ExpLife0011

awesome-windows-kernel-security-development. windows kernel security development

IDAPython_Note. IDAPython 's note

CVE-2019-0803. Win32k Elevation of Privilege Poc

Sagaan-AntiCheat-V2.0. Anti Cheat i made in my free time. Credits to everyone who helped are in the files and some are in the code. I will definitely improve this Anti Cheat along the way, now its just beta. Enjoy.

anti-anti-vm-detection-dll-1. C++

snifferview. C

KeUserModeCallBack. A Simple Example

WinFaults. A small header file mapping status codes passed to KiExceptionDispatch before KiPreprocessFault to individual CPU faults.

KernelModeMonitor. Kernel-Mode driver and User-Mode application communication project

vdebug. C

RegEditX. Enhanced Registry Editor

AimKit-Pasted-Driver. The BlackBone paste that GreenTea denies he pasted

NtCompareSigningLevel-hook. swap the function pointer in NtCompareSigningLevels for undetected driver communication.

MoaRpm. The Mother-of-All ReadProcessMemory Classes

SAC-Sagaan-AntiCheat-SignatureScanner-. This is a usermode program which just scans signatures of any loaded modules in csgo. This does require you to get signatures of cheats for your game and so on

SAC-Sagaan-AntiCheat-OverlayDetector-. This is a usermode program which basically scans windows to check if they are overlay. The program will scan for WS_VISIBLE, WS_EX_LAYERED, WS_EX_TRANSPARENT and any overlay which takes up >90% of the screen. Enjoy!

sfilter-1. 内核过滤器

portable-executable-resource-editor. Open source interfaces of WinAPI (BeginUpdateResource, UpdateResource, EndUpdateResource) for PE32 & PE32+ files.

-RpcViewEx. C++

TaskSchedLPE. Task Scheduler LPE by SandboxEscaper

smbdoor. kernel backdoor via registering a malicious SMB handler

kernel_window_hide. 内核级别隐藏指定窗口

SAC-Sagaan-AntiCheat-Module-. This will be injected into your game, or just loaded up on start up. This checks for any extra modules which are loaded into the game

reflective-rewrite. Attempt to rewrite StephenFewers Reflective DLL Injection to make it a little more stealthy. Some code taken from Meterpreter & sRDI. Currently a work in progress.

HideDriver. Hide Driver，win7*64

Awesome-Windows-Exploitation-Study-References. List of Awesome Windows Exploitation Study References

gamesense-GUI. indigo hack base.

DeleteFileByCreateIrp. 通过创建Irp删除文件，代码抄袭自某杀毒软件*86部分，因此可以看到IDA痕迹

MemoryError. WorkInProgress

SyscallHook. System call hook for Windows 10 20H1

spice-usbdk. A Windows filter driver that supports redirection of USB traffic to user-space application, to be used by Spice USB redirection (windows client side).

MiniDrv. The empty driver created by vs2017 (single-binary can running from xp to win10)

ShellcodeLoader. Small tool to load shellcodes or PEs to analyze them

CVE-2022-21882. win32k LPE

SAC-Sagaan-AntiCheat-ModuleThread. This version of the anti cheat monitors the threads created and the modules loaded. will be working on this for awhile, stay tune for future updates!

iris. WinDbg extension to perform basic detection of common Windows exploit mitigations

LpcPoc. C

iDefender. iDefender（冰盾 - 终端主动防御系统）

QWidgetDemo. Qt编写的一些开源的demo，预计会有100多个，一直持续更新完善，代码简洁易懂注释详细，每个都是独立项目，非常适合初学者，代码随意传播使用，拒绝打赏和捐赠，欢迎留言评论！

wslam. WSL Anti-Malware

Windows-Hack-Programming.

WordEncrypt. Transparent Encryption

JDDebug. C++

RefleXXion. RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature array.

FuzzingPaper-1. Recent Fuzzing Paper

Fuzzing101. An step by step fuzzing tutorial. A GitHub Security Lab initiative

InfinityHookPro. InfinityHookPro Win7 -> Win11 latest

IDASignMaker. IDA高级技巧 API符号自动识别库 IDASignMaker

ShotHv. ShotHv

driver_callback_bypass_1909. 研究和移除各种内核回调,在anti anti cheat的路上越走越远

FOKS-TROT. minifilter双缓冲透明加解密过滤驱动

GameHacking. A Repository with all Things GameHacking.

kernel_gdi.

EncryptEngine. Transprent Encryption

os-tutorial. How to create an OS from scratch

CefBrowser. Qt CefBrowser [Windows/Mac OS]

docker-tutorial. :watermelon:犬小哈的 《Docker 学习教程》，( A Tutorial to Docker ) 带您玩转 Docker !!!

iMonitor. iMonitor（冰镜 - 终端行为分析系统）

iMonitorSDK. 系统监控开发套件（sysmon、promon、edr、终端安全、主机安全、零信任、上网行为管理）

MMInject. Kernel DLL Injector using NX Bit Swapping and VAD hide for hiding injected DLL