kkent030315

anycall. x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration

evil-mhyprot-cli. A PoC for Mhyprot2.sys vulnerable driver that allowing read/write memory in kernel/user via unprivileged user process.

PageTableInjection. Code Injection, Inject malicious payload via pagetables pml4.

anymapper. x64 Windows kernel driver mapper, inject unsigned driver using anycall

NoPatchGuardCallback. x64 Windows PatchGuard bypass, register process-creation callbacks from unsigned code

CVE-2022-42046. CVE-2022-42046 Proof of Concept of wfshbr64.sys local privilege escalation via DKOM

MsIoExploit. Exploit MsIo vulnerable driver

libmhyprot. A static library, wrapper for mhyprot vulnerable driver, execute exploits and tests

NtSymbol. Resolve DOS MZ executable symbols at runtime

Van1338. A journal for $6,000 Riot Vanguard bounty.

razy_importer. Rust implementation of lazy_importer

anyvtop. x64 Windows implementation of virtual-address to physical-address translation

kernel_callbacks. Bypasses for Windows kernel callbacks PatchGuard protection

kdump. A kernel module dumper for Windows x64 using mhyprot vulnerable driver

EvilHooker. Function hooks in Windows NT Kernel

detect-anyrun. ANY.RUN sandbox detection collection

anyelevate. x64 Windows privilege elevation using anycall

ProcessVmAccess. Two PoC of accessing process virtual memory via NT Kernel

CiGetCertPublisherName. An example code of CiGetCertPublisherName

EQU8-PoC. A proof-of-concept to abuse EQU8 anti-cheat kernel driver

Process-Dumper. Memory Dumper For Win10 x64 Processes

ZemanaLPE. A proof-of-concept of local privilege escalation by exploiting Zemana AntiMalware/AntiLogger

CVE-2017-9769. A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to be opened to an arbitrary process.

libinject. A dll injector static library for Win x64 processes with handle elevation supported

rust-vcpu. Virtual CPU with its own architecture, written in Rust.

CSharp-AES-Algorithm. The AES algorithm implementation with C#

jekyll-twitter-theme. A twitter theme for Jekyll.

hcaptcha-module. hCaptcha integration with Nuxt.js

hhide. Windows x86-64 process protection w/ hiding handle via ObRegisterCallbacks

mold. Mold: A Modern Linker for Windows 🦠

kdmapper. KDMapper is a simple tool that exploits iqvw64e.sys Intel driver to manually map non-signed drivers in memory

IDARustCargo. Python

UnityMonoInject. Inject arbitrary managed code to the Unity games

lazy_importer. library for importing functions from dlls in a hidden, reverse engineer unfriendly way

kmp. C++

kernel32-imports. import list of kernel32.dll in Win10 1909 18363.1139

ExploitCapcom. This is a standalone exploit for a vulnerable feature in Capcom.sys

CheckPagingDrv. Read CR0 and Check Paging Flag

ntstatus. NTSTATUS bindings for Rust

vgrl1337. Vanguard vgrl.dll ordinal 1337 is a mystery

OverlayD3D9. Simple overlay using D3D9

notify-icon-rs. A safe, ergonomic Rust wrapper around the Windows Shell_NotifyIcon API for managing system tray icons on Windows platforms

libconsole. ✨ Beautiful printouts in Python

SHA256-Algorithm-CSharp. SHA256 Algorithm Implementation Using C#

goblin-experimental. (Experimental) An impish, cross-platform binary parsing crate, written in Rust

winapi-rs. Rust bindings to Windows API

PSVSEnv. Fork of PSVSEnv

scroll. Scroll - making scrolling through buffers fun since 2016

windows-service-rs. Windows services in Rust

goblin. An impish, cross-platform binary parsing crate, written in Rust

transacted_hollowing. Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging

twitcasting-py. An unofficial python module for wrapping TwitCasting common APIs

nest-google-recaptcha. Google recaptcha module for nestjs

reactos. A free Windows-compatible Operating System