Hannn

SharpUnhooker. C# Based Universal API Unhooker

DCMB. Dont Call Me Back - Dynamic kernel callback resolver. Scan kernel callbacks in your system in a matter of seconds!

MeterPwrShell. Automated Tool That Generates The Perfect Meterpreter Powershell Payload

BetterXencrypt. A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs.

KPDB. Windows PDB parser for kernel-mode environment.

warbird-research. Find out how to bypass HVCI (or not). My own research on Microsoft Warbird (specifically in clipsp.sys)

TripleS. Extracting Syscall Stub, Modernized

SharpLoadLibrary. An attempt to make a LoadLibrary designed for offensive operations, in C# obviously.

SharpHalos. My implementation of Halo's Gate technique in C#

HalosUnhooker. Halos Gate-based NTAPI Unhooker

Win32kHooker. .data ptr swapper for newer win32k versions. (Supports Windows 11)

SyscallShuffler. Your NTDLL vaccine from modern direct syscall methods.

JALSI. JALSI - Just Another Lame Shellcode Injector

ReversePowernoid. Reverse TCP Powershell has never been this paranoid. (basically an Opsec-safe reverse powershell)

Breaking-Detecting-Direct-Syscall-Techniques. A repository filled with ideas to break/detect direct syscall techniques

SysGate. One gate to all syscalls!

NiceTryDLL. Nice try reading NTDLL from disk, nerd.

LocalAMSI.Fail. This is a port of AMSI.fail,i modify the code to make it C# 5 compatible and can be executed on Windows 10 without installing any extra requirements.AMSI.fail itself generates obfuscated PowerShell snippets that break or disable AMSI for the current process.

vuln-drivers. Documenting my journey reverse engineering vulnerable drivers in the wild.

sementara. Some random shits for random things

GetRektBoy724.

ZeroThreadKernel. Recursive and arbitrary code execution at kernel-level without a system thread creation

SISOP-2-2026-IT-052. daemon? more like demon

SISOP-3-2026-IT-052. communication is key type shi