Sheng-Hao Ma

RunPE-In-Memory. Run a Exe File (PE Module) in memory (like an Application Loader)

PR0CESS. some gadgets about windows process and ready to use :)

Skrull. Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted.

Windows-APT-Warfare. 著作《Windows APT Warfare：惡意程式前線戰術指南》各章節技術實作之原始碼內容

wowInjector. PoC: Exploit 32-bit Thread Snapshot of WOW64 to Take Over $RIP & Inject & Bypass Antivirus HIPS (HITB 2021)

my-Little-Ransomware. easy ransomware module base on csharp.

sakeInject. Windows PE - TLS (Thread Local Storage) Injector in C/C++

wowGrail. PoC: Rebuild A New Path Back to the Heaven's Gate (HITB 2021)

buyHouseAnalyzer. 開源台灣房市在線實價登錄分析工具

puzzCode. simple compiler based on mingw to build uncrackable windows application against analysis tools

wow64Jit. Call 32bit NtDLL API directly from WoW64 Layer

shellDev.py. tool for building windows shellcode in C by MinGW

theArk. Windows x86 PE Packer In C++

SignThief. Windows PE Signature Thief in C++

xlsKami. Out-of-the-Box Tool to Obfuscate Excel XLS. Include Obfuscation & Hide for Cell Labels & BoundSheets

vtMal. Malware Sandbox Emulation in Python @ HITCON 2018

ntkrnlProtectScan. One Click Tool to Scan All the Enabled Protection of current Windows NT Kernel

The-Purified-Elements. The Purified Windows 11: without Defender, Updater, Patches, System Health, etc.

xlsGen. (PoC) Tiny Excel BIFF8 Generator, to Embedded 4.0 Macros in xls files without Excel.

HellKitty-In-VC. Ring3 Rootkit Backdoor.

masqueradeCmdline. A PoC to demo modifying cmdline of the child process dynamically. It might be useful against process log tracing, AV or EDR.

madPocket. Play PokémonGo From Home, No Jailbreak!

dnLauncher. C

winInject101. Windows Injection 101: from Zero to ROP (HITCON 2017)

knownDlls_Poison. C

funcTracker. Useful Plugin for IDA to Trace Function Call Tree

Win-Exploit-Inject. PoC for DEF CON 26: Playing Malware Injection with Exploit thoughts

CrackShield-MapleStory-Hack. MapleStory Hack Plugin

Lexa. Windows Application Loader Running *.Exe files in Memory against Scrylla

APCInjector-BYPASS-AV. C++

isuMaster-NodeJS. 義守管家線上雲端服務

Whisper.py. 白癡喔還要下 pip install 誰會用啦—隨開即用 Windows 版 OpenAI Whisper 逐字稿產生器

PykemonGo. Play PokémonGo without hands, Based on Python, and Easy to fix.

moska. Tiny Windows x86 Assembly Compiler in C++ and Keystone Engine

goodGarena. Garena 競時通順暢開遊戲小補丁

WebBrowser-Control-GET-POST-Request-Hook-In-CSharp. Catch All HTTP Request In IE WebBrowser Control In C#

PowerCursor. Auto Move Your Cursor to the Focused Window while You Alt-Tab or Touchboard for Windows

OSX-Dyanmic-Hook. inline hook functions in memory on OSX

NTUSTxTDOH-Reversing-Game. NTUSTxTDOH 2015/11/15~29 Easy Crack Me

Chakra. Instagram 限時動態自動閱讀器

PkZIP-Unarchiver-in-C. Make stored PkZIP file unarchive in C

Algorithm. 一些演算法學習筆記

Win32-Debugger. 用CBuilder自幹Win32的除錯器.(搭配WinAPI)

easyChptchaOCR. 簡易義守選課驗證碼圖像100%辨識

vodka. .NET PE file parser in C/C++

Word2Vec.py. Word2Vec written in pure Numpy

engExamSystem-NodeJS. 基於 NodeJS 開發的英文克漏字線上測驗系統

BiuBiu. Control-Flow-Graph Analysis based on Radare2 In Python3

how-to-homework. C/C++ Dirty Work

Dad-sRoot. Easy Process Spy For Windows7 x32bit

IconJector. Unorthodox and stealthy way to inject a DLL into the explorer using icons

praHeapSpray. Heap Spray Practice

m00d1e.js. Get important information of moodle in node.js

C-CodingStyleHacker-In-CSharp. C#

NTUSTXTDOH_EasyBofBasic. 2015/12/27 台科BOF基礎講課Live Demo程式

FkBBTalk. 剃除該死的聊聊

googMeow. Google Search Ninja based on Python

capa. The FLARE team's open-source tool to identify capabilities in executable files.

defendnot. An even funnier way to disable windows defender. (through WSC api)

dc30-space-jam. Resources and demos from the DEFCON 30 Brief "Space Jam: Exploring Radio Frequency Attacks in Outer Space" by James Pavur