Jack Ullrich

ShellcodeStdio. An extensible framework for easily writing compiler optimized position independent x86 / x64 shellcode for windows platforms.

syscall-detect. PoC capable of detecting manual syscalls from usermode.

memfuck. A PoC designed to bypass all usermode hooks in a WoW64 environment.

Windows-API-Fuzzer. Designed to learn OS specific anti-emulation patterns by fuzzing the Windows API.

TRunPE. A modified RunPE (process hollowing) technique avoiding the usage of SetThreadContext by appending a TLS section which calls the original entrypoint.

universal-syscall-64. Resolve syscall numbers at runtime for all Windows versions.

AADBrokerDecrypt. C#

EmulateMe. Showing how proof-of-work can be used to evade antivirus emulators.