damen0909 Goto Github PK

al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

atls

A lite TLS implementation used for learning: TLS 1.0 TLS 1.1 TLS 1.2 TLS 1.3 GMSSL 1.1(国密SSL) based on libcrypto.so.

awesome-vmp

虚拟化保护（VMP壳）分析相关资料

blackbone

Windows memory hacking library

cryptopp

free C++ class library of cryptographic schemes

dlltoshellcode

Fast Conversion Windows Dynamic Link Library To ShellCode

dokany

User mode file system library for windows with FUSE Wrapper

dwm_overlay

PoC: DX11 overlay over DWM

dxx

Windows Kernel Driver with C++ runtime

goodbyeedr

hades-windows

Purity toolsHades A HIDS is designed run on Windows

heu_kms_activator

hidden

Windows driver with usermode interface which can hide objects of file-system and registry, protect processes and etc

hvpp

hvpp is a lightweight Intel x64/VT-x hypervisor written in C++ focused primarily on virtualization of already running operating system

hyperdbg

The HyperDbg project is a hypervisor-based, kernel-mode, and user-mode debugger that aims to bring innovative ideas to the debuggers world!

hyperhide

Hypervisor based anti anti debug plugin for x64dbg

imgui

Dear ImGui: Bloat-free Immediate Mode Graphical User interface for C++ with minimal dependencies

infhook19041

infinityhook

Hook system calls, context switches, page faults and more.

infinityhookpro

InfinityHookPro Win7 -> Win11 latest

kdu

Kernel Driver Utility

kernel-bridge

Windows kernel hacking framework, driver template, hypervisor and API written on C++

ksm

A fast, hackable and simple x64 VT-x hypervisor for Windows and Linux. Builtin userspace sandbox and introspection engine.

lessonattachments

memprocfs

The Memory Process File System

novmp

A static devirtualizer for VMProtect x64 3.x. powered by VTIL.

openssl_test

OpenSSL's usage

pafish

Pafish is a demonstration tool that employs several techniques to detect sandboxes and analysis environments in the same way as malware families do.

pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

process-dump

Windows tool for dumping malware PE files from memory back to disk for analysis.