lbxloom Goto Github PK

km-um-communication

A somewhat wide collection of various kernelmode-usermode communication methods in one repository (mainly just for learning purposes).

kmexts

Simple driver to register all available process, thread, image, Registry, and Object callbacks

kpdb

Windows PDB parser for kernel-mode environment.

lazy_importer

library for importing functions from dlls in a hidden, reverse engineer unfriendly way

lazzzy

laZzzy is a shellcode loader, developed using different open-source libraries, that demonstrates different execution techniques.

lilypublic

meme-rw

Archive R/W into any protected process by changing the value of KTHREAD->PreviousMode

milfuscator

x86 PE Mutator

mirage

kernel-mode Anti-Anti-Debug plugin. based on intel vt-x && ept technology

nmistackwalk

no-crt-template

simple c++ visual studio project that doesn't use the C/C++ runtime

no_access_protection

nohv

Kernel driver for detecting Intel VT-x hypervisors.

nomercy

Open source anti cheat

ollvm-12.x

obfuscator-llvm 移植到llvm12.x.

pagetablehook

pagewalkr

An x64 page table iterator written in C++ as a kernel mode windows driver.

pediycrawler

看雪论坛 个人信息以及精华帖获取

permanent-hwid-spoofer

pi-defender

Kernel Security driver used to block past, current and future process injection techniques on Windows Operating System.

poseidon

stealthy UM <-> KM communication system without creating any system threads, permanent hooks, driver objects, section objects or device objects.

pplcontrol

Controlling Windows PP(L)s

protect_process

ptbypass-poc

Bypassing code hooks detection in modern anti-rootkits via building faked PTE entries.

pubg-pak-hacker

use windows kernel deriver hidden file and itself to Bypass BE

re_sysdiag

逆向火绒安全软件驱动——sysdiag

readwritedriver

A kernel driver for reading and writing memory

remap

return-address-spoofer

Illustrates the concept of return address spoofing, and how it is used.

rw-no-attach