Popular repositories Loading

1. delete-self-poc delete-self-poc Public

   A way to delete a locked file, or current running executable, on disk.

   C 505 93

2. wsb-detect wsb-detect Public

   wsb-detect enables you to detect if you are running in Windows Sandbox ("WSB")

   C 356 45

3. ntqueueapcthreadex-ntdll-gadget-injection ntqueueapcthreadex-ntdll-gadget-injection Public

   This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret gadget can be used for stealthy code injection.

   C 232 32

4. Windows-API-Hashing Windows-API-Hashing Public

   This is a simple example and explanation of obfuscating API resolution via hashing

   C 229 37

5. shellcode-plain-sight shellcode-plain-sight Public

   Hiding shellcode in plain sight within a large memory region. Inspired by technique used by Raspberry Robin's Roshtyak

   C 176 30

6. elf-strings elf-strings Public archive

   elf-strings will programmatically read an ELF binary's string sections within a given binary. This is meant to be much like the strings UNIX utility, however is purpose built for ELF binaries.

   Go 140 16