Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)
-
Updated
Dec 17, 2024 - C#
#
ntdll-unhooking
Here are 11 public repositories matching this topic...
Dump lsass using only NTAPI functions creating 3 JSON and 1 ZIP file... and generate the MiniDump file later!
-
Updated
Dec 18, 2024 - C#
Bypass Credential Guard by patching WDigest.dll using only NTAPI functions
-
Updated
Dec 10, 2024 - C#
Inline syscalls made for MSVC supporting x64 and WOW64
microsoft windows syscalls syscall-fuzzer ssdt syscall-table ntdll syscall-hook ssdt-hook syscall-hooking ntdll-unhooking win32u
-
Updated
Jul 10, 2023 - C++
A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber
malware antivirus evasion bypass fiber dropper bypass-antivirus edr implant process-injection ntdll-unhooking systemfunction033
-
Updated
Feb 10, 2023 - C
Bypass the Event Trace Windows(ETW) and unhook ntdll.
-
Updated
Sep 29, 2023 - C
Unhook Ntdll.dll, Go & C++.
-
Updated
Jul 11, 2024 - C++
Overwrite ntdll.dll's ".text" section to bypass API hooking. Getting the clean dll from disk, Knowndlls folder, a debugged process or a URL
-
Updated
Jul 9, 2024 - C#
Overwrite ntdll.dll's ".text" section to bypass API hooking. Getting the clean dll from disk, Knowndlls folder or a debugged process
-
Updated
Jul 9, 2024 - Python
Overwrite ntdll.dll's ".text" section to bypass API hooking. Getting the clean dll from disk, Knowndlls folder or a debugged process
-
Updated
Jul 10, 2024 - Go
The project consists of a service that utilizes advanced techniques to inject a Payload into its own process, specifically the Windows RuntimeBroker.exe
c windows system service assembly x64 malware windows-service malware-research malware-development anti-debugging ntdll earlybird anti-debugger ppid-spoofing syswhisper ntdll-unhooking dllblockpolicy
-
Updated
Jul 3, 2024 - C
Improve this page
Add a description, image, and links to the ntdll-unhooking topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the ntdll-unhooking topic, visit your repo's landing page and select "manage topics."