A proof-of-concept User-Defined Reflective Loader (UDRL) which aims to recreate, integrate, and enhance Cobalt Strike’s evasion features! Contributors: UDRL Usage …
Windiff – Web-based Tool That Allows Comparing Symbol, Type And Syscall Information Of Microsoft Windows Binaries Across Different Versions Of The OS
WinDiff is an open-source web-based tool that allows browsing and comparing symbol, type and syscall information of Microsoft Windows binaries …
AtomLdr – A DLL Loader With Advanced Evasive Features
A DLL Loader With Advanced Evasive Features Features: CRT library independent. The final DLL file, can run the payload by …
APCLdr – Payload Loader With Evasion Features
Payload Loader With Evasion Features. Features: no crt functions imported indirect syscalls using HellHall api hashing using CRC32 hashing algorithm …
Havoc – Modern and malleable post-exploitation command and control framework
Havoc is in an early state of release. Breaking changes may be made to APIs/core structures as the framework matures. …
laZzzy – Shellcode Loader, Developed Using Different Open-Source Libraries, That Demonstrates Different Execution Techniques
laZzzy is a shellcode loader that demonstrates different execution techniques commonly employed by malware. laZzzy was developed using different open-source …
Ropr – A Blazing Fast Multithreaded ROP Gadget Finder. Ropper / Ropgadget Alternative
ropr is a blazing fast multithreaded ROP Gadget finder What is a ROP Gadget? ROP (Return Oriented Programming) Gadgets are …
NimGetSyscallStub – Get Fresh Syscalls From A Fresh Ntdll.Dll Copy
Get fresh Syscalls from a fresh ntdll.dll copy. This code can be used as an alternative to the already published …
Nim-Loader – WIP Shellcode Loader In Nim With EDR Evasion Techniques
a very rough work-in-progress adventure into learning nim by cobbling resources together to create a shellcode loader that implements common …
Nanodump – A Crappy LSASS Dumper With No ASCII Art
A flexible tool that creates a minidump of the LSASS process. 1. Features It uses syscalls (with SysWhispers2) for most …