Mirrors
/
Windows-Rootkits
mirror of https://github.com/ciyze0101/Windows-Rootkits
6
0
Fork 0
Code Issues Projects Releases Wiki Activity
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
201 Commits
1 Branch
0 Tags
46 MiB
 
 
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'master'
${ noResults }
Go to file
LycorisGuard c7ed346f10
Update README.md 		3 years ago
CheckKernelEATHook update 5 years ago
GetKernel32Addressx64 Add Comment 5 years ago
HideProcess ReadMe 5 years ago
HookDeviceIocontrlFile hook DeviceIoControl to log buffer for 32 and 64 bit 5 years ago
Inject delete 3 years ago
KernelHiddenExecute-master https://github.com/zouxianyu/KernelHiddenExecute 3 years ago
LoadImageCallBack update 5 years ago
MmLoadDriver https://bbs.pediy.com/thread-250514.htm 3 years ago
ProcessManager update 5 years ago
ProtectFilex64 update 5 years ago
ProtectFilex86 update 5 years ago
ProtectProcessx64 update 5 years ago
ReloadKernel-XP update 5 years ago
SSDT-SSSDT-Manager update 5 years ago
ZwQueryVirtualMemory update 5 years ago
.gitattributes 💥🐫 Added .gitattributes & .gitignore files 7 years ago
.gitignore 💥🐫 Added .gitattributes & .gitignore files 7 years ago
README.md Update README.md 3 years ago

README.md

Windows-Rootkits

CheckKernelEATHook

Reference 3600safeOpenSource

GetKernel32Addressx64

x64 use asm

HideProcess

HideProcess by Remove ProcessList in EPROCESS struct.

HookDeviceIocontrlFile

Reference IOCTL Fuzzer v1.2

Inject

atom-bombing-master
herpaderping-main
Process-Hollowing
ProcessDoppelgänging
ReflectiveDLLInjection
SetThreadContext to Inject support x64 and x86
SetWindowsHookEx to Inject
UserApcInject
ExtraWindowInject
CreateRemoteThread

LoadImageCallBack

Scan PE's IAT in PsSetLoadImageNotifyRoutine's callback

ProcessManager

Enum Process By PsLookupProcessByProcessId/travel Active List/PspCidTable
Hdie Process By Process Active List/PspCidTable
Monitor Process CreateInformation By PsSetCreateProcessNotifyRoutineEx

ProtectFilex64

Protect File in Windows 7 by ObRegisterCallbacks

ProtectFilex86

Hook NtSetInformationFile to change target file
Hook NtWriteFile to write the target file
Hook NtDeleteFile to delete the target file
bind keyboard Filter Driver to avoid "ctrl+c" copy the content

ProtectProcessx64

Protect Process in Windows 7 by ObRegisterCallbacks

ReloadKernel-XP

Reference 3600safeOpenSource

SSDT-SSSDT-Manager

Check SSDT/ShadowSSDT Hook/InlineHook
Resume SSDT/ShadowSSDT Hook/InlineHook

ZwQueryVirtualMemory

Enum Module By NtQueryVirtualMemory