Mirrors
/
Windows-Rootkits
mirror of https://github.com/ciyze0101/Windows-Rootkits
6
0
Fork 0
Code Issues Projects Releases Wiki Activity
201 Commits 1 Branch 0 Tags 46 MiB
C 64.2%
C++ 35.7%
Go to file
LycorisGuard c7ed346f10 Update README.md 2020-11-21 12:31:41 +08:00
CheckKernelEATHook update 2018-08-15 14:46:23 +08:00
GetKernel32Addressx64 Add Comment 2018-08-14 13:58:20 +08:00
HideProcess ReadMe 2018-08-14 01:25:51 +08:00
HookDeviceIocontrlFile hook DeviceIoControl to log buffer for 32 and 64 bit 2018-08-19 16:38:19 +08:00
Inject delete 2020-11-20 14:05:22 +08:00
KernelHiddenExecute-master https://github.com/zouxianyu/KernelHiddenExecute 2020-11-06 17:47:17 +08:00
LoadImageCallBack update 2018-08-14 19:04:41 +08:00
MmLoadDriver https://bbs.pediy.com/thread-250514.htm 2020-11-06 17:37:31 +08:00
ProcessManager update 2018-08-14 20:00:00 +08:00
ProtectFilex64 update 2018-08-14 22:01:03 +08:00
ProtectFilex86 update 2018-08-14 21:58:47 +08:00
ProtectProcessx64 update 2018-08-14 22:03:25 +08:00
ReloadKernel-XP update 2018-08-15 14:53:14 +08:00
SSDT-SSSDT-Manager update 2018-08-14 22:22:43 +08:00
ZwQueryVirtualMemory update 2018-08-15 00:27:32 +08:00
.gitattributes 💥🐫 Added .gitattributes & .gitignore files 2016-08-28 22:03:20 +08:00
.gitignore 💥🐫 Added .gitattributes & .gitignore files 2016-08-28 22:03:20 +08:00
README.md Update README.md 2020-11-21 12:31:41 +08:00

README.md

Windows-Rootkits

CheckKernelEATHook

Reference 3600safeOpenSource

GetKernel32Addressx64

x64 use asm

HideProcess

HideProcess by Remove ProcessList in EPROCESS struct.

HookDeviceIocontrlFile

Reference IOCTL Fuzzer v1.2

Inject

atom-bombing-master
herpaderping-main
Process-Hollowing
ProcessDoppelgänging
ReflectiveDLLInjection
SetThreadContext to Inject support x64 and x86
SetWindowsHookEx to Inject
UserApcInject
ExtraWindowInject
CreateRemoteThread

LoadImageCallBack

Scan PE's IAT in PsSetLoadImageNotifyRoutine's callback

ProcessManager

Enum Process By PsLookupProcessByProcessId/travel Active List/PspCidTable
Hdie Process By Process Active List/PspCidTable
Monitor Process CreateInformation By PsSetCreateProcessNotifyRoutineEx

ProtectFilex64

Protect File in Windows 7 by ObRegisterCallbacks

ProtectFilex86

Hook NtSetInformationFile to change target file
Hook NtWriteFile to write the target file
Hook NtDeleteFile to delete the target file
bind keyboard Filter Driver to avoid "ctrl+c" copy the content

ProtectProcessx64

Protect Process in Windows 7 by ObRegisterCallbacks

ReloadKernel-XP

Reference 3600safeOpenSource

SSDT-SSSDT-Manager

Check SSDT/ShadowSSDT Hook/InlineHook
Resume SSDT/ShadowSSDT Hook/InlineHook

ZwQueryVirtualMemory

Enum Module By NtQueryVirtualMemory