admin

WaryasSWHE

C++ 0 0

Updated 2025-11-26 18:53:29 +08:00

mash_hypervisor

C++ 0 0

mash hypervisor host pml4

hypervisor

Updated 2025-11-24 15:47:24 +08:00

APT_Step_Bear_Inject

C++ 0 0

复现《EDR的梦魇：Storm-0978使用新型内核注入技术“Step Bear”》

Updated 2025-11-24 15:46:51 +08:00

DuckMemoryScan

C++ 0 0

检测绝大部分所谓的内存免杀马

Updated 2025-11-24 15:46:28 +08:00

csgo2_tiny_server_plugin_system

C++ 0 0

a server plugin system for cs2 server,power by lua

cs2 csgo csgo-server csgo2

Updated 2025-11-24 15:46:13 +08:00

traffic-duck

C++ 0 0

traffic duck

Updated 2025-11-24 15:45:30 +08:00

cpu_duck

C++ 0 0

关于intel和amd指令行为不一样这件事

Updated 2025-11-24 15:45:10 +08:00

Etw-Syscall

C++ 0 0

https://key08.com/index.php/2021/10/19/1375.html

Updated 2025-11-24 15:44:55 +08:00

PresentHookDetection

C++ 0 0

Updated 2025-11-24 15:44:31 +08:00

CobaltStrikeDetected

C++ 0 0

40行代码检测到大部分CobaltStrike的shellcode

Updated 2025-11-24 15:43:28 +08:00

DuckSandboxDetect

C++ 0 0

沙箱测试,测评国内常见沙箱的代码与结论

Updated 2025-11-24 15:43:11 +08:00

CowInjecter

C++ 0 0

滥用cow机制进行全局注入

Updated 2025-11-24 15:42:32 +08:00

efi-memory

C++ 0 0

PoC EFI runtime driver for memory r/w & kdmapper fork

Updated 2025-11-24 15:41:25 +08:00

pdfwkrnl-exploit

C++ 0 0

abusing signed pdfwkrnl.sys for kernel function calling from usermode.

dkom exploit kernel kernel-exploit pdfwkrnl vulnerable-driver

Updated 2025-11-24 15:40:28 +08:00

driverMapper

C++ 0 0

An Unsigned Driver Mapper for Windows 10 22H2 -> Windows 11 23H2 that uses PdFwKrnl to exploit the Read/Write IOCTL Calls to disable DSE & PG to map the unsigned driver.

Updated 2025-11-24 15:40:09 +08:00