An open API service providing repository metadata for many open source software ecosystems.

GitHub topics: rootkit

memN0ps/illusion-rs 📦

Rusty Hypervisor - Windows UEFI Blue Pill Type-1 Hypervisor in Rust (Codename: Illusion)

Language: Rust - Size: 2.85 MB - Last synced at: about 6 hours ago - Pushed at: 10 months ago - Stars: 291 - Forks: 35

memN0ps/matrix-rs 📦

Rusty Hypervisor - Windows Kernel Blue Pill Type-2 Hypervisor in Rust (Codename: Matrix)

Language: Rust - Size: 2.58 MB - Last synced at: about 6 hours ago - Pushed at: 12 months ago - Stars: 289 - Forks: 32

gmh5225/kli-ex

Expanding Kernel Lazy Importer

Language: C++ - Size: 118 KB - Last synced at: 2 days ago - Pushed at: over 2 years ago - Stars: 32 - Forks: 9

kouzhudong/AntiHook

Enum and Remove Hook in Windows

Size: 18.3 MB - Last synced at: 3 days ago - Pushed at: 3 days ago - Stars: 39 - Forks: 9

sudoskys/Root

?什么你说Root?我不到啊 | 致力于编写全面详细的Root教程文档 | 刷机 | 安卓

Size: 54.3 MB - Last synced at: 2 days ago - Pushed at: 11 months ago - Stars: 440 - Forks: 26

OriganOH/PhantomJS-Rootkit

👻 PhantomJS - Advanced Security Toolkit 🛡️

Language: JavaScript - Size: 17.6 KB - Last synced at: 4 days ago - Pushed at: 4 days ago - Stars: 1 - Forks: 0

grisuno/LazyOwn

LazyOwn RedTeam/APT Framework is the first RedTeam Framework with an AI-powered C&C, featuring rootkits to conceal campaigns, undetectable malleable implants compatible with Windows/Linux/Mac OSX, and self-configuring backdoors. With its Web interface and powerful Console Client, it is the best combination for your RedTeam/APT campaigns.

Language: HTML - Size: 259 MB - Last synced at: 5 days ago - Pushed at: 5 days ago - Stars: 68 - Forks: 25

GeorgevirSingh/dark-kill

# dark-killA user-mode code and its rootkit that permanently kills EDR processes using Process Creation Blocking Kernel Callback Routine and ZwTerminateProcess. ⚙️ This project includes instructions for building both the client and the driver, ensuring a smooth setup. 🛠️

Language: C++ - Size: 13.7 KB - Last synced at: 5 days ago - Pushed at: 5 days ago - Stars: 1 - Forks: 0

provrb/react

Remote Elevation and Persistence Access Control Technique. User mode rootkit that takes advantage of System32 mock directory and DLL Hijacking. Created for education purposes and not to be distributed.

Language: C - Size: 96.7 MB - Last synced at: 6 days ago - Pushed at: 6 days ago - Stars: 4 - Forks: 2

ldpreload/Medusa

LD_PRELOAD Rootkit

Language: C - Size: 708 KB - Last synced at: 4 days ago - Pushed at: 3 months ago - Stars: 254 - Forks: 63

SaadAhla/dark-kill

A user-mode code and its rootkit that will Kill EDR Processes permanently by leveraging the power of Process Creation Blocking Kernel Callback Routine registering and ZwTerminateProcess.

Language: C++ - Size: 15.6 KB - Last synced at: 7 days ago - Pushed at: 14 days ago - Stars: 141 - Forks: 35

MatheuZSecurity/Rootkit

Collection of codes focused on Linux rootkits

Language: C - Size: 74.6 MB - Last synced at: 2 days ago - Pushed at: 10 days ago - Stars: 130 - Forks: 32

cr0nx/awesome-linux-attack-forensics-purplelabs

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

Size: 95.7 KB - Last synced at: 7 days ago - Pushed at: over 2 years ago - Stars: 289 - Forks: 38

CYBER-MRINAL/LINUX-DEFENDER

Linux-Defender 🛡️ A robust Linux hardening script for securing your system in one shot ⚙️🔐 ✅ Checks for rootkits, malware, and suspicious activity 🔥 Configures firewall, antivirus, and audit tools 🎯 Supports Arch, Debian, Kali, and Parrot OS 🕵️‍♂️ Includes kali-anonsurf support for anonymous browsing on Kali

Language: Shell - Size: 67.4 KB - Last synced at: 9 days ago - Pushed at: 9 days ago - Stars: 2 - Forks: 0

jussihi/SMM-Rootkit

SMM rootkit similar to LoJax or MosaicRegressor

Language: C - Size: 214 KB - Last synced at: 1 day ago - Pushed at: over 1 year ago - Stars: 125 - Forks: 29

gmh5225/CallMeWin32kDriver

Load your driver like win32k.sys

Language: C++ - Size: 23.4 KB - Last synced at: 2 days ago - Pushed at: almost 3 years ago - Stars: 255 - Forks: 75

memN0ps/eagle-rs 📦

Rusty Rootkit - Windows Kernel Rookit in Rust (Codename: Eagle)

Language: Rust - Size: 450 KB - Last synced at: 4 days ago - Pushed at: about 2 years ago - Stars: 559 - Forks: 71

milabs/awesome-linux-rootkits

awesome-linux-rootkits

Size: 74.2 KB - Last synced at: 11 days ago - Pushed at: 6 months ago - Stars: 1,856 - Forks: 249

jm33-m0/emp3r0r

Linux/Windows post-exploitation framework made by linux user

Language: Go - Size: 144 MB - Last synced at: 12 days ago - Pushed at: 12 days ago - Stars: 1,555 - Forks: 268

rwxrob/bonzai

Dashist CLI framework, batteries included

Language: Go - Size: 3.86 MB - Last synced at: 3 days ago - Pushed at: 6 months ago - Stars: 227 - Forks: 22

mempodippy/vlany

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)

Language: C - Size: 1.17 MB - Last synced at: 6 days ago - Pushed at: over 4 years ago - Stars: 956 - Forks: 195

ExpLife0011/awesome-windows-kernel-security-development

windows kernel security development

Size: 3.25 MB - Last synced at: 11 days ago - Pushed at: almost 3 years ago - Stars: 2,010 - Forks: 539

mephistolist/tito

In-Memory Rootkit For Linux

Language: Shell - Size: 360 KB - Last synced at: 15 days ago - Pushed at: 15 days ago - Stars: 70 - Forks: 11

3a1/Elysium

UEFI Bootkit that bypass signature checks to load unsigned driver as mcupdate.dll

Language: C - Size: 314 KB - Last synced at: 15 days ago - Pushed at: 15 days ago - Stars: 0 - Forks: 0

DualHorizon/blackpill

A Linux kernel rootkit in Rust using a custom made type-2 hypervisor, eBPF XDP and TC programs

Language: Rust - Size: 282 KB - Last synced at: 13 days ago - Pushed at: 6 months ago - Stars: 326 - Forks: 41

faris77s/rootkit

rootkit password 1

Size: 2.87 MB - Last synced at: 16 days ago - Pushed at: 16 days ago - Stars: 4 - Forks: 2

Gui774ume/ebpfkit

ebpfkit is a rootkit powered by eBPF

Language: C - Size: 7.63 MB - Last synced at: 8 days ago - Pushed at: over 2 years ago - Stars: 800 - Forks: 93

alfonmga/hiding-cryptominers-linux-rootkit 📦

Linux rootkit POC to hide a crypto miner's process and CPU usage.

Language: C - Size: 19.5 KB - Last synced at: 5 days ago - Pushed at: over 1 year ago - Stars: 76 - Forks: 39

sad0p/d0zer

Elf binary infector written in Go.

Language: Go - Size: 136 KB - Last synced at: 1 day ago - Pushed at: 5 months ago - Stars: 210 - Forks: 36

slep2-0/WindowsRootkit

Read the README

Language: C++ - Size: 235 KB - Last synced at: 18 days ago - Pushed at: 18 days ago - Stars: 5 - Forks: 0

ait-aecid/caraxes

Academic research rootkit using ftrace-hooking to hide files and processes via magic word or user/group. Tested until Linux 6.11.

Language: C - Size: 143 KB - Last synced at: 19 days ago - Pushed at: 19 days ago - Stars: 23 - Forks: 0

bitdefender/hvmi

Hypervisor Memory Introspection Core Library

Language: C - Size: 13.5 MB - Last synced at: 14 days ago - Pushed at: about 1 year ago - Stars: 648 - Forks: 68

ait-testbed/attackmate

AttackMate is an attack orchestration tool that executes full attack-chains based on playbooks.

Language: Python - Size: 8.81 MB - Last synced at: 18 days ago - Pushed at: about 1 month ago - Stars: 36 - Forks: 6

theSecHunter/Hades-Windows

Hades HIDS/HIPS for Windows

Language: C++ - Size: 484 MB - Last synced at: 21 days ago - Pushed at: 21 days ago - Stars: 280 - Forks: 94

MatheuZSecurity/ElfDoor-gcc

ElfDoor-gcc is an LD_PRELOAD that hijacks gcc to inject malicious code into binaries during linking, without touching the source code.

Language: C - Size: 519 KB - Last synced at: 21 days ago - Pushed at: 2 months ago - Stars: 111 - Forks: 16

adamhlt/Basic-Rootkit

POC Ring3 Windows Rootkit (x86 / x64) - Hide processes and files

Language: C++ - Size: 788 KB - Last synced at: 4 days ago - Pushed at: almost 2 years ago - Stars: 55 - Forks: 19

mrexodia/TitanHide

Hiding kernel-driver for x86/x64.

Language: C - Size: 847 KB - Last synced at: 23 days ago - Pushed at: 23 days ago - Stars: 2,315 - Forks: 437

MatheuZSecurity/UnhookingLinuxEdr

Attacking the cleanup_module function of a kernel module

Size: 11.7 KB - Last synced at: 21 days ago - Pushed at: 3 months ago - Stars: 35 - Forks: 11

Horyxima/Simple-RunPE-Process-Hollowing

The RunPE program is written in C# to execute a specific executable file within another files memory using the ProcessHollowing technique.

Language: C# - Size: 47.9 KB - Last synced at: 24 days ago - Pushed at: 24 days ago - Stars: 0 - Forks: 0

daem0nc0re/VectorKernel

PoCs for Kernelmode rootkit techniques research.

Language: C# - Size: 17.5 MB - Last synced at: 5 days ago - Pushed at: 5 months ago - Stars: 375 - Forks: 62

brosck/Frosty

「🧊」Ring 3 Rootkit for Windows 10

Language: C - Size: 425 KB - Last synced at: 22 days ago - Pushed at: 7 months ago - Stars: 57 - Forks: 16

ngn13/shrk

LKM rootkit for modern kernels, with DNS C2 and a simple web interface

Language: C - Size: 898 KB - Last synced at: 22 days ago - Pushed at: 3 months ago - Stars: 69 - Forks: 8

joaoviictorti/shadow-rs

Windows Kernel Rootkit in Rust

Language: Rust - Size: 459 KB - Last synced at: 26 days ago - Pushed at: 26 days ago - Stars: 604 - Forks: 66

AxtMueller/Windows-Batch-Deployment

A programmable and rootkit-like Windows remote access tool.

Size: 94.1 MB - Last synced at: 14 days ago - Pushed at: about 1 year ago - Stars: 139 - Forks: 50

xl7dev/WebShell

Webshell && Backdoor Collection

Language: PHP - Size: 23.4 MB - Last synced at: 26 days ago - Pushed at: about 5 years ago - Stars: 1,893 - Forks: 1,036

m0nad/Diamorphine

LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)

Language: C - Size: 28.3 KB - Last synced at: 26 days ago - Pushed at: almost 2 years ago - Stars: 2,038 - Forks: 458

bytecode77/r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

Language: C - Size: 5.08 MB - Last synced at: 27 days ago - Pushed at: 3 months ago - Stars: 1,931 - Forks: 433

UEFI-code/Linux-Danger

Forget Ring3. Run EVERYTHING in Ring0!

Language: C - Size: 147 MB - Last synced at: 20 days ago - Pushed at: about 2 months ago - Stars: 1 - Forks: 2

HARM4Y/Karlann

It's a kernel-based keylogger for Windows x86/x64.

Language: C - Size: 354 KB - Last synced at: 20 days ago - Pushed at: almost 3 years ago - Stars: 139 - Forks: 50

0xbitx/DEDSEC_BOTNET

Linux-based botnet builder designed for creating advanced botnet payloads.

Size: 19 MB - Last synced at: 26 days ago - Pushed at: 30 days ago - Stars: 87 - Forks: 16

thebigcicca/HiddenGhost

HiddenGhost is an new solution for find system call table with support for 5.7x kernels +

Language: C - Size: 98.6 KB - Last synced at: 4 days ago - Pushed at: about 1 month ago - Stars: 4 - Forks: 1

3intermute/arm64_silent_syscall_hook

silent syscall hooking without modifying sys_call_table/handlers via patching exception handler

Language: C - Size: 58.6 KB - Last synced at: 12 days ago - Pushed at: about 1 year ago - Stars: 131 - Forks: 38

XaFF-XaFF/Black-Angel-Rootkit

Black Angel is a Windows 11/10 x64 kernel mode rootkit. Rootkit can be loaded with enabled DSE while maintaining its full functionality.

Language: C++ - Size: 173 KB - Last synced at: about 1 month ago - Pushed at: over 1 year ago - Stars: 640 - Forks: 110

XaFF-XaFF/Cronos-Rootkit

Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.

Language: C++ - Size: 10.6 MB - Last synced at: about 1 month ago - Pushed at: about 3 years ago - Stars: 907 - Forks: 187

skyw4tch3r/RootKits-List-Download

This is the list of all rootkits found so far on github and other sites.

Size: 24.4 KB - Last synced at: about 1 month ago - Pushed at: about 2 years ago - Stars: 1,329 - Forks: 385

h3xduck/TripleCross

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

Language: C - Size: 86.4 MB - Last synced at: about 1 month ago - Pushed at: about 1 year ago - Stars: 1,851 - Forks: 233

Uyriahz/Simple-RunPE-Process-Hollowing

The RunPE program is written in C# to execute a specific executable file within another files memory using the ProcessHollowing technique.

Language: C# - Size: 42 KB - Last synced at: about 1 month ago - Pushed at: about 1 month ago - Stars: 0 - Forks: 0

Cr4sh/s6_pcie_microblaze

PCI Express DIY hacking toolkit for Xilinx SP605. This repository is also home of Hyper-V Backdoor and Boot Backdoor, check readme for links and info

Language: C - Size: 38.4 MB - Last synced at: about 1 month ago - Pushed at: about 1 year ago - Stars: 795 - Forks: 162

JKornev/hidden

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

Language: C - Size: 665 KB - Last synced at: about 1 month ago - Pushed at: almost 3 years ago - Stars: 1,904 - Forks: 495

Yaianyang/Simple-RunPE-Process-Hollowing

The RunPE program is written in C# to execute a specific executable file within another files memory using the ProcessHollowing technique.

Language: C# - Size: 42 KB - Last synced at: about 1 month ago - Pushed at: about 1 month ago - Stars: 0 - Forks: 0

Idov31/Nidhogg

Nidhogg is an all-in-one simple to use windows kernel rootkit.

Language: C++ - Size: 723 KB - Last synced at: about 1 month ago - Pushed at: 2 months ago - Stars: 1,985 - Forks: 290

KeyaShah03/KernelSU

A Kernel based root solution for Android

Language: Kotlin - Size: 11.9 MB - Last synced at: about 1 month ago - Pushed at: about 1 month ago - Stars: 0 - Forks: 0

RUTHER-DEV/Process-Hider

Hide processes from Task Manager by manually mapping itself into it and hooking NtQuerySystemInformation

Language: C++ - Size: 26.4 KB - Last synced at: about 1 month ago - Pushed at: about 1 month ago - Stars: 0 - Forks: 0

screetsec/Vegile

This tool will setting up your backdoor/rootkits when backdoor already setup it will be hidden your spesisifc process,unlimited your session in metasploit and transparent. Even when it killed, it will re-run again. There always be a procces which while run another process,So we can assume that this procces is unstopable like a Ghost in The Shell

Language: Shell - Size: 48.8 KB - Last synced at: about 1 month ago - Pushed at: almost 3 years ago - Stars: 730 - Forks: 164

vkobel/linux-syscall-hook-rootkit

Simple kernel module that hooks the `execve` syscall and waits for `date` to be executed with the `backd00r` argument followed by a PID number, elevating it to root credentials.

Language: C - Size: 19.5 KB - Last synced at: 21 days ago - Pushed at: about 5 years ago - Stars: 24 - Forks: 4

tkmru/awesome-linux-rootkits

a summary of linux rootkits published on GitHub

Size: 3.91 KB - Last synced at: 10 days ago - Pushed at: about 5 years ago - Stars: 177 - Forks: 23

byt3n33dl3/Isabella

Rootkit and Kernel attack kit, 𝗜𝘀𝗮𝗯𝗲𝗹𝗹𝗮 program Enables Cyber Attacks to gain access from Machines without being detected.

Language: C - Size: 31.3 KB - Last synced at: 2 days ago - Pushed at: 11 months ago - Stars: 10 - Forks: 1

landhb/HideProcess

A basic Direct Kernel Object Manipulation rootkit that removes a process from the EPROCESS list, hiding it from the Task Manager

Language: C - Size: 6.85 MB - Last synced at: about 1 month ago - Pushed at: about 6 years ago - Stars: 676 - Forks: 116

mav8557/Father

LD_PRELOAD rootkit

Language: C - Size: 47.9 KB - Last synced at: 15 days ago - Pushed at: over 1 year ago - Stars: 132 - Forks: 32

Lucas-Paz-Silva/titan

Next.js 15 fullstack template with better-auth for authentication and drizzle-orm as the orm

Language: TypeScript - Size: 421 KB - Last synced at: about 1 month ago - Pushed at: about 1 month ago - Stars: 0 - Forks: 0

Washaion/Simple-RunPE-Process-Hollowing

The RunPE program is written in C# to execute a specific executable file within another files memory using the ProcessHollowing technique.

Language: C# - Size: 42 KB - Last synced at: about 1 month ago - Pushed at: about 1 month ago - Stars: 0 - Forks: 0

rphang/evilBPF

Weaponizing the Linux Kernel (Hide Files/PID, SSH backdoors, SSL Sniffer, ...) by poking around eBPF/XDP

Language: C - Size: 1.8 MB - Last synced at: 20 days ago - Pushed at: 10 months ago - Stars: 52 - Forks: 15

malefax/Adrishya

Author of Project Adrishya a rootkit which use ftrace mechanism to hook syscall; (write this because God commanded me); work for both x86_64 and arm; CREDIT-(Oleksii Lozovskyi{ilammy})FOUNDER OF FTRACE HOOKING

Language: C - Size: 493 KB - Last synced at: about 1 month ago - Pushed at: about 1 month ago - Stars: 14 - Forks: 1

gmh5225/Driver-SoulExtraction

SoulExtraction is a windows driver library for extracting cert information in windows drivers

Language: C - Size: 91.8 KB - Last synced at: 2 days ago - Pushed at: over 2 years ago - Stars: 24 - Forks: 6

MatheuZSecurity/ModTracer

ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again.

Language: C - Size: 36.1 KB - Last synced at: about 1 month ago - Pushed at: 4 months ago - Stars: 80 - Forks: 10

Taimenak/Simple-RunPE-Process-Hollowing

The RunPE program is written in C# to execute a specific executable file within another files memory using the ProcessHollowing technique.

Language: C# - Size: 39.1 KB - Last synced at: about 1 month ago - Pushed at: about 1 month ago - Stars: 0 - Forks: 0

h3xduck/Umbra

A LKM rootkit targeting 4.x and 5.x kernel versions which opens a backdoor that can spawn a reverse shell to a remote host, launch malware and more.

Language: C - Size: 190 MB - Last synced at: 9 days ago - Pushed at: almost 4 years ago - Stars: 127 - Forks: 28

nullcel/dollarnine

A self-propagating worm driven by an embedded rootkit

Language: C++ - Size: 3.49 MB - Last synced at: about 1 month ago - Pushed at: about 1 month ago - Stars: 0 - Forks: 0

MikeHorn-git/LKD

Linux Kernel development lab. With LKM rootkit samples

Language: C - Size: 27.3 KB - Last synced at: about 1 month ago - Pushed at: about 2 months ago - Stars: 5 - Forks: 0

sapellaniz/lkm_unhide

LKM unhide is a LKM Rootkits Detection Tool for Linux Kernels 5.x/6.x.

Language: C - Size: 1000 Bytes - Last synced at: about 2 months ago - Pushed at: about 2 months ago - Stars: 0 - Forks: 0

XaFF-XaFF/Kernel-Process-Hollowing

Windows x64 kernel mode rootkit process hollowing POC.

Language: C++ - Size: 27.3 KB - Last synced at: about 1 month ago - Pushed at: almost 2 years ago - Stars: 189 - Forks: 27

Reakt0rPhantom/Stuxnet-Rootkit

Stuxnet extracted binaries by reversing & Stuxnet Rootkit Analysis

Size: 0 Bytes - Last synced at: about 2 months ago - Pushed at: about 2 months ago - Stars: 0 - Forks: 0

eversinc33/Banshee

Experimental Windows x64 Kernel Rootkit with anti-rootkit evasion features.

Language: C++ - Size: 666 KB - Last synced at: about 2 months ago - Pushed at: about 2 months ago - Stars: 535 - Forks: 78

loneicewolf/LOJAX

LOJAX ROOTKIT (UEFI) +PDF Included[x]

Size: 2.43 MB - Last synced at: about 1 month ago - Pushed at: over 2 years ago - Stars: 33 - Forks: 14

Qiunzman/Simple-RunPE-Process-Hollowing

The RunPE program is written in C# to execute a specific executable file within another files memory using the ProcessHollowing technique.

Language: C# - Size: 39.1 KB - Last synced at: about 2 months ago - Pushed at: about 2 months ago - Stars: 0 - Forks: 0

UmaRex01/YMC

A plug-and-play, extendible and customizable Windows driver that lands your malware capabilities in kernel-land.

Size: 4.88 KB - Last synced at: about 2 months ago - Pushed at: about 2 months ago - Stars: 0 - Forks: 0

b3c001/bico_lkm

Bico_LKM é um rootkit escrito em C e possui funcionamento em nivel de kernel (ring0)

Language: C - Size: 37.1 KB - Last synced at: about 2 months ago - Pushed at: about 2 months ago - Stars: 3 - Forks: 0

carloslack/KoviD

Red-Team Linux kernel rootkit

Language: C - Size: 26.8 MB - Last synced at: about 2 months ago - Pushed at: 2 months ago - Stars: 362 - Forks: 60

KastMain/Simple-RunPE-Process-Hollowing

The RunPE program is written in C# to execute a specific executable file within another files memory using the ProcessHollowing technique.

Language: C# - Size: 38.1 KB - Last synced at: about 2 months ago - Pushed at: about 2 months ago - Stars: 0 - Forks: 0

UEFI-code/WindowsDanger

A REALLY Danger Windows Driver, Turn Any threads Ring0!

Language: C - Size: 98.6 MB - Last synced at: about 1 month ago - Pushed at: 3 months ago - Stars: 8 - Forks: 3

idchoppers/nt_rootkit

A kernel mode rootkit for NT.

Language: C - Size: 97.7 KB - Last synced at: 2 months ago - Pushed at: 2 months ago - Stars: 1 - Forks: 0

therealdreg/cgaty

Hooking the GDT - Installing a Call Gate. POC for Rootkit Arsenal Book Second Edition (version 2022)

Language: C - Size: 253 MB - Last synced at: about 15 hours ago - Pushed at: almost 2 years ago - Stars: 72 - Forks: 14

nurupo/rootkit

Linux rootkit for Ubuntu 16.04 and 10.04 (Linux Kernels 4.4.0 and 2.6.32), both i386 and amd64

Language: C - Size: 25.4 KB - Last synced at: about 1 month ago - Pushed at: about 1 year ago - Stars: 798 - Forks: 202

guill777/ElfDoor-gcc

ElfDoor-gcc is an LD_PRELOAD that hijacks gcc to inject malicious code into binaries during linking, without touching the source code.

Language: C - Size: 519 KB - Last synced at: 2 months ago - Pushed at: 2 months ago - Stars: 0 - Forks: 0

0xbitx/DEDSEC_ZIPHITE

Linux-based tool that injects covert malicious code into a legitimate Python script.

Size: 6.84 MB - Last synced at: 26 days ago - Pushed at: 2 months ago - Stars: 0 - Forks: 1

Idov31/Jormungandr

Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel.

Language: C++ - Size: 48.8 KB - Last synced at: 2 months ago - Pushed at: over 1 year ago - Stars: 225 - Forks: 27

Gui774ume/ebpfkit-monitor

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

Language: C - Size: 168 KB - Last synced at: 3 months ago - Pushed at: over 2 years ago - Stars: 128 - Forks: 17

flashnuke/mod-rootkit

Kernel-space x86_64 Linux rootkit leveraging kprobes and ftrace for syscall hooking (hiding entries and reverse shell backdoor)

Language: C - Size: 161 KB - Last synced at: 3 months ago - Pushed at: 3 months ago - Stars: 7 - Forks: 0

rickmark/mojo_thor

Research about malware that infects the EFI and SMC of Apple MacBooks.

Language: Assembly - Size: 144 MB - Last synced at: 2 months ago - Pushed at: 3 months ago - Stars: 57 - Forks: 12

gmh5225/FakeEnclave

A poc that abuses Enclave

Language: C++ - Size: 12.7 KB - Last synced at: 2 days ago - Pushed at: almost 3 years ago - Stars: 38 - Forks: 8