Awesome

Windows-Rootkits

CheckKernelEATHook

Reference 3600safeOpenSource

GetKernel32Addressx64

x64 use asm

HideProcess

HideProcess by Remove ProcessList in EPROCESS struct.

HookDeviceIocontrlFile

Reference IOCTL Fuzzer v1.2

Inject

atom-bombing-master<br> herpaderping-main<br> Process-Hollowing<br> ProcessDoppelgänging<br> ReflectiveDLLInjection<br> SetThreadContext to Inject support x64 and x86<br> SetWindowsHookEx to Inject<br> UserApcInject<br> ExtraWindowInject<br> CreateRemoteThread<br>

LoadImageCallBack

Scan PE's IAT in PsSetLoadImageNotifyRoutine's callback

ProcessManager

Enum Process By PsLookupProcessByProcessId/travel Active List/PspCidTable<br> Hdie Process By Process Active List/PspCidTable<br> Monitor Process CreateInformation By PsSetCreateProcessNotifyRoutineEx<br>

ProtectFilex64

Protect File in Windows 7 by ObRegisterCallbacks

ProtectFilex86

Hook NtSetInformationFile to change target file<br> Hook NtWriteFile to write the target file<br> Hook NtDeleteFile to delete the target file<br> bind keyboard Filter Driver to avoid "ctrl+c" copy the content

ProtectProcessx64

Protect Process in Windows 7 by ObRegisterCallbacks

ReloadKernel-XP

Reference 3600safeOpenSource

SSDT-SSSDT-Manager

Check SSDT/ShadowSSDT Hook/InlineHook<br> Resume SSDT/ShadowSSDT Hook/InlineHook

ZwQueryVirtualMemory

Enum Module By NtQueryVirtualMemory