zer0condition/mhydeath

Stars
376
Rank 113,810 (Top 3 %)
Language
C++
Created over 1 year ago
Updated over 1 year ago

zer0condition/mhydeath

zer0condition

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Abusing mhyprotect to kill AVs / EDRs / XDRs / Protected Processes.

mhydeath

Abusing mhyprotect (not mhyprot2) to kill AVs / EDRs / XDRs / Protected Processes.

Resources

https://github.com/ZeroMemoryEx/Terminator
https://github.com/kkent030315/evil-mhyprot-cli

Demo

Crowdstrike Falcon and MsDefender

ReverseKit

x64 Dynamic Reverse Engineering Toolkit

NVDrv

Abusing nvidia driver (nvoclock.sys) for physical/virtual memory and control register manipulation.

GDRVLoader

Unsigned driver loader using CVE-2018-19320

ZeroHVCI

Achieve arbitrary kernel read/writes/function calling in Hypervisor-Protected Code Integrity (HVCI) protected environments calling without admin permissions or kernel drivers.

ZeroThreadKernel

Recursive and arbitrary code execution at kernel-level without a system thread creation

Demystifying-PatchGuard

Demystifying PatchGuard is a comprehensive analysis of Microsoft's security feature called PatchGuard, which is designed to prevent unauthorized modifications to the Windows kernel. The analysis is done through practical engineering, with a focus on understanding PatchGuard's inner workings.

Reversing-a-signed-driver

Reverse Engineering a signed kernel driver packed and virtualized with VMProtect 3.6

Guarded-Regions-Bypass-Valorant

External Base for Valorant

GDRVLib

Virtual and physical memory hacking library using gigabyte vulnerable driver

Gloomy.cc-Fortnite

Open-Source External Fortnite Cheat

RWCommunication

IDTHook-x86

Detour hooking IRQ1 ISR through IDT (Interrupt Descriptor Table)

Valorant-External

CritBSOD

Abusing RtlAdjustPrivilege and NtSetInformationProcess to cause a BSOD from usermode

OffsetStreaming

Simple program to stream offsets for your game cheat, Was reversing some p2c and decided to recreate a better version of this function for fun

memoryPy

DriverPEScan

Parse all driver PEs in current directory to scan for certain characteristics or section names