Black-Angel-Rootkit
Black Angel is a Windows 11/10 x64 kernel mode rootkit. Rootkit can be loaded with enabled DSE while maintaining its full functionality. (by XaFF-XaFF)
inline_syscall
Inline syscalls made easy for windows on clang (by JustasMasiulis)
Our great sponsors
| Black-Angel-Rootkit | inline_syscall | |
|---|---|---|
| 2 | 1 | |
| 565 | 609 | |
| - | - | |
| 4.4 | 1.8 | |
| 6 months ago | almost 2 years ago | |
| C++ | C++ | |
| GNU General Public License v3.0 only | Apache License 2.0 |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Black-Angel-Rootkit
Posts with mentions or reviews of Black-Angel-Rootkit.
We have used some of these posts to build our list of alternatives
and similar projects.
inline_syscall
Posts with mentions or reviews of inline_syscall.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-03-16.
-
Can't do exploitation research on a novel unhooking approach without a database of the DLLs for every Windows version. Ideas?
https://github.com/JustasMasiulis/inline_syscall (AFAIK the only library that produces inline-able syscall stubs)
What are some alternatives?
When comparing Black-Angel-Rootkit and inline_syscall you can also consider the following projects:
Jormungandr - Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel.
SysWhispers2 - AV/EDR evasion via direct system calls.
ZwProcessHollowing - ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption
lazy_importer - library for importing functions from dlls in a hidden, reverse engineer unfriendly way
Kernel-Process-Hollowing - Windows x64 kernel mode rootkit process hollowing POC.
Corth - It's like Porth, but in C++. Yep, we're going full circle.
introvert