inline_syscall
Inline syscalls made easy for windows on clang (by JustasMasiulis)
Black-Angel-Rootkit
Black Angel is a Windows 11/10 x64 kernel mode rootkit. Rootkit can be loaded with enabled DSE while maintaining its full functionality. (by XaFF-XaFF)
| inline_syscall | Black-Angel-Rootkit | |
|---|---|---|
| 1 | 2 | |
| 696 | 631 | |
| 1.1% | 1.4% | |
| 3.4 | 4.4 | |
| 9 months ago | over 1 year ago | |
| C++ | C++ | |
| Apache License 2.0 | GNU General Public License v3.0 only |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
inline_syscall
Posts with mentions or reviews of inline_syscall.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-03-16.
-
Can't do exploitation research on a novel unhooking approach without a database of the DLLs for every Windows version. Ideas?
https://github.com/JustasMasiulis/inline_syscall (AFAIK the only library that produces inline-able syscall stubs)
Black-Angel-Rootkit
Posts with mentions or reviews of Black-Angel-Rootkit.
We have used some of these posts to build our list of alternatives
and similar projects.
What are some alternatives?
When comparing inline_syscall and Black-Angel-Rootkit you can also consider the following projects:
lazy_importer - library for importing functions from dlls in a hidden, reverse engineer unfriendly way
Kernel-Process-Hollowing - Windows x64 kernel mode rootkit process hollowing POC.
Corth - It's like Porth, but in C++. Yep, we're going full circle.
ZwProcessHollowing - ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption
Cronos-Rootkit - Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.