inline_syscall
Inline syscalls made easy for windows on clang (by JustasMasiulis)
Black-Angel-Rootkit
Black Angel is a Windows 11/10 x64 kernel mode rootkit. Rootkit can be loaded with enabled DSE while maintaining its full functionality. (by XaFF-XaFF)
| inline_syscall | Black-Angel-Rootkit | |
|---|---|---|
| 1 | 2 | |
| 609 | 565 | |
| - | - | |
| 1.8 | 4.4 | |
| almost 2 years ago | 6 months ago | |
| C++ | C++ | |
| Apache License 2.0 | GNU General Public License v3.0 only |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
inline_syscall
Posts with mentions or reviews of inline_syscall.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-03-16.
-
Can't do exploitation research on a novel unhooking approach without a database of the DLLs for every Windows version. Ideas?
https://github.com/JustasMasiulis/inline_syscall (AFAIK the only library that produces inline-able syscall stubs)
Black-Angel-Rootkit
Posts with mentions or reviews of Black-Angel-Rootkit.
We have used some of these posts to build our list of alternatives
and similar projects.
What are some alternatives?
When comparing inline_syscall and Black-Angel-Rootkit you can also consider the following projects:
SysWhispers2 - AV/EDR evasion via direct system calls.
Jormungandr - Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel.
lazy_importer - library for importing functions from dlls in a hidden, reverse engineer unfriendly way
ZwProcessHollowing - ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption
Kernel-Process-Hollowing - Windows x64 kernel mode rootkit process hollowing POC.
Corth - It's like Porth, but in C++. Yep, we're going full circle.
introvert