process-injection

Template-Driven AV/EDR Evasion Framework

Multilayered AV/EDR Evasion Framework (no longer actively maintained)

Centralized resource for listing and organizing known injection techniques and POCs

PE Injection、DLL Injection、Process Injection、Thread Injection、Code Injection、Shellcode Injection、ELF Injection、Dylib Injection, including 400+Tools and 350+posts

PE loader with various shellcode injection techniques

Materials for the workshop "Red Team Ops: Havoc 101"

Detects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process hollowing. Built in Rust for speed. Includes CLI and TUI interfaces.

🐟 PoC of a VBA macro spawning a process with a spoofed parent and command line.

Some DLL Injection techniques in C++ implemented for both x86 and x64 windows OS processes

This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret gadget can be used for stealthy code injection.

A C# DLL injection library

A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber

An open-source process injection enumeration tool written in C#

Kernel Security driver used to block past, current and future process injection techniques on Windows Operating System.

A dynamic unpacking tool

Shellcode loader written in C and Assembly utilizing direct or indirect syscalls to evade UM EDR hooks

Shellcode obfuscation tool to avoid AV/EDR.

Ghost Proxifier Pro 是一款专为 Windows 平台打造的高性能进程级透明代理引擎，旨在解决现代复杂网络环境下的两大痛点：「特定应用不走系统代理」以及「多重 VPN/代理路由冲突」。 核心亮点描述： 真正的进程级细粒度控制：不同于传统的全局代理或 TUN 模式，它基于 MinHook 直接拦截应用层 Winsock API。这意味着您可以精确指定某个进程（如 Chrome、游戏或特定工具）走代理，而无需修改系统全局路由表。 「全家桶」自动关联技术：Pro 版独有的进程追踪算法。只需接管母进程，它便能智能识别并自动拦截该软件启动的所有关联子进程，彻底告别繁琐的手动配置。 零侵入、高兼容：采用独创的 Lazy Handshake (延迟握手) 机制，完美兼容现代异步 IO

simple shellcode injector

Purple-team telemetry & simulation toolkit.