maldev 开源项目推荐（75 个）

cr-0w /maldev

⚠️ malware development

vari-sh /RedTeamGrimoire

🔥📜 Forbidden collection of Red Team sorcery 📜🔥

D3Ext /maldev

Golang library for malware development

rtecCyberSec /Packer_Development

Slides & Code snippets for a workshop held @ x33fcon 2024

oldboy21 /RflDllOb

Reflective DLL Injection Made Bella

Whispergate /Erebus

Erebus is an Initial Access wrapper for the Mythic Command & Control Server. It converts shellcode into payloads specifically used for phishing and IA operations.

Print3M /ByteCaster

Swiss Army Knife for payload encryption, obfuscation, and conversion to byte arrays – all in a single command (14 output formats supported)! ☢️

LongWayHomie /PolyEngine

PolyEngine is an evasive PE packer designed for CTF challenges and low-level Windows security education. It focuses on bypassing EDR and AV heuristics through a layered stack of in-memory execution and obfuscation techniques.

voidvxvi /HellBunny

Shellcode loader written in C and Assembly utilizing direct or indirect syscalls to evade UM EDR hooks

Print3M /epic

PIC shellcode (C/C++) development toolkit designed for malware developers.

Trevohack /Venom

A ring0 Loadable Kernel Module (Linux) for latest kernels 6.x

CaptMag /MalDev

Creation of multiple Malware tools consisting of evasion, enumeration and exploitation

Zuigetzu /Donut-CustomHost

Advanced OPSEC fork of Donut. Features a Custom in-memory CLR Host, Tail-Jump ETW bypasses, and zero-patch AMSI evasion for stealthy shellcode generation.

oldboy21 /SWAPPALA

In-memory hiding technique

hellokittyfan48 /process-hollowing

Process Hollowing PoC

0xbekoo /maldev

⚠️ Malware Development training ⚠️

HackLike-co /Cloak

Generate Secure, Polymorphic, Evasive (lol) Payloads

carved4 /go-crypter

A cryptographic payload loader and executor designed for advanced in-memory execution techniques. This project combines strong encryption, compression, and sophisticated evasion capabilities to execute both shellcode and PE files directly in memory.

carved4 /go-wincall

load arbitrary dlls, call any exported function, calls execute inside g0 as normal syscalls do from the traditional route, no syscall or windows imports, exposes many convenience functions for winapi interaction :3

GreySec-Security-Forums /Community-Articles

Articles, White Papers, Technical Write-Ups and more authored by members of the GreySec community. Curated by staff, selected for excellence.