Process Hollowing Injector (C)
C source for process hollowing (RunPE): NtUnmapViewOfSection + PEB image-base fix-up + RWX to RX. Prebuilt x86/x64 demo binaries included.
Arsenal
Professional offensive security tools & exploit frameworks
98
Tools
12
Categories
Reflective DLL Injection Template
Position-independent reflective loader (PEB walk, relocations, imports) with injector harness. Prebuilt x86/x64 binaries. No disk, no LoadLibrary.
Python RAT Core Module
Complete Python 3 RAT framework: C2 server with operator console, implant agent, and standalone generator. AES-256-GCM with pure-Python fallback, anti-analysis, persistence.
Shellcode Encoder x86/x64
Encoder with 5 PIC schemes (xor, rc4, sub-add, insertion, polymorphic) + AES-128-CTR. Real NASM stubs for x86 and x64, 83/83 tests pass.
Windows Rootkit Driver (WDM)
WDM kernel driver (x64): DKOM process hiding, NTFS IRP hook, nsiproxy MIB filtering, CmRegisterCallbackEx protection. User-mode loader included.
Keylogger Module (Win32 API)
WH_KEYBOARD_LL keylogger: window-title context, XOR log rotation, HTTPS exfiltration, Run-key persistence. Prebuilt x86/x64 binaries + decryptor.
PE Packer/Crypter Source
AES-128-CTR PE packer with self-decrypting NASM stub (.zion section), stub anti-debug and TLS callback re-execution. 17/17 emulation tests.
Fileless Malware Loader (PowerShell)
PowerShell in-memory loader: dual-arch AMSI patch, Assembly::Load, shellcode runner, and manual PE mapping with relocations and imports.
C2 Communication Protocol Library
HTTPS/DNS/ICMP C2 library with unified API: AES-256-GCM, anti-replay, fixed DNS chunking, real task delivery. Server handler included.
Persistence Techniques Cookbook (Windows)
10 MITRE-mapped persistence techniques with install/check/remove. v1.1: binPath quoting and honest AppInit_DLLs documentation.