ppid-spoofing
Here are 7 public repositories matching this topic...
Windows usermode rootkit with inline hooking for process/file/registry hiding, indirect syscalls, keylogger, HTTPS C2, dropper, and EDR/AV evasion.
-
Updated
Jan 22, 2026 - C++
Advanced shellcode loader with AES-256, EDR/AMSI/ETW bypass, indirect syscalls.
-
Updated
Jan 11, 2026 - C
Advanced Windows PE Injector (x86/x64, C++17, MSVC 19+). Manual mapping of DLLs (Run export call) + full EXE injection into svchost.exe. Direct syscall stubs, PPID spoofing (explorer.exe), randomized base, PE headers/IAT/TLS/relocs handling, trampoline execution.
-
Updated
Mar 18, 2026 - C++
The project consists of a service that utilizes advanced techniques to inject a Payload into its own process, specifically the Windows RuntimeBroker.exe
-
Updated
Jul 3, 2024 - C
🛡️ Explore a simple Windows usermode rootkit for educational purposes, showcasing privilege escalation, stealth features, and remote management capabilities.
-
Updated
Jan 2, 2026
Improve this page
Add a description, image, and links to the ppid-spoofing topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the ppid-spoofing topic, visit your repo's landing page and select "manage topics."