[Deprecated, work in progress alternative: https://github.com/M2Team/NanaRun] Series of System Administration Tools

x64 Dynamic Reverse Engineering Toolkit

大灰狼远控木马 V9.5 源码

Stealthy UM <-> KM communication system without creating any system threads, permanent hooks, driver objects, section objects or device objects.

Research on Anti-malware and other related security solutions

External Base for Valorant

Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution

The windows kernel debugger consists of two parts, KMOD which is the kernel driver handling ring3 request and KCLI, the command line interface for the driver. It originated due to insufficient useability with CheatEngine's DBVM driver while debugging games running under certain AntiCheat software.

This script is used to bypass DLL Hooking using a fresh mapped copy of ntdll file, patch the ETW and trigger a shellcode with process hollowing

A Respondus LockDown Browser Bypass

XOR 加密 分离免杀

Bypassing antivirus detection: old-school malware, new tricks

Simple method of checking whether or not mouse movement or buttons (<windows 10) are injected

A Kernel Driver that can be used for a cheat or malware base to circumvent common cache & structure table checks. PsLoadedModuleList however requires a PG Bypass on (Some) Machines > 22H2 Win10, Not Win 11

Changes assembly by adding extra instructions, these instructions don't change the end result of the register. We do this as vac scans for patterns of code, by changing the assembly, we make the pattern scanning harder for the anticheat. This is not a vac bypass, only should be used as a way to bypass the anti cheat whilst using other methods.

DLL Hijacking and Mock directories technique to bypass Windows UAC security feature and getting high-level privileged reverse shell. Security researchers identified this technique which uses a simplified process of DLL hijacking and mock folders to bypass UAC control. I tested this on Windows 10,11 and bypassed Windows 10 UAC security feature.

(Sim)ulate (Ba)zar Loader

A Simple AntiCensorship Tool developed using C/C++ Programming Language for Windows

RumbleFighter GameGuard bypass written with C++ 11 using win32

CS:GO Addon