xrombar/flower

Six-layer call-stack spoofing via .pdata lacunae — defeats ETW-Ti, kernel callbacks, CET shadow stack, and return-address validation in a single composite chain.

Moonwalk++: Simple POC Combining StackMoonwalking and Memory Encryption

A memory-based evasion technique which makes shellcode invisible from process start to end.

Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+BlockDll) mitigation policy on spawned process + PPID spoofing + Api resolving from TIB + API hashing

A Windows x64 offensive research framework that constructs fully synthetic call stacks

A EDR bypassing shellcode loader framework for Windows 10 64bit, featuring ETW/AMSI patching, Tartarus Gate, process protection and more

Endpoint and Lateral Movement Evasion

This is for Ethical Use only. The default automated binaries created are all burned. I have added the script to the repo to modify certain signatures and it will still work.

An AdaptixC2 Loader with Advanced Evasion, Such as Phantom DLL Hollowing | Stack Spoof | Sleep Mask | CFG Bypass | CET Bypass