xec412/NocturneLdr

A EDR bypassing shellcode loader framework for Windows 10 64bit, featuring ETW/AMSI patching, Tartarus Gate, process protection and more

A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Sleep Obfuscation.

Six-layer call-stack spoofing via .pdata lacunae — defeats ETW-Ti, kernel callbacks, CET shadow stack, and return-address validation in a single composite chain.

An AdaptixC2 Loader with Advanced Evasion, Such as Phantom DLL Hollowing | Stack Spoof | Sleep Mask | CFG Bypass | CET Bypass

Dynamic shellcode loader with sophisticated evasion capabilities

Moonwalk++: Simple POC Combining StackMoonwalking and Memory Encryption

A Windows x64 offensive research framework that constructs fully synthetic call stacks

Use NtProtectVirtualMemory in Ekko timers without needing to use stack pivoting or other RSP shifting tricks

P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an execution and staging location for shellcode injection into remote processes, without triggering common detection mechanisms.