Skip to content

Latest commit

 

History

History
14 lines (10 loc) · 746 Bytes

File metadata and controls

14 lines (10 loc) · 746 Bytes

Wraith

A handle hijacking implementation for a given process, using Aether as the dynamic direct syscall wrapper.
There's no practical need to use direct syscalls in your own process for handle hijacking, but it was a good exercise to show actual use of Aether This implementation uses std::optional because I think it's underappreciated!

Showcase

Example Implementation

Notes

This is for educational purposes only. Handle hijacking is typically either blocked or detected by EDRs and kernel-mode anti-cheat solutions, so this technique has limited real-world applicability.

Credits

NtDoc for NtAPI Definitions