Dor00tkit/BamExtensionTableHook
Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when attackers disable standard process notify callbacks.
Research on Windows Kernel Executive Callback Objects
Appears on
Quick read
Latest capture 2026-07-28 03:04
0 paths
Agent instructions and tool configuration found in this repository.
No config files detected.
3 observed captures since 2026-06-24. Charts use measured snapshots only.
Stars from first capture -2
All tracked data
Observed snapshots
Observed snapshots
Nearest indexed repositories by embedding similarity.
Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when attackers disable standard process notify callbacks.
Windows Object Explorer 64-bit
Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999
Windows Kernel Programming Experiments
No description.
Enumerating and removing kernel callbacks using signed vulnerable drivers