mgeeky/ThreadStackSpoofer

Health v2 · maintenance only

Adoption not part of the score

1242 stars · 191 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A proof-of-concept C++ implementation of thread call stack spoofing, an in-memory evasion technique that hides shellcode references from a thread's call stack. It is aimed at red teamers and security researchers demonstrating how to evade memory scanners, AVs, and EDRs.

Use cases

• hide shellcode memory allocations from EDR scanners
• spoof thread call stack during red team operations
• bypass thread-based memory examination rules
• study in-memory evasion techniques
• build offensive security tooling with call stack spoofing

When to choose

• you need a reference implementation of thread stack spoofing for Windows x64/x86
• you are researching EDR evasion or malware analysis techniques
• you want to improve call stack stealth in red team tooling

When to avoid

• you need a production-ready, supported security product
• you are looking for defensive detection tooling rather than offensive evasion
• you target non-Windows platforms

Facets

library · maturity maintenance

security reverse-engineering security penetration-testing windows windows cpp red-team evasion shellcode call-stack-spoofing edr-bypass poc malware-research

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mgeeky/ThreadStackSpoofer")