NTDLL-Unhook

NTDLL 脱钩 通过原生API实现正确的ntdll.dll .text节脱钩。支持x86/x64/wow64。 工作原理 程序遍历PEB定位ntdll.dll基地址，手动解析PE导出表以解析NT...

malwoverview

Malwoverview !Alt...

SHGenOb

SHGenOB: Generador de Shellcode a partir de Código C PIC Introducción SHGenOB es una herramienta basada en Python diseñada para generar shellcode a partir de Código Independiente de Posición PIC escrito en C. Automatiza el proceso de compilar código C, extraer la sección .text y, opcionalmente,...

WindowsPatchDetector

Experimental Windows .text section Patch Detector ====================== Experimental: Windows .text section compare - disk versus memory Original Idea After reading about the Skeleton Key malware http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/ develop ...

cobaltstrike-sleepmask-yara

cobaltstrike-sleepmask-yara Just a git repo for the sleepmask detection rule i found in https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs tl;dr The tl;dr of it is that these bytes are part of the sleep mask kit unobfuscated .text section itsel...

Linux Distros Unpatched Vulnerability : CVE-2026-80688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - riscv: drop init from veccheckunalignedaccessspeedallcpus This function runs within a kthread and need not necessarily finish before system finishes boot and...

CVE-2024-57838 s390/entry: Mark IRQ entries to fix stack depot warnings

In the Linux kernel, the following vulnerability has been resolved: s390/entry: Mark IRQ entries to fix stack depot warnings The stack depot filters out everything outside of the top interrupt context as an uninteresting or irrelevant part of the stack traces. This helps with stack trace...