NTDLL-Unhook

NTDLL Unhook proper ntdll .text section unhooking via native api. x86/x64/wow64 supported. How It Works The program walks the PEB to locate ntdll.dll base address and manually parses the PE export table to resolve NT API functions without touching the Import Address Table. It then uses NtOpenFile...

malwoverview

Malwoverview !Alt...

SHGenOb

SHGenOB: Shellcode Generator from PIC C Code Introduction SHGenOB is a Python-based tool designed to generate shellcode from Position Independent Code PIC written in C. It automates the process of compiling C code, extracting the .text section, and optionally encrypting the resulting shellcode...

WindowsPatchDetector

Experimental Windows .text section Patch Detector ====================== Experimental: Windows .text section compare - disk versus memory Original Idea After reading about the Skeleton Key malware http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/ develop ...

cobaltstrike-sleepmask-yara

cobaltstrike-sleepmask-yara Just a git repo for the sleepmask detection rule i found in https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs tl;dr The tl;dr of it is that these bytes are part of the sleep mask kit unobfuscated .text section itsel...

Linux Distros Unpatched Vulnerability : CVE-2026-80688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - riscv: drop init from veccheckunalignedaccessspeedallcpus This function runs within a kthread and need not necessarily finish before system finishes boot and...

CVE-2024-57838 s390/entry: Mark IRQ entries to fix stack depot warnings

In the Linux kernel, the following vulnerability has been resolved: s390/entry: Mark IRQ entries to fix stack depot warnings The stack depot filters out everything outside of the top interrupt context as an uninteresting or irrelevant part of the stack traces. This helps with stack trace...