how-to-bypass-aslr-on-linux-x86_64

Breaking 64 bit aslr on Linux x86-64 In this article, I'll discuss about the application of the technique described by Samuel Groß in his Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass, to bypass ASLR on Linux x8664. To show this I'm gonna solve a...

Huan

Huan Huan is an encrypted PE Loader Generator that I developed for learning PE file structure and PE loading processes. It encrypts the PE file to be run with different keys each time and embeds it in a new section of the loader binary. Currently, it works on 64 bit PE files. How It Works? First,...

heappy

🙂 Heappy: a happy heap editor Heappy is an editor based on gdb/gef that helps you to handle the heap during your exploitation development. The project should be considered a didactic tool useful to understand the evolution of the heap during the process life cycle. It has been created to simplify...

cs_yara

csyara Check Cobalt Strike Yara Rules 参考链接 https://github.com/CCob/BeaconEye BeaconEye Bug Fix: https://wbglil.gitbook.io/cobalt-strike/cobalt-strike-gong-ji-fang-yu/untitled-1 rule from https://raw.githubusercontent.com/CCob/BeaconEye/master/BeaconEye.cs beaconEye.yar rule CobaltStrike strings:...

quipu

Quipu A desktop workbench for writing, validating, compiling, and testing YARA rules. Quipu pronounced “KEE-poo” brings a project explorer, a YARA-aware editor, the YARA-X compiler, and focused scan results into one local application. It embeds both YARA-X and its language server, so you do not...

vxlang-page

VxLang Contents Docs What is VxLang? Supported File Formats Preview Virtualization Preview Dual-Mode Preview Obfuscation Preview Code-Flattening Preview Tutorial Usage & Guide-Code Precautions How to get the full version Donate and Subscription Patreon Link Event Extension-Codes and Plug-in...

azurelinux

Azure Linux 4 An open-source Linux distribution built and optimized forAzure, with sources derived from Fedora Linux. Azure Linux provides a secured, reliable operating system for virtual machines, containers, and bare-metal platforms. Azure Linux is built on a robust open-source foundation from...

striga

Striga Striga is an experimental x86-64 to LLVM IR lifter written in Python. It uses the experimental llvm-nanobind project. Examples uv run python lift.py uv run python brighten.py uv run python binaryshield.py lift.py lifts sample PE functions to LLVM IR. brighten.py demonstrates wrapping and...

kdmp-parser

kdmp-parser This C++ library parses Windows kernel full dumps .dump /f in WinDbg, BMP dumps .dump /ka in WinDbg as well as more recent dump types that were introduced in 2022. The library supports loading 64-bit dumps and provides read access to things like: The context record, The exception...

nocturne

nocturne Named after one of my favorite games, "nocturne" is a bin2bin x86-64 PE code virtualizer and binary rewriter. Features Native Call Bridge 30+ VM Handlers Built-in junk code obfuscation Thread-safe per-invocation VM state Usage To use the Nocturne virtualizer, copy and include...

MCPTrace

MCPTrace Latest release: v0.3.0 · Release notes Current source: post-v0.3.0 development; the changes below have not been tagged as a new release. MCPTrace is a Volatility 3 plugin for extracting MCP/JSON-RPC message candidates from Windows and Linux memory dumps. It examines process memory for...

Z0FCourse_ReverseEngineering

Reverse Engineering Course This course aims to take an individual from beginner to intermediate advanced is really only achieved through experience in reverse engineering. While this course focuses on Windows 64-bit, the technical knowledge applies to 32-bit Windows and the theory to any OS. The...

drow

drow Description TL;DR drow is a command-line utility that is used to inject code and hook the entrypoint of ELF executables post-build. It takes unmodified ELF executables as input and exports a modified ELF contianing an embedded user-supplied payload that executes at runtime. Slightly more...

hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

monomorph

════════════════════════════════════╦═══ ╔═╦═╗ ╔═╗ ╔═╗ ╔═╗ ╔═╦═╗ ╔═╗ ╔══╔═╗ ╠═╗ ═╩ ╩ ╩═╚═╝═╩ ╩═╚═╝═╩ ╩ ╩═╚═╝═╩ ╠═╝═╩ ╩═ ════════════════════════════════╩═══════ By Retr0id ═══ MD5-Monomorphic Shellcode Packer ═══ USAGE: python3 monomorph.py inputfile outputfile payloadfile What does it do? It pac...

covirt

covirt An x86-64 code virtualizer for VM based obfuscation. Features Stack-based virtual machine architecture MBA, self-modifying code obfuscation Support for both PE and ELF binaries Code markers to define protected regions PE support only tested on binaries compiled via MinGW-w64 Getting starte...

EVENSTAR

EVENSTAR Intel 64/Windows low-level experiments...

LdrLockLiberator

LdrLockLiberator For when DLLMain is the only way LdrLockLiberator is a collection of techniques for escaping or otherwise forgoing Loader Lock while executing your code from DllMain or anywhere else the lock may be present. It was released in conjunction with the "Perfect DLL Hijacking" article...

ASM-Obfuscator

ASM-Obfuscator Advanced x86-64 assembly obfuscator. Description The Assembly Code Obfuscator is a powerful and versatile tool designed to enhance the security of your x86-64 assembly code. It shields your projects from reverse engineering and analysis by employing a wide range of obfuscation...

Fix-WinVerifyTrustSignatureValidationVuln

Fix-WinVerifyTrustSignatureValidationVuln Fix WinVerifyTrust Signature Validation Vulnerability, CVE-2013-39001, QID-3783322 This Fix is intended for 64-bit Windows Computers This PowerShell code is one way to fix the vulnerability - aside from creating a .reg file and using reg import to import...