LazyHook

Overview LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems HIPS through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed...

Shelter

Shelter Shelter is a completely weaponized sleep obfuscation technique that allows to fully encrypt your in-memory payload making an extensive use of ROP. This crate comes with the following characteristics: AES-128 encryption. Whole PE encryption capability. Removal of execution permission durin...

SilentMoonwalk

SilentMoonwalk PoC Implementation of a fully dynamic call stack spoofer TL;DR SilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from control flow. Authors...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUIRED -m |region|referenced|ioc -p |PID OPTIONAL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...

ThreadStackSpoofer

Thread Stack Spoofing / Call Stack Spoofing PoC A PoC implementation for an advanced in-memory evasion technique that spoofs Thread Call Stack. This technique allows to bypass thread-based memory examination rules and better hide shellcodes while in-process memory. Intro This is an example...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

NimicStack

NimicStack NimicStack is the pure Nim implementation of Call Stack Spoofing technique to mimic legitimate programs. Whole project is based on the PoC shared by WithSecure Labs Compilation You can directly compile the source code with the following command: nim c -d=mingw --app=console --cpu=amd64...

Unwinder

Content SilentMoonWalk Description Credits Usage callfunction! macro indirectsyscall! macro Parameter passing Examples Calling kernel32.dll!Sleep Calling kernel32.dll!OpenProcess Calling NtDelayExecution as indirect syscall Concatenate macro calls Considerations Initial frame PoC Stack replacemen...

CallStackSpoofer

CallStackSpoofer This repository demonstrates a PoC implementation to spoof arbitrary call stacks when making system calls. For a full technical walkthrough please see the accompanying blog post here: https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs. By default it contains...

CallStackMasker

CallStackMasker This repository demonstrates a PoC technique for dynamically spoofing call stacks using timers. Prior to our implant sleeping, we can queue up timers to overwrite its call stack with a fake one and then restore the original before resuming execution. Hence, in the same way we can...

MassDriver

MassDriver Proxying sensitive API calls from shellcode to artifact for CET compatible clean call stacks. Companion PoC for my blog post: Stop Being Weird — Life After Call Stack Spoofing Under CET. Building MinGW does not have a way to set the CET compatibility flag so you will need llvm-mingw to...

GHSA-HQQ3-7JHF-C5JX Forge: Denial of service in TLS record processing via call stack exhaustion

Summary Connections created with forge.tls.createConnection processed received TLS records recursively, one stack level per record. A peer can send one chunk of thousands of small records, such as heartbeat records, which are accepted before the handshake, and process throws RangeError: Maximum...

EUVD-2026-113364

Forge: Denial of service in TLS record processing via call stack exhaustion...

Forge: Denial of service in TLS record processing via call stack exhaustion

Summary Connections created with forge.tls.createConnection processed received TLS records recursively, one stack level per record. A peer can send one chunk of thousands of small records, such as heartbeat records, which are accepted before the handshake, and process throws RangeError: Maximum...

npm: Forge: Denial of service in TLS record processing via call stack exhaustion

npm: Forge: Denial of service in TLS record processing via call stack exhaustion vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

CVE-2026-99018

A flaw was found in the Linux kernel's RISC-V architecture support. When Shadow Call Stack SCS, a security feature designed to protect function return addresses, is enabled, the kernel incorrectly validates whether an exception originated from userspace using a user-modifiable register. An...

CVE-2026-119187

A flaw was found in node-forge. The Transport Layer Security TLS implementation processes incoming records through recursive function calls instead of an iterative loop. An unauthenticated remote attacker can exploit this flaw by sending a network payload containing a large number of small TLS...

Linux Distros Unpatched Vulnerability : CVE-2026-119187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used...

CVE-2026-119187

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

CVE-2026-119187

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...