DuplicateDump

DuplicateDump DuplicateDump هو فرع من MirrorDump مع التعديلات التالية: تنفيذ DInovke برنامج LSA plugin DLL مكتوب بلغة C++ يمكن تنظيفه بعد تفريغ LSASS. يقوم MirrorDump بتجميع LSA plugin كـ .NET assembly لا يمكن تفريغها بواسطة عملية LSASS. لهذا السبب فشل MirrorDump في حذف البرنامج المساعد. تتم مشار...

Nim_DInvoke

Nim DInvoke Implémentation de D/Invoke en Nim Tous les binaires Nim exposent généralement les mêmes 58 à 60 fonctions de l'API Windows : Toutes les autres fonctions de l'API Windows sont généralement résolues à l'exécution via GetProcAddress et LoadLibraryA, comme mentionné dans OffensiveNim ou c...

DInvoke

DInvoke Windows에서 PInvoke를 대체하는 동적 라이브러리입니다. DInvoke는 강력한 프리미티브를 포함하며, 이를 지능적으로 결합하여 디스크 또는 메모리에서 비관리 코드를 정밀하게 동적으로 호출할 수 있습니다. PE 파싱, 지능적인 동적 API 해석, 런타임 시 PE 플러그인 동적 로드, 프로세스 인젝션, API 후크 회피 등 다양한 목적으로 사용될 수 있습니다. 기능: PInvoke 없이 비관리 API 동적 호출 전략적 API 후크 회피를 가능하게 하는 프리미티브 관리 코드에서 비관리 PE 모듈 수동 매핑...

nimvoke

nimvoke Appels système indirects + DInvoke rendus simples. Conçue pour être importée directement dans vos propres projets Nim, nimvoke utilise des macros pour abstraire les détails de la réalisation d'appels système indirects et des déclarations de délégués de style DInvoke. Cette bibliothèque se...

Fiber - Using Fibers To Run In-Memory Code In A Different And Stealthy Way

A fiber is a unit of execution that must be manually scheduled by the application rather than rely on the priority-based scheduling mechanism built into Windows. Fibers are often called lightweight threads. For more detailed information about what are and how fibers work consult the official...

DuplicateDump - Dumping LSASS With A Duplicated Handle From Custom LSA Plugin

DuplicateDump is a fork of MirrorDump with following modifications: DInovke implementation LSA plugin DLL written in C++ which could be clean up after dumping LSASS. MirrorDump compile LSA plugin as .NET assembly which would not be unloaded by LSASS process. That's why MirrorDump failed to delete...

DInjector - Collection Of Shellcode Injection Techniques Packed In A D/Invoke Weaponized DLL

This repository is an accumulation of my code snippets for various shellcode injection techniques using fantastic D/Invoke API by @TheWover and @FuzzySecurity. Features: Fully ported to D/Invoke API Encrypted payloads which can be invoked from a URL or passed in base64 as an argument Built-in AMS...

LOLBITS v2.0.0 - C2 Framework That Uses Background Intelligent Transfer Service (BITS) As Communication Protocol And Direct Syscalls + Dinvoke For EDR User-Mode Hooking Evasion

LOLBITS is a C2 framework that uses Microsoft's Background Intelligent Transfer Service BITS to establish the communication channel between the compromised host and the backend. The C2 backend is hidden behind an apparently harmless flask web application and it's only accesible when the HTTP...