lacuna-rs

lacuna-rs Suplantación de pila de llamadas mediante ghost-frame + syscalls indirectas en tiempo de ejecución para Windows x64 — portado a Rust. Portado desde LACUNA Chain lacunachain.c por Mohamed Alzhrani 0xmaz. lacuna-rs es un crate de Rust reutilizable que proporciona las mismas primitivas que...

DInvoke_rs

DInvokers Rust port of Dinvoke. DInvokers may be used for many purposes such as PE parsing, dynamic exported functions resolution, dynamically loading PE plugins at runtime, API hooks evasion and more. Features: Dynamically resolve and invoke undocumented Windows APIs from Rust. Primitives allowi...

DarkWidow

DarkWidow Una herramienta Dropper personalizable dirigida a Windows. Menciones honorables: 1. BlackHat Asia, 2024 - Call For Tools 2. BlackHat USA, 2024 - Call For Tools 3. BlackHat SecTor, 2024 - Call For Tools 4. BlackHat Europe, 2024 - Call For Tools 5. Wild West Hacking Fest 2024 - Arsenal...

acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

awesome-edr-bypass

Awesome EDR Bypass 🛡️ Awesome EDR Bypass Resources For Ethical Hacking ⚔️ EDR bypass technology is not just for attackers. Many malware now have EDR bypass capabilities, knowledge that pentesters and incident responders should also be aware of. This repository is not intended to be used to escalate...

NovaLdr

NovaLdr ⚜️ NovaLdr es un Module Stomping sin hilos escrito en Rust, diseñado como un proyecto de aprendizaje mientras se explora el mundo del desarrollo de malware. Utiliza técnicas avanzadas como syscalls indirectas y cifrado de cadenas para lograr sus funcionalidades. Este proyecto no pretende...

NullGate

NullGate This project implements a comfortable and modern way to use the NTAPI functions using indirect syscalls, coupled with the FreshyCalls method with a little twist for dynamic syscall number retrieval. It also uses a technique that I haven't seen being mentioned to bypass windows defender's...

rust_syscalls

RUSTSYSCALLS Прямые и косвенные системные вызовы с единой заглушкой и разрешением SSN во время выполнения для Windows. Возможности: Одна строка для всех ваших системных вызовов Хеширование имени функции на этапе компиляции Прямые или косвенные системные вызовы Поддержка x8664, WOW64 и нативного x...

Unwinder

Content SilentMoonWalk Description Credits Usage callfunction! macro indirectsyscall! macro Parameter passing Examples Calling kernel32.dll!Sleep Calling kernel32.dll!OpenProcess Calling NtDelayExecution as indirect syscall Concatenate macro calls Considerations Initial frame PoC Stack replacemen...

HWSyscalls

HWSyscalls Main Contributors Description HWSyscalls is a new method to execute indirect syscalls using 3 main components: Hardware breakpoints and Vectored Exception Handler to control the flow of execution. HalosGate is used to find syscall numbers and addresses. Creating a synthetic trampoline ...

DEFCON-31-Syscalls-Workshop

Indirect Syscalls: A journey from high to low RedOps | Red Team Village | DEF CON 31 Getting Started All the theory and playbooks for the exercises can be found in the wiki, which together with the prepared POCs is the heart of this project. The POCs for the exercises can be found here on the mai...

nimvoke

nimvoke Indirect syscalls + DInvoke made simple. Designed to be imported directly into your own Nim projects, nimvoke uses macros to absract away the details of making indirect system calls and DInvoke-style delegate declarations. This library is meant to be easy to use and relatively op-sec...

AtlasLdr

Atlas is a reflective x64 loader that has the following features: Features Retrieve of DLL and PE from a remote server Manual Mapping on a remote process Erase of the DOS Header and NTHeader Magic bytes Position independent code Use of indirect Syscalls ZwOpenProcess ZwAllocateVirtualMemory...

CallstackSpoofingPOC

Callstack spoofing + Indirect Syscalls POC This project consists of a simple C++ self-Injecting dropper focused on EDR evasion POC. To implement it, I have combined the use of Windows Thread Pooling to hide the call stack and the use of indirect syscalls to avoid hooking in the NTDLL...

hookchain

Hookchain Abstract - EN In the current digital security ecosystem, where threats evolve rapidly and with complexity, companies developing Endpoint Detection and Response EDR solutions are in constant search for innovations that not only keep up but also anticipate emerging attack vectors. In this...

DllNotificationInjection - A POC Of A New "Threadless" Process Injection Technique That Works By Utilizing The Concept Of DLL Notification Callbacks In Local And Remote Processes

DllNotificationInection is a POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and remote processes. An accompanying blog post with more details is available here: https://shorsec.io/blog/dll-notification-injection/ Ho...

AtomLdr - A DLL Loader With Advanced Evasive Features

A DLL Loader With Advanced Evasive Features Features: CRT library independent. The final DLL file, can run the payload by loading the DLL executing its entry point, or by executing the exported "Atom" function via the command line. DLL unhooking from \KnwonDlls\ directory, with no RWX sections. T...