hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

libpeconv

libPeConv 用于加载和操作 PE 文件的库。 目标 libPEConv 的目标是创建一个用于自定义加载 PE 文件的“瑞士军刀”。它汇集了各种辅助函数，您可以快速将它们集成到自己的加载器中。例如：重新映射节区、应用重定位、加载导入、解析资源。 它不仅允许加载 PE 文件，还允许自定义某些步骤，例如 IAT 挂钩（通过提供自定义 IAT 解析器）和函数重定向。但是，它并不专注于内联挂钩，不应与 MS Detours 或 MinHook 等库混淆。 LibPeConv 可用于创建 PE 绑定器，因为它允许直接从资源中加载 PE，并将其当作本地代码一样集成。...

PELoader

PELoader PELoader implement various shellcode injection techniques, and use libpeconv library to load encrypted PE files instead of injecting shellcode into remote thread. Following techniques were implemented: Module Stomping LoadLibrary Module Stomping NtMapViewOfSection PoC Transacted Hollowin...

EUVD-2023-27561

Malicious code in bioql PyPI...

EUVD-2023-27562

Malicious code in bioql PyPI...

CVE-2023-23462

Libpeconv – integer overflow, before commit 75b1565 30/11/2022...

CVE-2023-23461

Libpeconv – access violation, before commit b076013 30/11/2022...

CVE-2023-23461

Libpeconv – access violation, before commit b076013 30/11/2022...

CVE-2023-23462

Libpeconv – integer overflow, before commit 75b1565 30/11/2022...

Integer overflow

Libpeconv – integer overflow, before commit 75b1565 30/11/2022...

Code injection

Libpeconv – access violation, before commit b076013 30/11/2022...

CVE-2023-23461 Libpeconv – access violation

Libpeconv – access violation, before commit b076013 30/11/2022...

CVE-2023-23462 Libpeconv – integer overflow

Libpeconv – integer overflow, before commit 75b1565 30/11/2022...

CVE-2023-23462 Libpeconv – integer overflow

Libpeconv – integer overflow, before commit 75b1565 30/11/2022...

CVE-2023-23461 Libpeconv – access violation

Libpeconv – access violation, before commit b076013 30/11/2022...

Libpeconv 安全漏洞

libPeConv is a library for loading and manipulating PE files by hasherezade individual developers. A security vulnerability exists in versions prior to libpeconv b076013 30/11/2022, which stems from an access conflict issue...

Libpeconv 输入验证错误漏洞

libPeConv is a library for loading and manipulating PE files by hasherezade individual developers. A security vulnerability exists in versions prior to Libpeconv 75b1565 30/11/2022 that stems from the presence of an integer overflow...

CVE-2023-23462

CVE-2023-23462 maps to Libpeconv with an integer overflow in versions prior to the fix commit 75b1565 (30/11/2022). Multiple sources (NVD entry, CNNVD, PRION, CVE lists) describe Libpeconv as a library for loading/manipulating PE files and confirm an overflow condition tied to pre-commit code. Th...

CVE-2023-23461

CVE-2023-23461 refers to a Libpeconv vulnerability: an access violation in versions prior to commit b076013 (29/11/2022). The CVSSv3.1 base score is 9.8 (CRITICAL) with NETWORK attack vector, no privileges/user interaction required, and impacts to confidentiality, integrity, and availability repo...