MappedImagesDetector

MappedImagesDetector Escáner nativo de memoria de Windows para detectar inyecciones maliciosas de DLL y malware en memoria MappedImagesDetector es una herramienta de Windows de bajo nivel en C++20 diseñada para detectar técnicas de inyección maliciosa de DLL utilizadas por malware moderno,...

InflativeLoading

InflativeLoading Artículo: https://winslow1984.com/books/malware/page/reflectiveloading-and-inflativeloading Historial de actualizaciones importantes En esta sección se proporcionan las actualizaciones importantes. Las actualizaciones importantes incluyen soporte o funcionalidades añadidas...

swapgs-attack-poc

SWAPGS攻击的PoC（CVE-2019-1125） 本仓库包含在2019年Black Hat USA上公开展示的SWAPGS攻击PoC的源代码。 内容 leakgsbkva - 变种1（在内核内存中查找随机值；仅限于PE内核映像头部） leakgsbkvat - 变种2（从内核内存中提取随机值；仅限于PE内核映像头部） 白皮书 Black Hat USA 2019演示文稿 前提条件 1. Visual Studio 2015 2. 未打补丁的Windows x64（7或更高版本） 作者 Andrei Vlad LUȚAȘ Dan Horea LUȚAȘ 额外资源 2019年Black...

PESTO

PESTO：PE（文件）统计工具 描述 PESTO 是一个 Python 脚本，用于提取 PE 文件的某些安全特征或标志，并将其保存到数据库中。它会搜索整个目录中的每个 PE 二进制文件，并将结果存入数据库。 它检查头文件中的架构标志，以及以下安全标志：ASLR、NOSEH、DEP 和 CFG。代码足够清晰，您可以根据需要修改标志和格式。 更多详情和标志说明请参见： https://www.slideshare.net/elevenpaths/anlisis-del-nivel-proteccin-antiexploit-en-windows-10 功能...

HeaderLessPE

HeaderLessPE 介绍 English 相比MemDll等内存加载技术，扩展后的HeaderLessPE有两个优点： 避免传统PE的DOS头、PE头特征 DOS头和PE头经常是被内存扫描的照顾重点特征，在使用Cobalt Strike的时候常需要设置Profile文件将加载完成的Beacon头抹掉。使用HeaderLessPE就不需要担心这个问题。 支持重定位和导入表，能方便的将EXE转换为HeaderLessPE结构 只要是支持重定位，不包含如：Tls、delay import等结构都能够转换为HeaderLessPE,...

CVE-2026-40499

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's printgvars function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted...

SUSE CVE-2006-1614

Integer overflow in the cliscanpe function in the PE header parser libclamav/pe.c in Clam AntiVirus ClamAV before 0.88.1, when ArchiveMaxFileSize is disabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code...

Process-Dump - Windows Tool For Dumping Malware PE Files From Memory Back To Disk For Analysis

Process Dump is a Windows reverse-engineering command-line tool to dump malware memory components back to disk for analysis. Often malware files are packed and obfuscated before they are executed in order to avoid AV scanners, however when these files are executed they will often unpack or inject...

KsDumper - Dumping Processes Using The Power Of Kernel Space

I always had an interest in reverse engineering. A few days ago I wanted to look at some game internals for fun, but it was packed & protected by EAC EasyAntiCheat. This means its handle were stripped and I was unable to dump the process from Ring3. I decided to try to make a custom driver that...

PESTO - PE (files) Statistical Tool

PESTO is a Python script that extracts and saves in a database some PE file security characteristics or flags searching for every PE binary in a whole directory, and saving results in a database. It checks for architecture flag in the header, and for the following security flags: ASLR, NOSEH, DEP...

CVE-2016-10402

Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\SYSTEM via a section header with a very large relative virtual address in a PE file, causing an integer overflow and heap-based buffer underflow...

Design/Logic Flaw

The kernel component in Symantec Anti-Virus Engine AVE 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cause a denial of service memory access violation and system crash via a malformed PE header file...

CVE-2016-2208

CVE-2016-2208 affects Symantec Antivirus Engine (AVE) kernel component in AVE 20151.1 before 20151.1.1.4. The issue arises when parsing malformed PE header files, enabling remote attackers to execute arbitrary code or cause a memory access violation and system crash. Several advisories and assess...

CVE-2016-2208

The kernel component in Symantec Anti-Virus Engine AVE 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cause a denial of service memory access violation and system crash via a malformed PE header file...

Symantec Antivirus Engine 20151.1.0.32 Malformed PE Header Parser Memory Access Violation (SYM16-008)

The version of Symantec Antivirus Engine AVE installed on the remote host is 20151.1.0.32. It is, therefore, affected by a remote code execution vulnerability due to improper parsing of malformed portable-executable PE header files and executables packed with early versions of Aspack. A remote...

The vulnerability of the Symantec Anti-Virus Engine’s antivirus kernel allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the Symantec Anti-Virus Engine is related to errors in syntactic analysis of executable files, packaged using the ASPack software. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or trigger a service failure memory corruption using a file with...

Symantec Antivirus Engine Malformed PE Header Parser Memory Access Violation

SUMMARY Symantec's Anti-Virus Engine AVE was susceptible to memory access violation due to a flaw when parsing a specifically-crafted PE header file in the kernel. The most common symptom of a successful attack would result in a system crash. AFFECTED PRODUCTS Symantec Anti Virus Engine --- CVE |...

Detours to modify the paragraph properties of vulnerability-vulnerability warning-the black bar safety net

Detours to modify the paragraph properties of the vulnerability Affected Software and systems Detours3. 0 and previous versions Description This issue will be its positioning as a vulnerability may be less suitable, the more likely that Detours a BUG, but because the defect will cause the exploit...

Smadav Anti Virus 9.1 Crash PoC

No description provided by source. Exploit Title: Smadav AntiVirus - Crash PoC Date: 10/Nov/2012 Exploit Author: Mada R Perdhana [email protected] / Spentera Research Team Vendor Homepage: http://www.smadav.net & http://www.smadav.web.id Software Link: http://www.smadav.net/download Version: 9.1...

Adobe Reader Plugin Signature Bypass Vulnerability - Linux

Adobe Reader is prone to plugin signature bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...