Huan

Huan Huan هي أداة توليد محمل PE مشفر قمت بتطويرها لتعلم بنية ملفات PE وعمليات تحميلها. تقوم بتشفير ملف PE المراد تشغيله باستخدام مفاتيح مختلفة في كل مرة وتضمينه في قسم جديد من الملف الثنائي للمحمل. تعمل حاليًا على ملفات PE ذات بنية 64 بت. كيف تعمل؟ أولاً، يقرأ Huan ملف PE المحدد ويقوم بتشفيره...

sRDI

sRDI - حقن DLL الانعكاسي عبر شيلكود يتيح sRDI تحويل ملفات DLL إلى شيلكود مستقل عن الموقع. يحاول أن يكون محمل PE كامل الوظائف يدعم أذونات الأقسام الصحيحة، واستدعاءات TLS، وعمليات التحقق من السلامة. يمكن اعتباره محمل PE شيلكود مربوطًا بـ DLL مضغوط. تتحقق الوظيفة عبر مكونين: مشروع C يقوم بتجميع تنفي...

amber

소개 Amber는 기본 PE 파일EXE, DLL, SYS...의 메모리 내 실행을 가능하게 하는 위치 독립적리플렉티브 PE 로더입니다. 안티바이러스, 방화벽, IDS, IPS 제품 및 애플리케이션 허용 목록 완화를 우회하는 데 사용할 수 있는 은밀한 메모리 내 페이로드 배포를 가능하게 합니다. Amber로 생성된 리플렉티브 페이로드는 원격 서버에서 스테이징하거나 일반 셸코드처럼 메모리에서 직접 실행할 수 있습니다. 기본적으로 생성된 모든 페이로드는 차세대 SGN 인코더를 사용하여 인코딩됩니다. Amber는 CRC32API와...

dotNetPELoader

dotNetPELoader إشعار أمني مؤخرًا، اكتشفت وجود نسخة معدلة غير رسمية من هذا المشروع يتم إعادة توزيعها خارج هذا المستودع. بعد مراجعة الملفات، حددت مكونات مخفية إضافية وسلوك تحميل سكريبت لا توجد بتاتًا في الكود المصدري الرسمي. يرجى الانتباه: التوزيع غير الرسمي يتضمن عناصر تنفيذ إضافية وعناصر تحميل...

ft9201-libfprint

ft9201-libfprint دعم بصمات الأصابع في لينكس لقارئ USB Focal-systems FT9201 2808:93a9، يُباع كدونجل مستقل لـ Windows Hello، كسائق لـ libfprint. المستشعر هو قارئ بصري صغير بحجم 96×96. محرك المطابقة المدمج في libfprint لا يؤدي عملاً جيداً على صورة بهذا الصغر، لذلك يستخدم هذا السائق بدلاً من ذلك محرك...

zig-pe

zig-pe Chargeur PE réflexif écrit en Zig. Charge et exécute des fichiers PE natifs et .NET directement depuis la mémoire. Fonctionnalités Pipeline de chargement PE Analyse des en-têtes DOS et NT PE32 et PE32+ à l'exécution Mappage des sections dans la mémoire allouée Résolution des importations p...

EUVD-2026-29347

barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section...

CVE-2026-34963

barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section...

CVE-2026-34963 barebox EFI PE Loader Memory Safety Vulnerabilities

barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section...

CVE-2026-34963 barebox EFI PE Loader Memory Safety Vulnerabilities

barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section...

PT-2026-39869

Name of the Vulnerable Software and Affected Versions barebox versions prior to 2026.04.0 Description Multiple memory-safety issues exist in the EFI PE loader within the efi/loader/pe.c file. An integer overflow occurs during virtual image size computation when using 32-bit arithmetic on section...

Barebox 输入验证错误漏洞

Barebox is a versatile and flexible bootloader developed by Barebox Open Source. Versions of barebox prior to 2026.04.0 contained a vulnerability related to input validation errors. This vulnerability stemmed from integer overflows and unvalidated boundaries within the EFI PE loader, which could...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft

Collateral Damage Collateral Damage is a kernel exploit for Xb...

Huan - Encrypted PE Loader Generator

Huan is an encrypted PE Loader Generator that I developed for learning PE file structure and PE loading processes. It encrypts the PE file to be run with different keys each time and embeds it in a new section of the loader binary. Currently, it works on 64 bit PE files. How It Works? First, Huan...

Cooolis-ms - A Server That Supports The Metasploit Framework RPC

Cooolis-ms is a server that supports Metasploit Framework RPC. It is used to work for Shellcode and PE loader, bypassing the static detection of anti-virus software to a certain extent, and allows the Cooolis-ms server to perform with the Metasploit server separate. Loader execution process: 1...

Windows Inject Reflective PE Files, Reverse TCP Stager with UUID Support (Windows x64)

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject Reflective PE Files, Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject Reflective PE Files, Windows x64 Reverse TCP Stager

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject Reflective PE Files, Windows x64 Bind Named Pipe Stager

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...