zig-pe

zig-pe Reflective PE loader written in Zig. Loads and executes native and .NET PE files directly from memory. Features PE Loading Pipeline Parse DOS and NT headers PE32 and PE32+ at runtime Map sections into allocated memory Resolve imports name and ordinal, PE32 4-byte / PE32+ 8-byte thunks Appl...

dotNetPELoader

dotNetPELoader Aviso de seguridad Recientemente, descubrí una versión modificada no oficial de este proyecto que se redistribuye fuera de este repositorio. Después de revisar los archivos, identifiqué componentes ocultos adicionales y un comportamiento de carga de scripts que NO existen en el...

amber

Introducción Amber es un cargador de PE independiente de posición reflectivo que permite la ejecución en memoria de archivos PE nativos EXE, DLL, SYS.... Permite el despliegue sigiloso de cargas útiles en memoria que pueden utilizarse para evadir productos antivirus, firewall, IDS, IPS y...

Huan

Huan Huan is an encrypted PE Loader Generator that I developed for learning PE file structure and PE loading processes. It encrypts the PE file to be run with different keys each time and embeds it in a new section of the loader binary. Currently, it works on 64 bit PE files. How It Works? First,...

ft9201-libfprint

ft9201-libfprint Soporte de huellas dactilares en Linux para el lector USB Focal-systems FT9201 2808:93a9, vendido como un dongle independiente de Windows Hello, como un controlador de libfprint. El sensor es un diminuto lector óptico de 96×96. El comparador incorporado de libfprint funciona mal...

libpeconv

libPeConv 用于加载和操作 PE 文件的库。 目标 libPEConv 的目标是创建一个用于自定义加载 PE 文件的“瑞士军刀”。它汇集了各种辅助函数，您可以快速将它们集成到自己的加载器中。例如：重新映射节区、应用重定位、加载导入、解析资源。 它不仅允许加载 PE 文件，还允许自定义某些步骤，例如 IAT 挂钩（通过提供自定义 IAT 解析器）和函数重定向。但是，它并不专注于内联挂钩，不应与 MS Detours 或 MinHook 等库混淆。 LibPeConv 可用于创建 PE 绑定器，因为它允许直接从资源中加载 PE，并将其当作本地代码一样集成。...

sRDI

sRDI - Shellcode Reflective DLL Injection sRDI allows for the conversion of DLL files to position independent shellcode. It attempts to be a fully functional PE loader supporting proper section permissions, TLS callbacks, and sanity checks. It can be thought of as a shellcode PE loader strapped t...

ReflectiveDLLInjection

About Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process. As such the library is responsible for loading itself by implementing a minimal Portable Executable PE fi...

CVE-2026-79298

🐞 CVE-2026-79298: Incomplete Remediation of UEFI Secure Boot Bypass in Howyar SysReturn A vulnerability was patched. A binary was revoked. But only half the architecture was fixed. Eighteen months later, the IA-32 boot path still carried the same custom PE loader, the same bypassed Secure Boot...

EUVD-2026-29347

barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section...

CVE-2026-34963

barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section...

CVE-2026-34963 barebox EFI PE Loader Memory Safety Vulnerabilities

barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section...

CVE-2026-34963 barebox EFI PE Loader Memory Safety Vulnerabilities

barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section...

PT-2026-39869

Name of the Vulnerable Software and Affected Versions barebox versions prior to 2026.04.0 Description Multiple memory-safety issues exist in the EFI PE loader within the efi/loader/pe.c file. An integer overflow occurs during virtual image size computation when using 32-bit arithmetic on section...

Barebox 输入验证错误漏洞

Barebox is a versatile and flexible bootloader developed by Barebox Open Source. Versions of barebox prior to 2026.04.0 contained a vulnerability related to input validation errors. This vulnerability stemmed from integer overflows and unvalidated boundaries within the EFI PE loader, which could...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft

Collateral Damage Collateral Damage is a kernel exploit for Xb...

Huan - Encrypted PE Loader Generator

Huan is an encrypted PE Loader Generator that I developed for learning PE file structure and PE loading processes. It encrypts the PE file to be run with different keys each time and embeds it in a new section of the loader binary. Currently, it works on 64 bit PE files. How It Works? First, Huan...

Cooolis-ms - A Server That Supports The Metasploit Framework RPC

Cooolis-ms is a server that supports Metasploit Framework RPC. It is used to work for Shellcode and PE loader, bypassing the static detection of anti-virus software to a certain extent, and allows the Cooolis-ms server to perform with the Metasploit server separate. Loader execution process: 1...

Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject Reflective PE Files, Reverse TCP Stager with UUID Support (Windows x64)

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...