SysWhispers2

SysWhispers2 SysWhispers 通过生成植入物可用于进行直接系统调用的头文件/汇编文件，帮助进行规避。 所有核心系统调用均受支持，示例生成文件位于 example-output/ 文件夹中。 SysWhispers 1 和 2 的区别 用法与 SysWhispers1 几乎相同，但无需指定要支持哪些 Windows 版本。大多数更改在底层。它不再依赖 @j00ru 的 syscall tables，而是使用由 @modexpblog 推广的“按系统调用地址排序”技术。这大大减少了系统调用存根的大小。 SysWhispers2 的具体实现是 @modexpblog...

SysWhispers3

SysWhispers3 SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. Official Discord Channel Come hang out on Discord! Why on earth didn't I create a PR to SysWhispers2? The reason for SysWhispers3 to be a standalone version are many, but the...

BestEdrOfTheMarket

市场上最佳EDR（BEOTM）V3 🐲🏴‍☠️ 市场上最佳EDR（Best Edr Of The Market）是一个开源实验室，旨在从底层视角实现并理解端点检测与响应（EDR）安全产品所使用的检测方法及其绕过技术。这些技术主要基于利用Windows NT的遥测能力来动态分析进程行为。 ➡️​ BestEdrOfTheMarket内核版本有何新特性？ 防御能力 当前版本（v3）侧重于Windows内核提供的部分拦截能力。这些包括： 通过替代系统调用处理程序进行系统调用拦截 利用虚拟地址描述符（VAD）树进行映像完整性检查...

tiny_tracer

tinytracer A Pin Tool for tracing: API calls, including input and output of selected functions defined local functions, and functions from statically linked libraries selected instructions: RDTSC, CPUID, INT inline system calls, including parameters of selected syscalls transition between section...

tracee

Before moving on, please consider giving us a GitHub star ⭐️. Thank you! About Tracee Tracee is a runtime security and observability tool that helps you understand how your system and applications behave. It is using eBPF technology to tap into your system and expose that information as events tha...

rsyscall

Summary rsyscall is a library which provides a interface to an ever-growing subset of Linux system calls. This interface is: process-independent : all system calls are called as methods on process objects, which can refer to the "local" process or to other processes under our control, possibly on...

gustave

c Airbus 2021, sduverger GUSTAVE - Embedded OS kernel fuzzer What is it ? GUSTAVE is a fuzzing platform for embedded OS kernels. It is based on QEMU and AFL and all of its forkserver siblings. It allows to fuzz OS kernels like simple applications. Thanks to QEMU, it is multi-platform. One can see...

CallStackSpoofer

CallStackSpoofer Questo repository dimostra un'implementazione PoC per spoofare call stack arbitrarie quando si effettuano chiamate di sistema. Per una descrizione tecnica completa, consulta il post del blog qui: https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs. Di default...

osx-re-101

osx & ios re 101 Lavori in corso, li sto raccogliendo attivamente. Da leggere assolutamente https://reverse.put.as/ https://blog.paloaltonetworks.com/tag/mac-os-x/ https://www.synack.com/blog/r-d-projects/os-x-security-research/ https://pewpewthespells.com/re.html https://github.com/bx/machO-tool...

LetMeowIn

LetMeowIn Un dump di LSASS sofisticato e furtivo che utilizza C++ e MASM x64. Come visto su Binary Defense e Cyber Security News Esclusione di responsabilità Non essere malvagio con questo. Ho creato questo strumento per imparare. Non sono responsabile se i federali bussano alla tua porta...

play-go-copy-fail-cve-2026-31431

Play Go Copy Fail CVE-2026-31431 उद्देश्य लिनक्स सिस्कॉल निम्न-स्तरीय सीखें पायथन और सी को गोलैंग में पोर्ट करें अपना खुद का पेलोड तैयार करें और फिर नौसिखिए के रूप में एक्सप्लॉइट करें पीटीवाई को मैन्युअल रूप से ऑटो-अपग्रेड करें प्रेरणा tgies/copy-fail-c painoob/Copy-Fail-Exploit-CVE-2026-31431...

MalDev

MalDev Ehi! Benvenuto nel mio repo : Sono Captain Magma, un appassionato dedicato alla cybersecurity, allo sviluppo di malware e all'analisi. Lo scopo di questo repository è gestire il mio percorso di apprendimento su MalDev mentre studio e aggiorno questo repository con i miei appunti e codice...

SysWhispers4

SysWhispers4 Évasion AV/EDR via appels système directs et indirects Windows NT 3.1 à Windows 11 24H2 · x64 · x86 · WoW64 · ARM64 SysWhispers4 est un générateur de stubs d'appels système basé sur Python qui produit du code C/ASM pour invoquer directement les fonctions du noyau NT, en contournant l...

PT-2026-79296

Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. Scenario caused by memory free paths not maintaining state data of upgraded higher order allocations. This could cause memory leak or double free even...

CVE-2026-49428

In FreeBSD's posixshm module, open(2) with O_TRUNC and fspacectl(2) failed to verify whether operations are permitted on largepage objects, incorrectly freeing kernel memory. An unprivileged local user can read freed kernel memory and escalate privileges. Affected: all supported versions prior to...

EUVD-2026-54956

A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires...

CVE-2026-45204

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of execution leading to kernel exceptions,...

EUVD-2026-54348

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages...

Important: Red Hat Security Advisory: rhc security update

An update for rhc is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

CVE-2026-49743

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlyin...