Shellcode-Test-Harness

Shellcode Test Harness A lightweight test harness designed to speed up shellcode development by providing an execution environment with integrated crash diagnostics and debug output redirection. Features Executes shellcode via module stomping Uses VEH to catch crashes: If the shellcode faults, it...

AMSI-patches-learned-till-now

Parches de AMSI aprendidos hasta ahora He documentado todos los parches de AMSI que he aprendido hasta ahora ❗ Mi aprendizaje de parches de AMSI hasta ahora. ¡No pertenece a los activos de mi empresa! DESCARGO DE RESPONSABILIDAD: ¡Este código no pretende ser evasivo hasta ahora! ¡Solo un enfoque...

Vectored-Exception-Handling-Squared

Vectored Exception Handling Squared A Rust Proof of Concept. Read more on my blog, all original research by CrowdStrike, this is just the POC for it! Unless I am blind; there does not seem to be much out there POC's etc relating to the discovery made by CrowdStrike researchers, called Vectored...

EhTrace

EhTrace EhTrace pronounced "ATrace" is a high-performance binary tracing and instrumentation framework for Windows. It enables deep runtime analysis of Windows executables without requiring source code, binary modifications, or traditional debugging. Overview EhTrace leverages Windows Vectored...

Astral_Projection

Astral Projection - UDRL Astral Projection is a Cobalt Strike UDRL User-Defined Reflective Loader, that performs advanced module stomping. The UDRL loads a module using LoadLibraryExW, then manipulates its internals by setting VEH to intercept strategic calls that allow it to steal the section...

LazyHook

Overview LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems HIPS through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed...

DetectWindowsCopyOnWriteForAPI

Herramientas de enumeración de propiedades de procesos de Windows para la caza de amenazas Antecedentes El propósito de estas herramientas es enumerar características de los procesos de Windows que apoyan la detección de las técnicas de inyección de procesos utilizadas por los actores de amenazas...

[Full-disclosure] # a new bug in Olly

Hello full-disclosure! I've found a bug in Olly leading to crash SEH/VEH-based programs during tracing. an example-pack could be found at my web-site http://nezumi.org.ru/olly-bug-776.zip, it includes two SEH/VEH programs and requests XP or latter to run VEH, while SEH works everywhere. Load an...