Vectored-Exception-Handling-Squared

Vectored Exception Handling Squared A Rust Proof of Concept. Read more on my blog, all original research by CrowdStrike, this is just the POC for it! Unless I am blind; there does not seem to be much out there POC's etc relating to the discovery made by CrowdStrike researchers, called Vectored...

AMSI-patches-learned-till-now

Correctifs AMSI appris jusqu'à présent J'ai documenté tous les correctifs AMSI que j'ai appris jusqu'à présent ❗ Mon apprentissage des correctifs AMSI jusqu'à présent. N'appartient pas aux actifs de mon entreprise ! AVERTISSEMENT : Ce code n'est pas destiné à être furtif pour l'instant ! Seulemen...

Astral_Projection

Astral Projection - UDRL Astral Projection is a Cobalt Strike UDRL User-Defined Reflective Loader, that performs advanced module stomping. The UDRL loads a module using LoadLibraryExW, then manipulates its internals by setting VEH to intercept strategic calls that allow it to steal the section...

LazyHook

Overview LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems HIPS through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed...

Shellcode-Test-Harness

Shellcode Test Harness A lightweight test harness designed to speed up shellcode development by providing an execution environment with integrated crash diagnostics and debug output redirection. Features Executes shellcode via module stomping Uses VEH to catch crashes: If the shellcode faults, it...

EhTrace

EhTrace EhTrace pronounced "ATrace" is a high-performance binary tracing and instrumentation framework for Windows. It enables deep runtime analysis of Windows executables without requiring source code, binary modifications, or traditional debugging. Overview EhTrace leverages Windows Vectored...

DetectWindowsCopyOnWriteForAPI

Windows Process Property Enumeration Tools for Threat Hunting خلفية الغرض من هذه الأدوات هو تعداد خصائص عمليات ويندوز التي تدعم اكتشاف تقنيات حقن العمليات التي يستخدمها المهاجمون. الأدوات d-cow - كاشف النسخ عند الكتابة Copy on Write لنظام ويندوز لواجهات برمجة تطبيقات ويندوز المشتركة مثل...

antidbg

AntiDBG antidbg est une bibliothèque anti-débogage en mode utilisateur x64 pour Windows, conçue pour protéger les logiciels contre le débogage. Considérez cette bibliothèque comme une base pour votre protection anti-débogage, et non comme votre seule défense. La bibliothèque est : Très facile à...

[Full-disclosure] # a new bug in Olly

Hello full-disclosure! I've found a bug in Olly leading to crash SEH/VEH-based programs during tracing. an example-pack could be found at my web-site http://nezumi.org.ru/olly-bug-776.zip, it includes two SEH/VEH programs and requests XP or latter to run VEH, while SEH works everywhere. Load an...