windbg_js_scripts

Script JavaScript per WinDbg Installa come galleria di WinDbg Clona il repository root@kitploit: git clone https://github.com/hugsy/windbgjsscripts In windbgjsscripts\config.xml, modifica le righe Setting Name="LocalCacheRootFolder" per riflettere il percorso locale del repository. In WinDbg,...

lupo

For instructions on how to use Lupo, visit https://github.com/malienist/lupo/wiki/Lupo-Wiki Lupo — Malware IOC Extractor Debugging module for Malware Analysis Automation For a step by step post on how to use Lupo, with images and instructions, please see this post:...

DbgShell

DbgShell Ein PowerShell-Frontend für die Windows-Debugger-Engine. Bereit, sich per Tab durch die Glorie zu navigieren? Für eine schnellere Einführung werfen Sie einen Blick auf Getting Started. Haftungsausschlüsse 1. Dieses Projekt wird nicht vom Windows-Debugger-Team erstellt, unterstützt oder...

windbg-mcp

WinDbg MCP Un serveur MCP Model Context Protocol qui expose chaque fonction de débogueur Windows pybag en tant qu'outil MCP natif. Il donne à tout client compatible MCP Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor et agents personnalisés un contrôle total sur les processus en mod...

ghostdebug

GhostDebug GhostDebug ist ein Windows-x64-Debugger-Prototyp, der aus einer nativen Debugging-DLL und einem .NET-Framework-Befehlszeilenclient besteht. Er ist für das Debugging von Zielen gedacht, die Debugger-Erkennungsprüfungen verwenden. Hintergrundinformationen zum Design finden Sie unter...

apiscope

ApiScope ApiScope è uno strumento di ricerca per Windows x64 che traccia chiamate API selezionate in un processo nuovo o già in esecuzione. Segue gli eventi di caricamento delle DLL tramite l'API del debugger di Windows e installa hook prima che il processo sottoposto a debug continui da ogni...

PsyloDbg

PsyloDbg PsyloDbg è un debugger Windows open source in rapida crescita e facile da usare, interamente scritto in Delphi. L'obiettivo principale di questo progetto è offrire agli analisti di malware uno strumento in più per ridurre i tempi di risposta durante il processo di analisi. Il progetto è...

wined

Windows Exploitation wined Tools The following scripts were...

PlugX Trojan Disguised as Legitimate Windows Debugger Tool in Latest Attacks

The PlugX remote access trojan has been observed masquerading as an open source Windows debugger tool called x64dbg in an attempt to circumvent security protections and gain control of a target system. "This file is a legitimate open-source debugger tool for Windows that is generally used to...

PlugX Trojan Disguised as Legitimate Windows Debugger Tool in Latest Attacks

The PlugX remote access trojan has been observed masquerading as an open source Windows debugger tool called x64dbg in an attempt to circumvent security protections and gain control of a target system. "This file is a legitimate open-source debugger tool for Windows that is generally used to...

Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Trend Micro’s Managed Extended Detection and Response MxDR team discovered that a file called x32dbg.exe was used to sideload a malicious DLL we identified as a variant of PlugX...

Patchless AMSI bypass using SharpBlock

Introduction For those that followed my personal blog posts on Creating an EDR and Bypassing It, I developed a new tool called SharpBlock. The tool implements a Windows debugger to prevent EDR’s or any other DLL from loading into a process that SharpBlock launches. One feature that was missing fr...

Binary vulnerability in ollydbg buffer

OllyDbg is a 32-bit Microsoft Windows assembly-level analyzing debugger, especially useful when source code is unavailable or the compiler encounters problems. A binary vulnerability exists in the ollydbg buffer that can be exploited by an attacker to cause a denial of service to the server...

DbgShell - A PowerShell Front-End For The Windows Debugger Engine

A PowerShell front-end for the Windows debugger engine. Ready to tab your way to glory? For a quicker intro, take a look at Getting Started. Disclaimers 1. This project is not produced, endorsed, or monitored by the Windows debugger team. While the debugger team welcomes feedback about their API...

PowerShell Front-End for Windows Debugger Engine: DbgShell

The main impetus for DbgShell is that it’s just waaaay too hard to automate anything in the debugger. There are facilities today to assist in automating the debugger, of course. But in my opinion they are not meeting people’s needs. Using the built-in scripting language is arcane, limited,...

Microsoft Edge Chakra NULL Pointer Dereference

spreadIndices = nullptr // This function emits the arguments for a call. // ArgOut's with uses immediately following defs. EmitArgListStartthisLocation, byteCodeGenerator, funcInfo, callSiteId; Js::RegSlot evalLocation = Js::Constants::NoRegister; // // If Emitting arguments for eval and assignin...

Microsoft Process Kill Utility (kill.exe) 6.3.9600.17298 - Crash (PoC)

Exploit for windows platform in category dos / poc ''' + Credits: HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MS-KILL-UTILITY-BUFFER-OVERFLOW.txt + ISR: ApparitionSec Vendor: ================= www.microsoft.com Product:...

FortKnox Personal Firewall 9.0.305.0 & 10.0.305.0 - Kernel Driver (fortknoxfw.sys) Memory Corruption Vulnerability

No description provided by source. / Exploit Title: 0day FortKnox Personal Firewall kernel driver fortknoxfw.sys memory corruption vulnerability Date: 25/10/2013 Author: Arash Allebrahim Contact : [email protected] Vendor Homepage: http://www.fortknox-firewall.com/ Vulnerable software :...

JPEGsnoop <= 1.5.2 WriteAV Crash PoC

No description provided by source. !/usr/bin/perl JPEGsnoop 1.5.2 = WriteAV Arbitrary Code Execution Author: Jean Pascal Pereira [email protected] Vendor URI: http://sourceforge.net/projects/jpegsnoop/ Vendor Description: JPEGsnoop is a detailed JPEG image decoder and analysis tool. It reports al...

DIMIN Viewer 5.4.0 Crash PoC

No description provided by source. !/usr/bin/perl DIMIN Viewer 5.4.0 = WriteAV Arbitrary Code Execution Author: Jean Pascal Pereira [email protected] Vendor URI: http://www.dimin.net Vendor Decription: View images in countless formats, and apply a variety of effects with this small, fast, and...