ghostdebug

GhostDebug GhostDebug 是一个 Windows x64 调试器原型，由一个原生调试 DLL 和一个 .NET Framework 命令行客户端组成。它旨在调试那些使用调试器检测检查的目标程序。 有关设计背景，请参阅 在 Windows 上开发不被检测的调试器。 要求 Windows x64 Visual Studio 2022（包含“使用 C++ 的桌面开发”工作负载） Windows 10 SDK 和 v143 C++ 工具集 .NET Framework 4.8 Developer Pack 已启用 NuGet 包还原 构建 在 Visual Studio...

windbg-mcp

WinDbg MCP Un servidor MCP Model Context Protocol que expone cada función del depurador de Windows de pybag como una herramienta nativa de MCP. Le otorga a cualquier cliente compatible con MCP Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor y agentes personalizados control total sob...

apiscope

ApiScope ApiScope 是一个 Windows x64 研究工具，用于跟踪新进程或运行进程中选定的 API 调用。它通过 Windows 调试器 API 跟踪 DLL 加载事件，并在被调试者从每个事件继续运行之前安装钩子。 包含的钩子： ntdll.dll!NtCreateFile（记录目标路径） ntdll.dll!NtOpenFile（记录目标路径） ntdll.dll!NtReadFile ntdll.dll!NtWriteFile ntdll.dll!NtClose ntdll.dll!NtOpenKey（记录键路径） ntdll.dll!NtSetValueKey...

lupo

For instructions on how to use Lupo, visit https://github.com/malienist/lupo/wiki/Lupo-Wiki Lupo — Malware IOC Extractor Debugging module for Malware Analysis Automation For a step by step post on how to use Lupo, with images and instructions, please see this post:...

DbgShell

DbgShell Un front-end de PowerShell para el motor de depuración de Windows. ¿Listo para tabular tu camino hacia la gloria? Para una introducción más rápida, echa un vistazo a Introducción. Descargos de responsabilidad 1. Este proyecto no es producido, respaldado ni supervisado por el equipo de...

PsyloDbg

PsyloDbg PsyloDbg 是一个快速成长且用户友好的开源 Windows 调试器，完全使用 Delphi 编写。 该项目的主要目标是为恶意软件分析人员提供另一种工具，以缩短他们在分析过程中的响应时间。 该项目仍处于非常早期的阶段，预计功能将逐步增加。 图片 调试事件 内存映射 加载的模块 被调试的进程树 转储并重建 PE 镜像（测试版） 调试器功能 = 已实现 = 尚未实现 加载的模块 列表。 转储重建的模块镜像。 导出函数列表。 ANSI / WIDE 字符串 列出文件/内存中的字符串。 高级搜索功能。 内存映射 列表。 识别 PE 镜像和节区。 识别线程堆栈。 识别堆。...

windbg_js_scripts

WinDbg JavaScript 脚本 作为 WinDbg 扩展库安装 克隆仓库 git clone https://github.com/hugsy/windbgjsscripts 在 windbgjsscripts\config.xml 中，编辑 Setting Name="LocalCacheRootFolder" 行，使其指向仓库的本地路径。 在 WinDbg 中，加载 config.xml 文件并保存设置： windbg .settings load \path\to\windbgjsscripts\config.xml...

wined

Windows Exploitation wined Tools The following scripts were...

PlugX Trojan Disguised as Legitimate Windows Debugger Tool in Latest Attacks

The PlugX remote access trojan has been observed masquerading as an open source Windows debugger tool called x64dbg in an attempt to circumvent security protections and gain control of a target system. "This file is a legitimate open-source debugger tool for Windows that is generally used to...

PlugX Trojan Disguised as Legitimate Windows Debugger Tool in Latest Attacks

The PlugX remote access trojan has been observed masquerading as an open source Windows debugger tool called x64dbg in an attempt to circumvent security protections and gain control of a target system. "This file is a legitimate open-source debugger tool for Windows that is generally used to...

Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Trend Micro’s Managed Extended Detection and Response MxDR team discovered that a file called x32dbg.exe was used to sideload a malicious DLL we identified as a variant of PlugX...

Patchless AMSI bypass using SharpBlock

Introduction For those that followed my personal blog posts on Creating an EDR and Bypassing It, I developed a new tool called SharpBlock. The tool implements a Windows debugger to prevent EDR’s or any other DLL from loading into a process that SharpBlock launches. One feature that was missing fr...

Binary vulnerability in ollydbg buffer

OllyDbg is a 32-bit Microsoft Windows assembly-level analyzing debugger, especially useful when source code is unavailable or the compiler encounters problems. A binary vulnerability exists in the ollydbg buffer that can be exploited by an attacker to cause a denial of service to the server...

DbgShell - A PowerShell Front-End For The Windows Debugger Engine

A PowerShell front-end for the Windows debugger engine. Ready to tab your way to glory? For a quicker intro, take a look at Getting Started. Disclaimers 1. This project is not produced, endorsed, or monitored by the Windows debugger team. While the debugger team welcomes feedback about their API...

PowerShell Front-End for Windows Debugger Engine: DbgShell

The main impetus for DbgShell is that it’s just waaaay too hard to automate anything in the debugger. There are facilities today to assist in automating the debugger, of course. But in my opinion they are not meeting people’s needs. Using the built-in scripting language is arcane, limited,...

Microsoft Edge Chakra NULL Pointer Dereference

spreadIndices = nullptr // This function emits the arguments for a call. // ArgOut's with uses immediately following defs. EmitArgListStartthisLocation, byteCodeGenerator, funcInfo, callSiteId; Js::RegSlot evalLocation = Js::Constants::NoRegister; // // If Emitting arguments for eval and assignin...

Microsoft Process Kill Utility (kill.exe) 6.3.9600.17298 - Crash (PoC)

Exploit for windows platform in category dos / poc ''' + Credits: HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MS-KILL-UTILITY-BUFFER-OVERFLOW.txt + ISR: ApparitionSec Vendor: ================= www.microsoft.com Product:...

FortKnox Personal Firewall 9.0.305.0 & 10.0.305.0 - Kernel Driver (fortknoxfw.sys) Memory Corruption Vulnerability

No description provided by source. / Exploit Title: 0day FortKnox Personal Firewall kernel driver fortknoxfw.sys memory corruption vulnerability Date: 25/10/2013 Author: Arash Allebrahim Contact : [email protected] Vendor Homepage: http://www.fortknox-firewall.com/ Vulnerable software :...

JPEGsnoop <= 1.5.2 WriteAV Crash PoC

No description provided by source. !/usr/bin/perl JPEGsnoop 1.5.2 = WriteAV Arbitrary Code Execution Author: Jean Pascal Pereira [email protected] Vendor URI: http://sourceforge.net/projects/jpegsnoop/ Vendor Description: JPEGsnoop is a detailed JPEG image decoder and analysis tool. It reports al...

DIMIN Viewer 5.4.0 Crash PoC

No description provided by source. !/usr/bin/perl DIMIN Viewer 5.4.0 = WriteAV Arbitrary Code Execution Author: Jean Pascal Pereira [email protected] Vendor URI: http://www.dimin.net Vendor Decription: View images in countless formats, and apply a variety of effects with this small, fast, and...