lupo

For instructions on how to use Lupo, visit https://github.com/malienist/lupo/wiki/Lupo-Wiki Lupo — Malware IOC Extractor Debugging module for Malware Analysis Automation For a step by step post on how to use Lupo, with images and instructions, please see this post:...

DbgShell

DbgShell Интерфейс PowerShell для отладчика Windows. Готовы табулировать свой путь к успеху? Для быстрого знакомства посмотрите Начало работы. Отказ от ответственности 1. Этот проект не создан, не одобрен и не контролируется командой отладчика Windows. Команда отладчика приветствует обратную связ...

windbg_js_scripts

WinDbg JavaScript 脚本 作为 WinDbg 扩展库安装 克隆仓库 root@kitploit: git clone https://github.com/hugsy/windbgjsscripts 在 windbgjsscripts\config.xml 中，编辑 Setting Name="LocalCacheRootFolder" 行，使其指向仓库的本地路径。 在 WinDbg 中，加载 config.xml 文件并保存设置： root@kitploit: windbg .settings load \path\to\windbgjsscripts\config.x...

windbg-mcp

WinDbg MCP Un serveur MCP Model Context Protocol qui expose chaque fonction de débogueur Windows pybag en tant qu'outil MCP natif. Il donne à tout client compatible MCP Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor et agents personnalisés un contrôle total sur les processus en mod...

ghostdebug

GhostDebug GhostDebug는 네이티브 디버깅 DLL과 .NET Framework 명령줄 클라이언트로 구성된 Windows x64 디버거 프로토타입입니다. 디버거 탐지 검사를 사용하는 대상을 디버깅하기 위한 것입니다. 디자인 배경은 Windows에서 탐지되지 않는 디버거 개발을 참조하세요. 요구 사항 Windows x64 Visual Studio 2022Desktop development with C++ 워크로드 포함 Windows 10 SDK 및 v143 C++ 도구 집합 .NET Framework 4.8...

apiscope

ApiScope ApiScope est un outil de recherche Windows x64 pour tracer des appels API sélectionnés dans un nouveau processus ou un processus en cours. Il suit les événements de chargement de DLL via l'API du débogueur Windows et installe des hooks avant que le débogué ne continue après chaque...

PsyloDbg

PsyloDbg PsyloDbg — это быстро развивающийся и удобный в использовании отладчик Windows с открытым исходным кодом, полностью написанный на Delphi. Основная цель этого проекта — предоставить аналитикам вредоносного ПО ещё один инструмент для сокращения времени реагирования в процессе анализа. Прое...

wined

Windows Exploitation wined Tools The following scripts were...

PlugX Trojan Disguised as Legitimate Windows Debugger Tool in Latest Attacks

The PlugX remote access trojan has been observed masquerading as an open source Windows debugger tool called x64dbg in an attempt to circumvent security protections and gain control of a target system. "This file is a legitimate open-source debugger tool for Windows that is generally used to...

PlugX Trojan Disguised as Legitimate Windows Debugger Tool in Latest Attacks

The PlugX remote access trojan has been observed masquerading as an open source Windows debugger tool called x64dbg in an attempt to circumvent security protections and gain control of a target system. "This file is a legitimate open-source debugger tool for Windows that is generally used to...

Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Trend Micro’s Managed Extended Detection and Response MxDR team discovered that a file called x32dbg.exe was used to sideload a malicious DLL we identified as a variant of PlugX...

Patchless AMSI bypass using SharpBlock

Introduction For those that followed my personal blog posts on Creating an EDR and Bypassing It, I developed a new tool called SharpBlock. The tool implements a Windows debugger to prevent EDR’s or any other DLL from loading into a process that SharpBlock launches. One feature that was missing fr...

Binary vulnerability in ollydbg buffer

OllyDbg is a 32-bit Microsoft Windows assembly-level analyzing debugger, especially useful when source code is unavailable or the compiler encounters problems. A binary vulnerability exists in the ollydbg buffer that can be exploited by an attacker to cause a denial of service to the server...

DbgShell - A PowerShell Front-End For The Windows Debugger Engine

A PowerShell front-end for the Windows debugger engine. Ready to tab your way to glory? For a quicker intro, take a look at Getting Started. Disclaimers 1. This project is not produced, endorsed, or monitored by the Windows debugger team. While the debugger team welcomes feedback about their API...

PowerShell Front-End for Windows Debugger Engine: DbgShell

The main impetus for DbgShell is that it’s just waaaay too hard to automate anything in the debugger. There are facilities today to assist in automating the debugger, of course. But in my opinion they are not meeting people’s needs. Using the built-in scripting language is arcane, limited,...

Microsoft Edge Chakra NULL Pointer Dereference

spreadIndices = nullptr // This function emits the arguments for a call. // ArgOut's with uses immediately following defs. EmitArgListStartthisLocation, byteCodeGenerator, funcInfo, callSiteId; Js::RegSlot evalLocation = Js::Constants::NoRegister; // // If Emitting arguments for eval and assignin...

Microsoft Process Kill Utility (kill.exe) 6.3.9600.17298 - Crash (PoC)

Exploit for windows platform in category dos / poc ''' + Credits: HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MS-KILL-UTILITY-BUFFER-OVERFLOW.txt + ISR: ApparitionSec Vendor: ================= www.microsoft.com Product:...

FortKnox Personal Firewall 9.0.305.0 & 10.0.305.0 - Kernel Driver (fortknoxfw.sys) Memory Corruption Vulnerability

No description provided by source. / Exploit Title: 0day FortKnox Personal Firewall kernel driver fortknoxfw.sys memory corruption vulnerability Date: 25/10/2013 Author: Arash Allebrahim Contact : [email protected] Vendor Homepage: http://www.fortknox-firewall.com/ Vulnerable software :...

JPEGsnoop <= 1.5.2 WriteAV Crash PoC

No description provided by source. !/usr/bin/perl JPEGsnoop 1.5.2 = WriteAV Arbitrary Code Execution Author: Jean Pascal Pereira [email protected] Vendor URI: http://sourceforge.net/projects/jpegsnoop/ Vendor Description: JPEGsnoop is a detailed JPEG image decoder and analysis tool. It reports al...

DIMIN Viewer 5.4.0 Crash PoC

No description provided by source. !/usr/bin/perl DIMIN Viewer 5.4.0 = WriteAV Arbitrary Code Execution Author: Jean Pascal Pereira [email protected] Vendor URI: http://www.dimin.net Vendor Decription: View images in countless formats, and apply a variety of effects with this small, fast, and...