HallWatch

HallWatch Copyright C 2026 Adam Zypherion — licensed under GPL-3.0. Indirect syscalls are simple once you have seen one. The loader walks ntdll, reads the SSN out of Nt prologue, finds the 0F 05 two bytes further in, sets r10/rax/rdx/r8/r9 itself, and jmps straight at those two bytes. The syscall...

DInvoke_rs

DInvokers Rust port of Dinvoke. DInvokers may be used for many purposes such as PE parsing, dynamic exported functions resolution, dynamically loading PE plugins at runtime, API hooks evasion and more. Features: Dynamically resolve and invoke undocumented Windows APIs from Rust. Primitives allowi...

Rusty-Playground

Rusty-Playground 🦀 A collection of Rust programs showcasing some offensive-securtiy and evasions techniques Tool| Description| References ---|---|--- ClipboardMon| Monitors the clipboard for changes and logs clipboard content or copies files depending on detected changes.| - DumpMDEConfig|...

DInvoke

DInvoke Dynamic replacement for PInvoke on Windows. DInvoke contains powerful primitives that may be combined intelligently to dynamically invoke unmanaged code from disk or from memory with careful precision. This may be used for many purposes such as PE parsing, intelligent dynamic API...

vBulletin 5.5.x < 5.5.2 Patch Level 2 Multiple Vulnerabilities

According to the self-reported version in its response header, the version of vBulletin hosted on the remote web server is 5.5.x 5.5.2 Patch Level 2, 5.5.3 5.5.3 Patch Level 2 or 5.5.4 5.5.4 Patch Level 2. It is, therefore, affected by multiples vulnerabilities : - A SQL injection vulnerability v...

CVE-2015-7808

The vBApiHook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments...

Detours to modify the paragraph properties of vulnerability-vulnerability warning-the black bar safety net

Detours to modify the paragraph properties of the vulnerability Affected Software and systems Detours3. 0 and previous versions Description This issue will be its positioning as a vulnerability may be less suitable, the more likely that Detours a BUG, but because the defect will cause the exploit...

Kerio Personal Firewall 2.1.x/4.x Local Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11859/info It is reported that the Kerio Personal Firewall KPF driver does not sufficiently sanitize API parameters that are received from API's that are hooked by KPF. When the KPF API hook handles certain parameter data...

Hook Analyser Malware Tool Released

Hook Analyser Malware Tool Released Hook analyser is a hook tool which can be potentially helpful in reversing applications and analysing malware. It can hook to an API in a process and search for a pattern in memory or dump the buffer. The tool can hook to an API in a process and can do followin...

maxthon2(voyagers 2) mxsafe. dll for web Trojan protection, and bypass-vulnerability warning-the black bar safety net

author: voidph4nt0m.org publish: 2007-09-27 http://www.ph4nt0m.org Text Mode maxthon2voyagers 2 mxsafe. dll for web Trojan protection as well as bypass ----------------------------------------------------------------------- maxthon2 boot time loading mxsafe. dll for some of the api hook. In the...

Malware and anti-malware technical analysis-vulnerability warning-the black bar safety net

Malware technology of all kinds, of any one function are likely to become a rogue technology, just like weapons, with the good may justice, with a crooked but become evil accomplice. First of all, I From win32 under some rogue bus analysis start: 1. I want to be a malware, the first thing to do i...