AMSI-patches-learned-till-now

AMSI-patches-learned-till-now I have documented all of the AMSI patches that I learned till now ❗ My AMSI patch Learning till now. Doesn't belong to my Company's Asset! DISCLAIMER: This code is not meant to be Evasive till now! Only a Conceptual Approach. Links: 1...

CVE-2023-3640

SCTF2023kernelpwn SCTF 2023 kernel pwn Off-topic: A little advertisement — the author is a 2024 undergraduate graduate student, participating in this year's autumn recruitment. Feel free to contact me sycrop This problem aims to test two points. 1. The starting points of the cpu entry area mappin...

RustChain

Descripción Esta herramienta es una PoC simple de cómo ocultar artefactos de memoria usando una cadena ROP en combinación con breakpoints de hardware. La cadena ROP cambiará las protecciones de la página de memoria del módulo principal a N/A mientras duerme es decir, cuando se llama a la función...

CVE-2018-1000199

CVE-2018-1000199 The Linux ptrace code virtualizes access to the debug registers, and the virtualization code has incorrect error handling. This means that if you write an illegal value to, say, DR0, the internal state of the kernel's breakpoint tracking can become corrupt despite the fact that t...

VehApiResolve

VehApiResolve Inspired by Dridex Loader's 32 bit API obfuscation. How does this work? We setup an exception handler. AddVectoredExceptionHandler CALLFIRST, ApiResolverHandler ; This exception handler will only handle exception's thrown as EXCEPTIONBREAKPOINT. When it is thrown by us, we're able t...

TamperingSyscalls

TamperingSyscalls TamperingSyscalls is a 2 part novel project consisting of argument spoofing and syscall retrival which both abuse EH in order to subvert EDRs. This project consists of both of these projects in order to provide an alternative solution to direct syscalls. Tampering with syscalls...

GhidraEmu

GhidraEmu This experimental Ghidra plugin allows you to easily deal with native pcode emulation. No scripts are needed anymore, just use it directly from Ghidra. It can be particularly useful for working with a variety of exotic processors that are not supported by common emulators. If the...

PatchlessCLRLoader

PatchlessCLRLoader PatchlessCLRLoader is a fork of InlineExecute-Assembly to load .NET assembly and direct the output to mailslot. I rewrites it to a standalone loader with the following implementation: AES encryption payload Fileless payload support Patchless AMSI and ETW bypass using hardware...

Voidgate

VOIDGATE Description: A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes such as msfvenom by performing on-the-fly decryption of individual encrypted assembly instructions, thus rendering memory scanners useless for that...

flare-qdb

FireEye Labs Query-Oriented Debugger flare-qdb is a command-line and scriptable Python-based tool for evaluating and manipulating native program state. It uses Vivisect to set a breakpoint on each queried instruction and executes Python code when hit. flare-qdb frees the analyst to take a nonline...

flare-qdb

FireEye Labs Query-Oriented Debugger flare-qdb es una herramienta basada en Python, utilizable desde la línea de comandos y mediante scripts, diseñada para evaluar y manipular el estado nativo de un programa. Utiliza Vivisect para establecer un punto de interrupción en cada instrucción consultada...

psr

Pointer Sequence Reverser Designed to help a reverse engineer easily see how a Windows C++ application is accessing a particular data member or object. Given the memory address of a data member or object, this tool will set a memory breakpoint at that address and then produce traces of the...

mora-hwbp

Mora-HWBP — AMSI / WLDP / ETW Telemetry Hooking via Hardware Breakpoints A security-research Proof-of-Concept POC demonstrating hardware-breakpoint CPU debug register based function hooking as an alternative to traditional in-memory code patching. Purpose & Scope This repository is published...

Linux Distros Unpatched Vulnerability : CVE-2026-90306

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ARM: 9481/2: breakpoint: CFI breakpoints only on demand This removes the stub hwbreakpointcfihandler from ARM, making it not steal breakpoint type 0x03...

DEBIAN-CVE-2026-90306

In the Linux kernel, the following vulnerability has been resolved: ARM: 9481/2: breakpoint: CFI breakpoints only on demand This removes the stub hwbreakpointcfihandler from ARM, making it not steal breakpoint type 0x03 ARMENTRYCFIBREAKPOINT unless CFI is actively used in the kernel. When not...

CVE-2026-90306

In the Linux kernel, the following vulnerability has been resolved: ARM: 9481/2: breakpoint: CFI breakpoints only on demand This removes the stub hwbreakpointcfihandler from ARM, making it not steal breakpoint type 0x03 ARMENTRYCFIBREAKPOINT unless CFI is actively used in the kernel. When not...

CVE-2026-90306

CVE-2026-90306 affects the Linux kernel on ARM architectures. The vulnerability resides in the hw_breakpoint_cfi_handler() stub, which was unconditionally claiming breakpoint type 0x03 (ARM_ENTRY_CFI_BREAKPOINT) even when CFI (Control Flow Integrity) was not actively instrumented in the kernel. T...

CVE-2026-90306: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ARM: 9481/2: breakpoint: CFI breakpoints only on demand This removes the stub hwbreakpointcfihandler from ARM, making it not steal breakpoint type 0x03 ARMENTRYCFIBREAKPOINT unless CFI is actively used in the kernel. When not...

PT-2026-93567

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM s390 architecture within the import wp info function. The len field of the kvm hw breakpoint structure, which is controlled by user space, is assigned to an...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: ARM: 9064/1: hwbreakpoint: Do not directly check the event’s overflowhandler hook The commit 1879445dfa7b “perf/core: Set event’s default ::overflowhandler” sets a default event-overflowhandler in perfeventalloc, and replaces the...