62 matches found
LazyHook
Overview LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems HIPS through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed...
unicorn-bios
unicorn-bios About Basic BIOS emulator/debugger for Unicorn Engine. Written to debug the XEOS Operating System boot sequence. Usage: Usage: unicorn-bios OPTIONS BOOTIMG Options: --help / -h: Displays help. --memory / -m: The amount of memory to allocate for the virtual machine in megabytes...
VectoredOverloading
VectoredOverloading Vectored Overloading is a local PE injection technique that was first observed in the KidKadi malware. It works by manipulating the load of a legitimate DLL using Hardware Breakpoints HWBP and Vectored Exception Handling VEH to change the DLL section object on-the-fly...
GhostlyHollowingViaTamperedSyscalls2
Ghostly Hollowing Via Tampered Syscalls Reupload Notice !NOTE The original repository previously used an incorrect license that omitted attribution to the founder of DeceptIQ, @Rad9800, whose TamperingSyscalls repository is published under the MIT License. His work was already credited in the...
hbp-attack-demo
fork from https://github.com/veritas501/hbpattackdemo hbpattack demo Reference: P0 blog: https://googleprojectzero.blogspot.com/2022/12/exploiting-CVE-2022-42703-bringing-back-the-stack-attack.html Created a vuln module, pretending we have a kernel arbitrary address write primitive, but KASLR is...
voltron
Voltron Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers LLDB, GDB, VDB and WinDbg by enabling the attachment of utility views that can retrieve and display data from the debugger host. By running these views in other TTYs...
ollydbg-binary-execution-visualizer
This repository does not have a README...
hwbp4mw
この記事は、元々 VX-Underground Black Mass Halloween Edition 2022 向けに書かれたものです。 フッキングエンジン: マルチスレッドセーフ x86/x64 hwbp フッキングエンジン c PAGEGUARD/hwbp ブレークポイントライブラリ c++20 hwbp ライブラリ DLL の例 c++20 デバッグレジスタを利用した汎用的な x64 ユーザーランド回避技術: TamperingSyscalls2 c TamperingSyscalls2 c++20 利用可能な ETW/AMSI フックの例 rad9800/misc...
HWSyscalls
HWSyscalls Main Contributors Description HWSyscalls is a new method to execute indirect syscalls using 3 main components: Hardware breakpoints and Vectored Exception Handler to control the flow of execution. HalosGate is used to find syscall numbers and addresses. Creating a synthetic trampoline ...
gdbfuzz
GDBFuzz: Debugger-Driven Fuzzing This is the companion code for the paper: 'Fuzzing Embedded Systems using Debugger Interfaces'. A preprint of the paper can be found here https://publications.cispa.saarland/3950/. The code allows the users to reproduce and extend the results reported in the paper...
gdbfuzz
GDBFuzz: 디버거 기반 퍼징 이 저장소는 논문 'Fuzzing Embedded Systems using Debugger Interfaces'의 동반 코드입니다. 논문의 사전 인쇄본은 https://publications.cispa.saarland/3950/ 에서 찾을 수 있습니다. 이 코드는 사용자가 논문에 보고된 결과를 재현하고 확장할 수 있도록 합니다. 결과를 보고, 재현하거나 확장할 때는 위 논문을 인용해 주시기 바랍니다. 폴더 구조 . ├── benchmark Google의 퍼저 테스트 스위트를 빌드하고 실험을...
CVE-2026-90306 ARM: 9481/2: breakpoint: CFI breakpoints only on demand
In the Linux kernel, the following vulnerability has been resolved: ARM: 9481/2: breakpoint: CFI breakpoints only on demand This removes the stub hwbreakpointcfihandler from ARM, making it not steal breakpoint type 0x03 ARMENTRYCFIBREAKPOINT unless CFI is actively used in the kernel. When not...
DEBIAN-CVE-2026-89923
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Free guest debug data on vcpu destroy kvms390clearbpdata is only called from kvmarchvcpuioctlsetguestdebug, i.e. when user space changes or disables debugging. A vCPU that is destroyed while hardware breakpoints are...
PT-2026-93564
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM s390 architecture where guest debug data is not properly freed when a vCPU is destroyed. The function kvm s390 clear bp data is only triggered when user space...
EUVD-2007-5876
Malware in sbrugna...
Malicious code in dbk-breakpoints (npm)
The package dbk-breakpoints was found to contain malicious code...
MAL-2025-18098 Malicious code in dbk-breakpoints (npm)
The package dbk-breakpoints was found to contain malicious code...
welpwn
Introduction Pwnning is an art. welpwn is designed to make pwnning an art, freeing you from dozens of meaningless jobs. Features - Automatically get those magic values for you. - libc address - heap address - stack address - program address with PIE - canary - Support multi glibc debugging. - 2.1...