GhostlyHollowingViaTamperedSyscalls2

Ghostly Hollowing Via Tampered Syscalls Reupload Notice !NOTE The original repository previously used an incorrect license that omitted attribution to the founder of DeceptIQ, @Rad9800, whose TamperingSyscalls repository is published under the MIT License. His work was already credited in the...

VectoredOverloading

VectoredOverloading Vectored Overloading is a local PE injection technique that was first observed in the KidKadi malware. It works by manipulating the load of a legitimate DLL using Hardware Breakpoints HWBP and Vectored Exception Handling VEH to change the DLL section object on-the-fly...

LazyHook

Overview LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems HIPS through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed...

hbp-attack-demo

fork de https://github.com/veritas501/hbpattackdemo demo de hbpattack Referencia al blog de P0: https://googleprojectzero.blogspot.com/2022/12/exploiting-CVE-2022-42703-bringing-back-the-stack-attack.html Creé un módulo vuln, simulando que tenemos una primitiva de escritura en dirección arbitrari...

unicorn-bios

unicorn-bios About Basic BIOS emulator/debugger for Unicorn Engine. Written to debug the XEOS Operating System boot sequence. Usage: root@kitploit: Usage: unicorn-bios OPTIONS BOOTIMG Options: --help / -h: Displays help. --memory / -m: The amount of memory to allocate for the virtual machine in...

voltron

Voltron Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers LLDB, GDB, VDB and WinDbg by enabling the attachment of utility views that can retrieve and display data from the debugger host. By running these views in other TTYs...

ollydbg-binary-execution-visualizer

This repository does not have a README...

hwbp4mw

This article was origininally for VX-Underground Black Mass Halloween Edition 2022. Hooking Engines: Multi-thread safe x86/x64 hwbp hooking engine c PAGEGUARD/hwbp Breakpoint Library c++20 hwbp Library DLL example c++20 Generic x64 user-land evasion technique utilizing debug registers:...

HWSyscalls

HWSyscalls 主要贡献者 描述 HWSyscalls 是一种使用 3 个主要组件来执行间接系统调用（indirect syscalls）的新方法： 使用硬件断点（Hardware breakpoints）和向量化异常处理程序（Vectored Exception Handler）来控制执行流程。 使用 HalosGate 来查找系统调用编号和地址。 在 kernel32 上利用硬件断点创建合成蹦床（synthetic trampoline）。 HWSyscalls 作为一个易于集成的库提供，可添加到任何想要使用间接系统调用、且不会触发基于现有间接系统调用检测方式的 EDR 或 A...

gdbfuzz

GDBFuzz: Debugger-Driven Fuzzing This is the companion code for the paper: 'Fuzzing Embedded Systems using Debugger Interfaces'. A preprint of the paper can be found here https://publications.cispa.saarland/3950/. The code allows the users to reproduce and extend the results reported in the paper...

gdbfuzz

GDBFuzz: Fuzzing Guiado por Depurador Este es el código complementario del artículo: 'Fuzzing de Sistemas Embebidos usando Interfaces de Depurador'. Una preimpresión del artículo se puede encontrar aquí https://publications.cispa.saarland/3950/. El código permite a los usuarios reproducir y...

EUVD-2007-5876

Malware in sbrugna...

Malicious code in dbk-breakpoints (npm)

The package dbk-breakpoints was found to contain malicious code...

MAL-2025-18098 Malicious code in dbk-breakpoints (npm)

The package dbk-breakpoints was found to contain malicious code...

welpwn

Introduction Pwnning is an art. welpwn is designed to make pwnning an art, freeing you from dozens of meaningless jobs. Features - Automatically get those magic values for you. - libc address - heap address - stack address - program address with PIE - canary - Support multi glibc debugging. - 2.1...

Malicious code in atg-breakpoints (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-4162 Malicious code in atg-breakpoints (npm)

--- -= Per source details. Do not edit below this line.=-...

Exploit for CVE-2024-27398

CVE-2024-27398 CVE-2024-27398 POC Dmesg Output !PoC Screen...

pwncli

This is an offensive tool for binary exploitation. The primary vulnerability targeted is not explicitly stated, but the code and documentation suggest that it is a buffer overflow vulnerability in a binary named "stackoverflownopie" and "stackoverflowpie". The tool, named "pwncli", is designed to...

Bread - BIOS Reverse Engineering And Advanced Debugging

BREAD BIOS Reverse Engineering & Advanced Debugging is an 'injectable' real-mode x86 debugger that can debug arbitrary real-mode code on real HW from another PC via serial cable. Introduction BREAD emerged from many failed attempts to reverse engineer legacy BIOS. Given that the vast majority -- ...