ThreadStackSpoofer

Thread Stack Spoofing / Call Stack Spoofing PoC A PoC implementation for an advanced in-memory evasion technique that spoofs Thread Call Stack. This technique allows to bypass thread-based memory examination rules and better hide shellcodes while in-process memory. Intro This is an example...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUIRED -m |region|referenced|ioc -p |PID OPTIONAL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...

LazyHook

Overview LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems HIPS through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed...

Shelter

Shelter Shelter is a completely weaponized sleep obfuscation technique that allows to fully encrypt your in-memory payload making an extensive use of ROP. This crate comes with the following characteristics: AES-128 encryption. Whole PE encryption capability. Removal of execution permission durin...

CallStackMasker

CallStackMasker This repository demonstrates a PoC technique for dynamically spoofing call stacks using timers. Prior to our implant sleeping, we can queue up timers to overwrite its call stack with a fake one and then restore the original before resuming execution. Hence, in the same way we can...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

SilentMoonwalk

SilentMoonwalk PoC Implementation of a fully dynamic call stack spoofer TL;DR SilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from control flow. Authors...

Unwinder

Content SilentMoonWalk Description Credits Usage callfunction! macro indirectsyscall! macro Parameter passing Examples Calling kernel32.dll!Sleep Calling kernel32.dll!OpenProcess Calling NtDelayExecution as indirect syscall Concatenate macro calls Considerations Initial frame PoC Stack replacemen...

CallStackSpoofer

CallStackSpoofer This repository demonstrates a PoC implementation to spoof arbitrary call stacks when making system calls. For a full technical walkthrough please see the accompanying blog post here: https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs. By default it contains...

MassDriver

MassDriver Proxying sensitive API calls from shellcode to artifact for CET compatible clean call stacks. Companion PoC for my blog post: Stop Being Weird — Life After Call Stack Spoofing Under CET. Building MinGW does not have a way to set the CET compatibility flag so you will need llvm-mingw to...

NimicStack

NimicStack NimicStack is the pure Nim implementation of Call Stack Spoofing technique to mimic legitimate programs. Whole project is based on the PoC shared by WithSecure Labs Compilation You can directly compile the source code with the following command: nim c -d=mingw --app=console --cpu=amd64...

PT-2026-145401

geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side without a server. Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion...

CVE-2026-93435

A flaw was found in node-redis-parser. A remote attacker, by sending crafted RESP REdis Serialization Protocol byte streams with repeated array headers, can exploit an unbounded recursion vulnerability in the RESP protocol parser. This can exhaust the V8 call stack, leading to an uncaught...

CVE-2020-37287

A flaw was found in vyper. An attacker interacting with an affected smart contract can cause data corruption and incorrect execution when functions process complex data types, such as multi-dimensional arrays or nested structures. The compiler incorrectly calculates the memory size of these compl...

npm: Forge: Denial of service in TLS record processing via call stack exhaustion

npm: Forge: Denial of service in TLS record processing via call stack exhaustion vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

Forge: Denial of service in TLS record processing via call stack exhaustion

Summary Connections created with forge.tls.createConnection processed received TLS records recursively, one stack level per record. A peer can send one chunk of thousands of small records, such as heartbeat records, which are accepted before the handshake, and process throws RangeError: Maximum...

GHSA-HQQ3-7JHF-C5JX Forge: Denial of service in TLS record processing via call stack exhaustion

Summary Connections created with forge.tls.createConnection processed received TLS records recursively, one stack level per record. A peer can send one chunk of thousands of small records, such as heartbeat records, which are accepted before the handshake, and process throws RangeError: Maximum...

EUVD-2026-113364

Forge: Denial of service in TLS record processing via call stack exhaustion...

CVE-2026-99018

A flaw was found in the Linux kernel's RISC-V architecture support. When Shadow Call Stack SCS, a security feature designed to protect function return addresses, is enabled, the kernel incorrectly validates whether an exception originated from userspace using a user-modifiable register. An...

CVE-2026-119187

A flaw was found in node-forge. The Transport Layer Security TLS implementation processes incoming records through recursive function calls instead of an iterative loop. An unauthenticated remote attacker can exploit this flaw by sending a network payload containing a large number of small TLS...