InflativeLoading

InflativeLoading Article: https://winslow1984.com/books/malware/page/reflectiveloading-and-inflativeloading Major Update History In this section, major updates are provided. Major updates do include added supports or features. 4/11/2024 Added PE Signature Obfuscation Only a few bytes in the PE...

HeaderLessPE

HeaderLessPE Introduction 中文 HeaderLessPE is a memory PE loading technique used by the Icedid Trojan. Based on this technology, we propose a new way of file-less attack using HVNC . This enhancement allows to inject HeaderLessPE into execute graphical hacking tools without limitations. Compared t...

PESTO

PESTO: PE files Statistical Tool Description PESTO is a Python script that extracts and saves in a database some PE file security characteristics or flags searching for every PE binary in a whole directory, and saving results in a database. It checks for architecture flag in the header, and for t...

swapgs-attack-poc

PoC for the SWAPGS attack CVE-2019-1125 This repository holds the sources for the SWAPGS attack PoC publicly shown at Black Hat USA, 2019. Contents leakgsbkva - variant 1 look for random values in kernel memory; limited to PE kernel image header leakgsbkvat - variant 2 extract random values from...

MappedImagesDetector

MappedImagesDetector Native Windows memory scanner for detecting malicious DLL injections and in-memory malware MappedImagesDetector is a low-level C++20 Windows tool designed to detect malicious DLL injection techniques used by modern malware, including manual-mapped DLLs, erased PE headers, and...

CVE-2026-40499

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's printgvars function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted...

SUSE CVE-2006-1614

Integer overflow in the cliscanpe function in the PE header parser libclamav/pe.c in Clam AntiVirus ClamAV before 0.88.1, when ArchiveMaxFileSize is disabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code...

Process-Dump - Windows Tool For Dumping Malware PE Files From Memory Back To Disk For Analysis

Process Dump is a Windows reverse-engineering command-line tool to dump malware memory components back to disk for analysis. Often malware files are packed and obfuscated before they are executed in order to avoid AV scanners, however when these files are executed they will often unpack or inject...

KsDumper - Dumping Processes Using The Power Of Kernel Space

I always had an interest in reverse engineering. A few days ago I wanted to look at some game internals for fun, but it was packed & protected by EAC EasyAntiCheat. This means its handle were stripped and I was unable to dump the process from Ring3. I decided to try to make a custom driver that...

PESTO - PE (files) Statistical Tool

PESTO is a Python script that extracts and saves in a database some PE file security characteristics or flags searching for every PE binary in a whole directory, and saving results in a database. It checks for architecture flag in the header, and for the following security flags: ASLR, NOSEH, DEP...

CVE-2016-10402

Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\SYSTEM via a section header with a very large relative virtual address in a PE file, causing an integer overflow and heap-based buffer underflow...

Design/Logic Flaw

The kernel component in Symantec Anti-Virus Engine AVE 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cause a denial of service memory access violation and system crash via a malformed PE header file...

CVE-2016-2208

The kernel component in Symantec Anti-Virus Engine AVE 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cause a denial of service memory access violation and system crash via a malformed PE header file...

CVE-2016-2208

CVE-2016-2208 affects Symantec Antivirus Engine (AVE) kernel component in AVE 20151.1 before 20151.1.1.4. The issue arises when parsing malformed PE header files, enabling remote attackers to execute arbitrary code or cause a memory access violation and system crash. Several advisories and assess...

The vulnerability of the Symantec Anti-Virus Engine’s antivirus kernel allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the Symantec Anti-Virus Engine is related to errors in syntactic analysis of executable files, packaged using the ASPack software. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or trigger a service failure memory corruption using a file with...

CVE-2016-2208: Undefined Security Weakness

The kernel component in Symantec Anti-Virus Engine AVE 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cause a denial of service memory access violation and system crash via a malformed PE header file...

Symantec Antivirus Engine 20151.1.0.32 Malformed PE Header Parser Memory Access Violation (SYM16-008)

The version of Symantec Antivirus Engine AVE installed on the remote host is 20151.1.0.32. It is, therefore, affected by a remote code execution vulnerability due to improper parsing of malformed portable-executable PE header files and executables packed with early versions of Aspack. A remote...

Symantec Antivirus Engine Malformed PE Header Parser Memory Access Violation

SUMMARY Symantec's Anti-Virus Engine AVE was susceptible to memory access violation due to a flaw when parsing a specifically-crafted PE header file in the kernel. The most common symptom of a successful attack would result in a system crash. AFFECTED PRODUCTS Symantec Anti Virus Engine --- CVE |...

PT-2016-1846

Name of the Vulnerable Software and Affected Versions Symantec Anti-Virus Engine versions 20151.1 through 20151.1.1.4 Description The issue is related to errors in parsing executable files packed with ASPack software. It may allow a remote attacker to execute arbitrary code or cause a denial of...

Detours to modify the paragraph properties of vulnerability-vulnerability warning-the black bar safety net

Detours to modify the paragraph properties of the vulnerability Affected Software and systems Detours3. 0 and previous versions Description This issue will be its positioning as a vulnerability may be less suitable, the more likely that Detours a BUG, but because the defect will cause the exploit...