Vectored-Exception-Handling-Squared

Vectored Exception Handling Squared A Rust Proof of Concept. Read more on my blog, all original research by CrowdStrike, this is just the POC for it! Unless I am blind; there does not seem to be much out there POC's etc relating to the discovery made by CrowdStrike researchers, called Vectored...

Shellcode-Test-Harness

Shellcode Test Harness A lightweight test harness designed to speed up shellcode development by providing an execution environment with integrated crash diagnostics and debug output redirection. Features Executes shellcode via module stomping Uses VEH to catch crashes: If the shellcode faults, it...

Astral_Projection

Astral Projection - UDRL Astral Projection is a Cobalt Strike UDRL User-Defined Reflective Loader, that performs advanced module stomping. The UDRL loads a module using LoadLibraryExW, then manipulates its internals by setting VEH to intercept strategic calls that allow it to steal the section...

EhTrace

EhTrace EhTrace pronounced "ATrace" is a high-performance binary tracing and instrumentation framework for Windows. It enables deep runtime analysis of Windows executables without requiring source code, binary modifications, or traditional debugging. Overview EhTrace leverages Windows Vectored...

LazyHook

Overview LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems HIPS through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed...

AMSI-patches-learned-till-now

これまでに学んだAMSIパッチ これまでに学んだすべてのAMSIパッチを文書化しました。 ❗ これまでの私のAMSIパッチ学習。私の会社の資産には属しません！ 免責事項: このコードは現時点では回避を目的としたものではありません！あくまで概念的なアプローチです。 リンク: 1. https://web.archive.org/web/20220718153535/https://pre.empt.dev/posts/maelstrom-etw-amsi/AntimalwareScanInterfaceAMSI 2...

DetectWindowsCopyOnWriteForAPI

Windows 공격 헤더 헌팅용 프로세스 속성 열거 도구 배경 이 도구들의 목적은 위협 행위자가 사용하는 프로세스 인젝션 트레이드크래프트 탐지를 지원하는 Windows 프로세스 속성을 열거하는 것입니다. 도구 d-cow - 공유 Windows API예: EtwEventWrite의 인메모리 패칭 탐지를 위한 Windows COWCopy on Write 탐지기 d-criticalsections - Windows 프로세스가 보유한 임계 섹션critical section 수를 열거합니다 d-dr-registers - 하드웨어 중단점을...

antidbg

AntiDBG antidbg は、Windows 向けの x64 ユーザーモード アンチデバッグ ライブラリであり、ソフトウェアをデバッグから保護するために設計されています。 このライブラリは、アンチデバッグ保護の基盤として考えてください。唯一の防御手段として考えないでください。 このライブラリは: 非常に使いやすい 必要な関数呼び出しは 1 回だけ。 高性能かつ最小限のリソース使用量 CPU 使用率 1%、メモリ 2MB 未満 のために設計されています。 外部依存関係が一切ありません。 完全に MIT ライセンスです。 CFG 準拠です。 構造...

[Full-disclosure] # a new bug in Olly

Hello full-disclosure! I've found a bug in Olly leading to crash SEH/VEH-based programs during tracing. an example-pack could be found at my web-site http://nezumi.org.ru/olly-bug-776.zip, it includes two SEH/VEH programs and requests XP or latter to run VEH, while SEH works everywhere. Load an...