frida-wshook

frida-wshook frida-wshook is an analysis and instrumentation tool which uses frida.re to hook common functions often used by malicious script files which are run using WScript/CScript. The tool intercepts Windows API functions and doesn't implement function stubs or proxies within the targeted...

InjectProc

InjectProc Process injection is a very popular method to hide malicious behavior of code and are heavily used by malware authors. There are several techniques, which are commonly used: DLL injection, process replacement a.k.a process hollowing, hook injection and APC injection. Most of them use...

applepie

applepie, a hypervisor implementation for Bochs Hello! Welcome to applepie! This is a tool designed for fuzzing, introspection, and finding bugs! This is a hypervisor using the Windows Hypervisor Platform API present in recent versions of Windows specifically this was developed and tested on...

CVE-2022-29072

INFORMATION I haven't posted any poc code anywhere for privilege escalation attack. The poc codes found have nothing to do with privilege escalation. For your information. About 7-zip 7-Zip is a free and open-source file archiver. The command line version of 7-Zip is also available for Unix-like...

instrumentation_callbacks

instrumentationcallbacks Instrumentation callbacks are quite a fun undocumented part of Windows. All the code in this repository is released under the MIT license. This repository uses google style C++ spacing. PRs are welcome if you find issues, bugs, or believe a specific feature should be adde...

WhoamiAlternatives

Alternatives to whoami Some experiments to retrieve the current username without calling whoami.exe or similar binaries. Method 1: PRTLUSERPROCESSPARAMETERS Get the environment variables from the PEB structure and parse it to find the username. Function NtQueryInformationProcess returns a...

gftrace

gftrace Una herramienta de línea de comandos para rastrear llamadas a la API de Windows en binarios de Golang. Nota: Esta herramienta es un PoC y un prototipo en desarrollo, así que por favor trátela como tal. ¡Los comentarios son siempre bienvenidos! ¿Cómo funciona? Aunque los programas Golang...

gftrace

gftrace A command line Windows API tracing tool for Golang binaries. Note: This tool is a PoC and a work-in-progress prototype so please treat it as such. Feedbacks are always welcome! How it works? Although Golang programs contains a lot of nuances regarding the way they are built and their...

delete-self-poc

🗑️ delete-self-poc The delete-self-poc is a demonstration of a method to delete a locked executable or currently running file from disk. This concept was initially discovered by Jonas Lykkegaard, and I have created the proof of concept POC for it. Additionally, it can be used to delete locked file...

NtDetours

NTSTATUS NTAPI TrInitPVOID ImageBase = &ImageBase; make IAT writable. look for simple.cpp TimedSleepEx calls the real SleepEx API through the TrueSleepEx function pointer. static DWORD WINAPI TrueSleepExDWORD dwMilliseconds, BOOL bAlertable = SleepEx; DWORD WINAPI TimedSleepExDWORD dwMilliseconds...

SilentMoonwalk

SilentMoonwalk PoC Implementation of a fully dynamic call stack spoofer TL;DR SilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from control flow. Authors...

go-shellcode

go-shellcode go-shellcode is a repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using various API calls or techniques. The available Shellcode runners include: CreateFiber CreateProcess CreateProcessWithPipe CreateRemoteThread...

maldev-for-dummies

Malware Development for Dummies In the age of EDR, red team operators cannot get away with using pre-compiled payloads anymore. As such, malware development is becoming a vital skill for any operator. Getting started with maldev may seem daunting, but is actually very easy. This workshop will sho...

EDRs

EDRs This repo contains information about EDRs that can be useful during red team exercise. patchsyscalldynamically64.c This proof-of-concept is resolving the syscall ID dynamically no need to check the version running on the remote host. To get the information on disk not tampered a call to...

dynmx

dynmx Prototype dynmx spoken dynamics is a signature-based detection approach for behavioural malware features based on Windows API call sequences. In a simplified way, you can think of dynmx as a sort of YARA for API call traces so called function logs originating from malware sandboxes. Hence,...

dynmx

Prototipo de dynmx dynmx pronunciado dynamics es un enfoque de detección basado en firmas para características de comportamiento de malware basado en secuencias de llamadas a la API de Windows. De manera simplificada, puede pensar en dynmx como una especie de YARA para trazas de llamadas a la API...

RtlHijack

RtlHijack A repository with scripts to demonstrate alternative Read and Write primitives using Rtl functions the unintended way. RtlFillMemory.c RtlFillMemory takes three arguments: a pointer to the destination memory, the number of bytes to write, and a single byte value. Writes only a byte into...

windows-api-function-cheatsheets

Hoja de referencia de funciones de la API de Windows Contacto 🌨️ Snowcrash: [email protected] Tabla de contenidos Hoja de referencia de funciones de la API de Windows Operaciones de archivos Gestión de procesos Gestión de memoria Gestión de hilos Gestión de bibliotecas de vínculos dinámicos...

Nim_DInvoke

Nim DInvoke D/Invoke implementation in Nim All Nim binaries typically expose the same 58-60 Windows API functions: All other Windows API functions are typically resolved on runtime via GetProcAddress and LoadLibraryA as mentioned in OffensiveNim or this blog post. So, it's not possible to hide AP...

flare-ida

Code Grafter Function Replacements About Code Grafter Code Grafter is an IDA Python script that makes it possible to use IDA Pro's Bochs IDB Mode to emulate code that imports Windows API functions. Emulation environments like Bochs IDB mode do not resolve or emulate imported functions, resulting ...