Search Results - RepositoryStats

DEFCON-31-Syscalls-Workshop VirtualAlllocEx

93

636

unknown

10

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

syscalls workshop shellcode edr-bypass edr-evasion direct-syscalls antivirus-bypass malware-analysis shellcode-loader antivirus-evasion indirect-syscalls windows-internals malware-development malware-development-guide

Created 2023-04-30

1,148 commits to main branch, last one 10 months ago

Direct-Syscalls-vs-Indirect-Syscalls VirtualAlllocEx

22

165

unknown

5

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

av-bypass av-evasion edr-bypass edr-evasion windows-int direct-syscalls shellcode-loader indirect-syscalls

Created 2023-05-23

10 commits to main branch, last one 10 months ago

shadow_syscall annihilatorq

13

140

apache-2.0

4

windows syscalls with a single line and a high level of abstraction. has modern cpp20 wrappers and utilities, range-based DLL and export enumeration, wrapper around kuser_shared_data. supported compil...

cpp masm export hashing syscall analysis syscalls shellcode header-only obfuscation win-internals getprocaddress direct-syscalls getmodulehandle shadow-syscalls reverse-engineering

Created 2023-08-23

36 commits to shellcode branch, last one 9 days ago

Direct-Syscalls-A-journey-from-high-to-low VirtualAlllocEx

21

129

unknown

3

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

av-bypass av-evasion edr-bypass edr-evasion direct-syscalls

Created 2023-04-14

17 commits to main branch, last one about a year ago

DSC_SVC_REMOTE VirtualAlllocEx

10

50

unknown

2

This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service p...

av-bypass av-evasion edr-bypass edr-evasion direct-syscalls

Created 2023-05-08

12 commits to main branch, last one about a year ago