Search Results - RepositoryStats

DEFCON-31-Syscalls-Workshop VirtualAlllocEx

93

632

unknown

10

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

syscalls workshop shellcode edr-bypass edr-evasion direct-syscalls antivirus-bypass malware-analysis shellcode-loader antivirus-evasion indirect-syscalls windows-internals malware-development malware-development-guide

Created 2023-04-30

1,148 commits to main branch, last one 9 months ago

Direct-Syscalls-vs-Indirect-Syscalls VirtualAlllocEx

22

164

unknown

5

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

av-bypass av-evasion edr-bypass edr-evasion windows-int direct-syscalls shellcode-loader indirect-syscalls

Created 2023-05-23

10 commits to main branch, last one 9 months ago

shadow_syscall annihilatorq

11

130

apache-2.0

4

windows syscalls with a single line and a high level of abstraction. has modern cpp20 wrappers and utilities, range-based DLL and export enumeration, wrapper around kuser_shared_data. supported compil...

cpp masm export hashing syscall analysis syscalls shellcode header-only obfuscation win-internals getprocaddress direct-syscalls getmodulehandle shadow-syscalls reverse-engineering

Created 2023-08-23

33 commits to shellcode branch, last one about a month ago

Direct-Syscalls-A-journey-from-high-to-low VirtualAlllocEx

20

128

unknown

2

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

av-bypass av-evasion edr-bypass edr-evasion direct-syscalls

Created 2023-04-14

17 commits to main branch, last one about a year ago

DSC_SVC_REMOTE VirtualAlllocEx

10

50

unknown

2

This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service p...

av-bypass av-evasion edr-bypass edr-evasion direct-syscalls

Created 2023-05-08

12 commits to main branch, last one about a year ago