Search Results - RepositoryStats

DEFCON-31-Syscalls-Workshop VirtualAlllocEx

90

572

unknown

10

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

syscalls workshop shellcode edr-bypass edr-evasion direct-syscalls antivirus-bypass malware-analysis shellcode-loader antivirus-evasion indirect-syscalls windows-internals malware-development malware-development-guide

Created 2023-04-30

1,148 commits to main branch, last one 5 months ago

Direct-Syscalls-vs-Indirect-Syscalls VirtualAlllocEx

18

136

unknown

4

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

av-bypass av-evasion edr-bypass edr-evasion windows-int direct-syscalls shellcode-loader indirect-syscalls

Created 2023-05-23

10 commits to main branch, last one 5 months ago

Direct-Syscalls-A-journey-from-high-to-low VirtualAlllocEx

19

121

unknown

2

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

av-bypass av-evasion edr-bypass edr-evasion direct-syscalls

Created 2023-04-14

17 commits to main branch, last one about a year ago

shadow_syscall annihilatorq

11

90

apache-2.0

1

windows syscalls with a single line and a comfort wrapper. comfort process module & export enumeration. clang, gcc, msvc supported

cpp masm export hashing syscall analysis syscalls shellcode header-only obfuscation win-internals getprocaddress direct-syscalls getmodulehandle shadow-syscalls reverse-engineering

Created 2023-08-23

7 commits to shellcode branch, last one 14 days ago

DSC_SVC_REMOTE VirtualAlllocEx

10

47

unknown

2

This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service p...

av-bypass av-evasion edr-bypass edr-evasion direct-syscalls

Created 2023-05-08

12 commits to main branch, last one about a year ago