direct-syscalls · GitHub Topics

VirtualAlllocEx / DEFCON-31-Syscalls-Workshop

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

antivirus-bypass antivirus-evasion edr-bypass edr-evasion malware-development windows-internals direct-syscalls indirect-syscalls malware-analysis malware-development-guide workshop shellcode-loader syscalls Shell

C 650

1 年前

VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

av-bypass av-evasion direct-syscalls edr-bypass edr-evasion indirect-syscalls shellcode-loader

C 178

1 年前

annihilatorq / shadow_syscall

windows syscalls with a single line and a high level of abstraction. has modern cpp20 wrappers and utilities, range-based DLL and export enumeration, wrapper around KUSER_SHARED_DATA. supported compil...

direct-syscalls 逆向工程 syscall syscalls Shell analysis C++export hashing header-only obfuscation

C++ 168

1 个月前

VirtualAlllocEx / Direct-Syscalls-A-journey-from-high-to-low

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

av-bypass av-evasion direct-syscalls edr-bypass edr-evasion

C 133

2 年前

voidvxvt / HellBunny

Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks

direct-syscalls edr-evasion indirect-syscalls malware-development msvc Windows process-injection edr-bypass dll shellcode-injection shellcode-loader

C 82

3 个月前

VirtualAlllocEx / DSC_SVC_REMOTE

This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service p...

av-bypass av-evasion direct-syscalls edr-bypass edr-evasion

C 51

2 年前

Fadouse / BypassETWDirectSyscallShellcodeLoader

BypassETWDirectSyscallShellcodeLoader is a robust C++14 application designed for secure and stealthy shellcode execution. It incorporates advanced anti-debugging and anti-sandboxing techniques to evad...

bypass-antivirus direct-syscalls injector shellcode-injection shellcode-loader

C++ 7

1 个月前