/r/netsec - Information Security News & Discussion

Improved SLEAPING sleepmask using Timers and APCs in order to spoof Timer Callback addresses at sleeping time achieving a more resilient sleep mask that works against great in-memory scanner like HSB, Moneta, etc. Also call stack return address detection

By: ／u／oldboy21 — September 18^th 2024 at 05:45

submitted by /u/oldboy21
[link] [comments]

/r/netsec - Information Security News & Discussion

In-memory sleeping technique using threads created in suspended state and timers that work with the ResumeThread function after context is set for execution. Each workers has its own stack and no need to modify the list of valid indirect call targets in C

By: ／u／oldboy21 — June 5^th 2024 at 06:58

submitted by /u/oldboy21
[link] [comments]

/r/netsec - Information Security News & Discussion

HardwareBreakPoint + Ekko ROP modified to hold stack arguments + Kernel Objects Enumeration for some honest hiding in memory.

By: ／u／oldboy21 — May 29^th 2024 at 05:37

submitted by /u/oldboy21
[link] [comments]

/r/netsec - Information Security News & Discussion

Find DLLs with RWX sections

By: ／u／oldboy21 — July 3^rd 2023 at 17:24

Whether you knew Process Mockingjay since ever or you just got to know it, this was "Monday Freedom to" code some C# that finds RWX sections laying around

submitted by /u/oldboy21
[link] [comments]

/r/netsec - Information Security News & Discussion

Yet, another packer/loader with my very own implementation of GetProcAddress and GetModuleHandle to dinamically fetch function addresses, as well as AES payload and function name encryption with a derived SHA256 key

By: ／u／oldboy21 — February 24^th 2023 at 16:19

submitted by /u/oldboy21
[link] [comments]

/r/netsec - Information Security News & Discussion

Find Writable Shares with Python.

By: ／u／oldboy21 — February 10^th 2023 at 13:17

submitted by /u/oldboy21
[link] [comments]

FreshRSS

Improved SLEAPING sleepmask using Timers and APCs in order to spoof Timer Callback addresses at sleeping time achieving a more resilient sleep mask that works against great in-memory scanner like HSB, Moneta, etc. Also call stack return address detection

In-memory sleeping technique using threads created in suspended state and timers that work with the ResumeThread function after context is set for execution. Each workers has its own stack and no need to modify the list of valid indirect call targets in C

HardwareBreakPoint + Ekko ROP modified to hold stack arguments + Kernel Objects Enumeration for some honest hiding in memory.

Find DLLs with RWX sections

Yet, another packer/loader with my very own implementation of GetProcAddress and GetModuleHandle to dinamically fetch function addresses, as well as AES payload and function name encryption with a derived SHA256 key

Find Writable Shares with Python.