Locked AtlasLdr - Reflective x64 PE/DLL Loader implemented using Dynamic Indirect Syscalls

[itsMe]

This is the hidden content, please

• Sign In
• or
• Sign Up

Atlas is a reflective x64 loader that has the following features:

Features

    Retrieve of DLL and PE from a remote server
    Manual Mapping on a remote process
    Position independent code
    Use of indirect Syscalls
        ZwAllocateVirtualMemory
        ZwProtectVirtualMemory
        ZwQuerySystemInformation
        ZwFreeVirtualMemory
        ZwCreateThreadEx
    Single stub for all Syscalls
        Dynamic SSN retrieve
        Dynamic Syscall address resolution
    Atlas also uses
        LdrLoadDll
        NtWriteVirtualMemory
    Custom implementations of
        GetProcAddress
        GetModuleHandle
    API hashing
    Cleanup on error
    Variable EntryPoint

This is the hidden content, please

• Sign In
• or
• Sign Up