Search the Community

PELoader implement various shellcode injection techniques, and use libpeconv library to load encrypted PE files instead of injecting shellcode into remote thread. Following techniques were implemented: Module Stomping (LoadLibrary) Module Stomping (NtMapViewOfSection) Transacted Hollowing Ghostly Hollowing NtMapViewOfSection (RWX-RW-RX) NtAllocateVirtualMemory (RW-RX) Credits: most of my work was based on @hasherezade's PoC scripts. [hide][Hidden Content]]

IDA2Obj is a tool to implement SBI (Static Binary Instrumentation). The working flow is simple: Dump object files (COFF) directly from one executable binary. Link the object files into a new binary, almost the same as the old one. During the dumping process, you can insert any data/code at any location. SBI is just one of the using scenarios, especially useful for black-box fuzzing. [hide][Hidden Content]]

Using Go to implement CobaltStrike’s Beacon This project is for learning protocol analysis and reverse engineering only, if someone’s rights have been violated, please contact me to remove the project, and the last DO NOT USE IT ILLEGALLY [hide][Hidden Content]]