Explore >> Select a destination

You are here

 cocomelonc.github.io
Malware AV/VM evasion - part 16: WinAPI GetProcAddress implementation. Simple C++ example. - cocomelonc
| | bruteratel.com
Exception Junction - Where All Exceptions Meet Their Handler | Brute Ratel C4
3.4 parsecs away

Travel
| | This blog is in relation to some of the hurdles I've met while debugging and researching various new features for Brute Ratel. Before we get started, let me inform you that this blog is not for beginners. It requires some knowledge about Windows internals, exception handlers, and getting your hands dirty with a debugger, preferably x64dbg. And to add to that, there's limited to near zero information on the web related to this topic, thus I spent the last 24 hours researching and writing this from scratch while being high on caffeine.
| | modexp.wordpress.com
Invoking System Calls and Windows Debugger Engine | modexp
3.1 parsecs away

Travel
| | Introduction Quick post about Windows System calls that I forgot about working on after the release of Dumpert by Cn33liz last year, which is described in this post. Typically, EDR and AV set hooks on Win32 API or NT wrapper functions to detect and mitigate against malicious activity. Dumpert attempts to bypass any user-level hooks...
| | alice.climent-pommeret.red
EDR Bypass : How and Why to Unhook the Import Address Table - Alice Climent-Pommeret
2.3 parsecs away

Travel
| |
| | mcuoneclipse.com
Position-Independent Code with GCC for ARM Cortex-M | MCU on Eclipse
22.9 parsecs away

Travel
| Welcome to 'Alice in Wonderland'! For a university research project using an ARM Cortex-M33 we are evaluating position-independent code as way to load applications or part of it with a bootloader. It sounds simple: just add -fPIC to the compiler settings and you are done. Unfortunately, it is not that simple. That option opened up...