+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: Jomungand - Shellcode Loader with memory evasion (/showthread.php?tid=6254582)
Jomungand - Shellcode Loader with memory evasion - ĐĮΜĘ - Oct 23, 2023
Exactly what the title states.
https://github.com/RtlDallas/Jomungand
RE: Jomungand - Shellcode Loader with memory evasion - Kayfoxz - Oct 23, 2023
interesting share, pretty cool, hq as always Dime
RE: Jomungand - Shellcode Loader with memory evasion - Tentco - Oct 23, 2023
Some selective EDR's might hook VirtualAlloc even though it's indirectly calling them(not sure).
Maybe this won't run properly on other win version due to syscall number being different then arch in syscalls_stub.asm.
Saving as RC4/AES encrypted bytes inside file with compile-time string encryption instead of reading from file will also make it handy.
The Hardware breakpoint thing is clean(HWBP) I was thinking about something kinda similar like catching segfault and continuing with exception or filling with NOP's on certain jmp's.
Most EDR's blacklisted calls are available here - https://malapi.io/
Thought I would share in case someone doesn't know.