Aug 12, 2024 09:17 AM
(This post was last modified: Aug 12, 2024 09:23 AM by Hackers.)
(Aug 12, 2024 09:00 AM)pinguoin Wrote: 1- Sir once again, Great work, i've been away for a month and im happy to see you still working on good guides, actualy fun to follow and work with it.
2- I'd like to ask you; Will the September edition be a Begenning to Last Step - by - Step guideline to follow from all your post ? Which could help lots of people to understand where to start and figure more likely if they're being on the right road.
- I'm greatly agreed with this, these are very important base that users should be learning has a simple "Standart".
I don't understand what happenned with the time but, back in the past, we use to have so many good guide and users in HF bringing the quality in !
I hope there will be some more new user's like him.
thanks Pinguoin!
- yes, I'll add more info about the memory methods
- and general info about each step
I hope these things help. At end of the day, I wish more people would release open source code & share knowledge.
There are a lot of products in marketplaces for this kind of thing, but very rarely are they actually worth selling/buying. People should focus on learning & making their own in my opinion.
I've been on forums for 20 years, and the internet has changed a lot.
Forums started with so much passion - a passion for sharing knowledge, learning, and more. Some of that passion feels lost, but not entirely. there is still hope! :)
(Aug 12, 2024 07:23 AM)blyat1337 Wrote: Let me be clear, I am not hating, you are clearly capable, I just don't like half backed code, but that is me. You can do better, and you know it, I know it.
As far as other stuff I mentioned, Unhooking, maybe look into indirect-syscalls, it is a lot more "safe" with EDR, even though some of them are playing in kernelmode and hijhacking HAL so that won't do you good unless you stack spoof/ Hijhack syscall id of unused system call and replace with the one you wanna use etc..
The never ending game, I guess...
The LoadPE is great starting point, no new thread created, same process context. Leading EDR's will be bypassed but if you want to support 100% of files, handle no relocations, handle TLS, handle SEH.
Downloaders are "easy" but they are bad for stability work and require access to "unusual" C&C servers. can lead to detection, real threat actors will never use it. Try holding file offline, you will have a challenge.. but what is life without one?
Good luck anyways
Thanks, appreciate it.
I am working on a syswhispers3 loader as well, which uses syscalls and a variety of methods. Working on prototypes currently but the goal for October is to have syscalls used for a memory loader.
I do understand what you're saying about internet & downloading. I did that because I hadn't before and a few people around HF have talked about web builders recently. The other loaders/crypters I worked on were pretty much all held within the source code, no networking required. I wanted to try something different for this one, so threw that in - but yeah, in practice, it will just cause more headaches than benefits for someone. Storing the bin inside a resource or other data of the final program is definitely better and easier to hide.
I think my main thing is this:
- I did this to learn new concepts as I go, mainly being the win api for downloading payload, and the ntdll text replace from disk. In another one I released couple months ago I did ntdll, without the text replace, but to get addresses from PEB and use that one rather than from disk, or by loading in ntdll a second time.
- agreed that this is not my best work
- it's a scantime protector, so I agree that it won't be used in real red/blue simulations/etc because it won't hold up in runtime
