PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Malware development part 1 - basics

0xpat.github.io | blog | #red-team | #metasploit | #c-plus-plus | #malware-development | #shellcode | #antivirus-evasion
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Series kickoff: a C++ shellcode launcher and the three AV detection mechanisms it must survive—signature, heuristic and sandbox—plus msfvenom shellcode generation and Visual Studio project setup.
Published
Collected

Related coverage

blog · bishopfox.com
Rust for Malware Development
Bishop Fox compares Rust and C/C++ for malware: larger, harder-to-analyze binaries complicate reverse engineering and can slip past signature detection — demonstrated with a simple shellcode dropper.
blog · netspi.com
Executing MSF Payloads via PowerShell Webshellery
A Metasploit module turns arbitrary file upload into shells on Windows backends: its JSP, PHP, or ASPX webshells launch base64-encoded PowerShell commands running MSF payloads past antivirus.
blog · 0xpat.github.io
Malware development part 9 - hosting CLR and managed code injection
Malware development part 9: executing managed .NET assemblies from native code—hosting the CLR via ICLRRuntimeHost/ICorRuntimeHost, and running payloads from memory rather than disk.
blog · 0xpat.github.io
Malware development part 8 - COFF injection and in-memory execution
Part 8 of the malware dev series: a COFF object-file loader à la Cobalt Strike's BOFs—compiling C to .obj, parsing headers, sections and relocations, then executing the machine code from memory.
blog · 0xpat.github.io
Malware development part 7 - Secure Desktop keylogger
Part 7 of the malware dev series builds a Secure Desktop keylogger: after escalating to SYSTEM, a low-level keyboard hook on the WINLOGON desktop captures credentials typed into UAC and logon prompts.
blog · 0xpat.github.io
Malware development part 6 - advanced obfuscation with LLVM and template metaprogramming
Malware development part 6: anti-disassembly obfuscation with Obfuscator-LLVM—how IR-level transforms and template metaprogramming hide control flow, plus the VS2017 build setup.
Back