PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Combining Indirect Dynamic Syscalls and API Hashing

labs.cognisys.group | blog | #windows | #red-team | #evasion | #shellcode | #syscalls | #api-hashing
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Overview
Published
Collected

Related coverage

blog · labs.cognisys.group
Advanced Module Stomping & Heap/Stack Encryption
Overview
blog · bishopfox.com
Rust for Malware Development
Bishop Fox compares Rust and C/C++ for malware: larger, harder-to-analyze binaries complicate reverse engineering and can slip past signature detection — demonstrated with a simple shellcode dropper.
blog · bugcrowd.com
Weird ways to hide shellcode
Discover a novel red teaming technique for hiding shellcode inside procedurally generated mazes, using shortest-path algorithms to disguise payloads from EDR and antivirus detection.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
tool · github.com
IUM-Debugger: Patching Secure Kernel to Enable Debugging of VTL 1 Isolated User Mode Trustlets
Overcomes signature-enforced boot protections on securekernel.exe to unlock dynamic live debugging of Windows VBS trustlets (e.g., Credential Guard), greatly simplifying reverse engineering and vulnerability research against isolated secure enclaves.
blog · bishopfox.com
From Fork to Framework: What Modifying Apollo Taught Us About Agent Invasion
Bishop Fox forked Mythic's Apollo agent and built a custom obfuscator to evade EDR, but Apollo's architecture assumed readable symbol names — obfuscation failed, pushing a from-scratch redesign.
Back