Folder Path

/vx/Papers/Windows/Evasion - Systems Call and Memory Evasion/

0 directories 49 files
List Grid
Name
Size Modified
Up
2019-06-19 - Combining Direct System Calls and sRDI.pdf
2.0 MiB
2019-07-07 - Calling Syscalls Directly from Visual Studio to Bypass AVs and EDRs.pdf
503 KiB
2020-05-10 - The Fake Entry Point Trick.txt
4.2 KiB
2020-06-20 - Hiding Process Memory via Anti-Forensic Techniques.pdf
467 KiB
2020-12-31 - Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams.pdf
332 KiB
2021-01-09 - Heresys Gate Kernel ZwNTDLL Scraping and Work Out Ring 0 to Ring 3 via Worker Factories.pdf
442 KiB
2021-01-10 - Offensive Windows IPC Internals 1 Named Pipes.pdf
579 KiB
2021-02-12 - Offensive Windows IPC Internals 2 RPC.pdf
682 KiB
2021-03-28 - Executing a PE File in Memory.zip
19 MiB
2021-12-07 - Dynamically Retrieving SYSCALLs - Hells Gate.7z
366 KiB
2021-12-07 - Identifying Antivirus Software by enumerating Minifilter String Names.7z
152 KiB
2022-02-04 - AppLocker bypass by hash caching misuse.pdf
150 KiB
2022-02-04 - JmpNoCall.pdf
1.2 MiB
2022-03-11 - AV and EDR Evasion Using Direct System Calls.pdf
1.0 MiB
2022-04-03 - NtdllPipe - Using cmd.exe to retrieve a clean version of ntdll.dll.pdf
117 KiB
2022-04-09 - Demonstrating API Hooking in Rust.rar
1.9 MiB
2022-04-11 - Demonstrating Copying Data To A GPU - GpuMemoryAbuse.cpp
12 KiB
2022-04-19 - Resolving System Service Numbers using the Exception Directory.pdf
116 KiB
2022-04-22 - Bypassing LSA Protection in Userland.pdf
656 KiB
2022-04-23 - Bypassing PESieve and Moneta The easy way.pdf
1.7 MiB
2022-05-05 - A very simple and alternative PID finder.pdf
212 KiB
2022-05-24 - Gargoyle x64 - DeepSleep.zip
173 KiB
2022-06-14 - Demonstrating inline syscalls in Cplusplus.zip
12 KiB
2022-06-17 - Demonstrating Thread Stack Spoofing.zip
231 KiB
2022-06-26 - Protecting the Heap - Encryption and Hooks.pdf
432 KiB
2022-06-30 - CallStack Spoofer Demonstration.zip
16 KiB
2022-06-30 - Spoofing Call Stacks To Confuse EDRs.pdf
2.2 MiB
2022-07-05 - Vulpes - Obfuscating Memory Regions with Timers.pdf
353 KiB
2022-08-02 - Fourteen Ways to Read the PID for the Local Security Authority Subsystem Service LSASS.pdf
553 KiB
2022-08-04 - API Resolving Obfuscation via Veh.zip
11 KiB
2022-08-07 - Tampering With Windows Syscalls.zip
33 KiB
2022-08-08 - Manual Implementation of BlockDLLs and ACG.cpp
4.2 KiB
2022-08-16 - Demonstrating inline function importing in Cplusplus.zip
15 KiB
2022-09-26 - Sacrificing Suspended Processes.7z
2.2 MiB
2022-10-18 - Changing memory protection using APC.pdf
186 KiB
2022-10-31 - Heavens Gate in CSharp.7z
12 KiB
2022-10-31 - Resolving syscalls in CSharp.7z
20 KiB
2022-11-22 - x64 return address spoofing.7z
139 KiB
2022-12-04 - SilentMoonWalk - Demonstrating call stack spoofing.zip
284 KiB
2022-12-08 - Hooking System Calls in Windows 11 22H2 like Avast Antivirus. Research, analysis and bypass.pdf
723 KiB
2023-02-07 - Demonstrating Unhooking NTDLL from Disk.7z
5.0 KiB
2023-02-07 - Demonstrating Unhooking NTDLL from KnownDlls.7z
9.0 KiB
2023-02-07 - Demonstrating Unhooking NTDLL from Remote Server.7z
6.7 KiB
2023-02-07 - Demonstrating Unhooking NTDLL from Suspended Process.7z
5.4 KiB
2023-04-17 - An in-depth look at the Golang Windows calls.pdf
1004 KiB
2023-04-25 - Demonstrating stack encryption.zip
5.0 KiB
2023-08-16 - Understanding Syscalls Direct and Indirect and Cobalt Strike Implementation.pdf
1.9 MiB
2023-10-09 - Demonstrating Sleep Obfuscation - KrakenMask.7z
54 KiB
2024-02-28 - MutationGate.7z
165 KiB