b2cc8e2b95
Fix #7569 , Fix warbird check for missing text section
...
Fix #7569
2016-11-21 14:57:01 -06:00
ec7a07e0bb
Move DLL prefix calculation to its own method
2015-08-24 14:05:24 -05:00
3c90ae1ebd
Use mov instead of lea for 64-bit absolute addrs
2015-08-24 13:51:54 -05:00
21c349494f
Fix default buffer_register for x64
2015-08-19 19:01:35 -05:00
d71467f9e7
Allow x64 registers for buffer_register
2015-08-19 17:06:29 -05:00
bf39f53066
Add proper CreateThread stub for x64
2015-08-19 16:16:58 -05:00
2b0f6e723d
Explain the byte sequence
2015-07-03 11:12:59 -05:00
5c582b76ca
Resolves #4380 , check for warbird template
...
Resolves #4380 . Adds a check for warbird (license verification)
windows template. For reference please see:
http://thisissecurity.net/2014/10/15/warbird-operation/
2015-07-03 02:38:52 -05:00
0a4a72f49d
Support templates with small text sections (win32)
2015-03-29 01:51:58 -05:00
b9b40edde9
Major speedup, especially for large shellcode (stageless)
2015-03-29 00:44:06 -05:00
5e123e024d
Add 'coding: binary' to all msf/rex library files
...
This fixes a huge number of hard-to-detect runtime bugs
that occur when a default utf-8 string from one of these
libraries is passed into a method expecting ascii-8bit
2014-08-17 17:31:53 -05:00
77e9996501
Mitigate metasm relocation error by disabling ASLR
...
Deal with import error by actually using the GetProcAddress code.
2013-12-07 20:54:13 -06:00
8d33138489
Support silent shellcode injection into DLLs
...
Only run code on DLL_PROCESS_ATTACH, preventing infinite loop otherwise:
Added code would create thread -> calls DLL entry point -> calling added code...
2013-12-07 19:44:17 -06:00
d6e4e46d86
better validation of buffer register
2013-09-09 12:16:15 -05:00
5a424ab4df
Allow user supplied buffer register
...
let the user pick, otherwise default to edx
2013-08-26 13:15:12 -05:00
383c9ed7f8
set edx as a BufferRegister
...
polymorphic encoders can now always use EDX
as a BufferRegister, making it harder to catch
the decoder stub.
2013-08-25 14:18:32 -05:00
f5e9089dd5
remove dupe comment
2013-08-25 12:46:47 -05:00
a50fa2deec
style fixups
2013-08-25 12:37:30 -05:00
8f47aa6dcb
Basic Injector class
...
create a class for injecting payloads
into an exe template as a new section
2013-08-24 16:11:00 -05:00
wchen-r7
James Lee
HD Moore
scriptjunkie
David Maloney