admin/Astharot15-COMLoaderAstharot
1
0
Fork 0
mirror of https://github.com/Astharot15/COMLoaderAstharot/ synced 2026-07-13 20:52:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README with technical details

Browse Source 
Added details about hijack targets, callback, download function, payload synchronization, and COM object reliability.
This commit is contained in:
Astharot15
2026-07-12 15:31:44 +02:00
committed by GitHub
parent e69d4f4e68
commit 1dacf94474
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+4
View File
@@ -3,7 +3,11 @@
### Interesting details ### Interesting details
The hijack targets chrome and msedge; it also works in explorer, but it is likely to crash. The hijack targets chrome and msedge; it also works in explorer, but it is likely to crash.
The callback used is **LdrCallEnclave**. The callback used is **LdrCallEnclave**.
A Download function is commented out. It worked in the .exe compilation, but when compiled as a dll, it gets caught by AVs; so instead of using wininet, winhttp was used. A Download function is commented out. It worked in the .exe compilation, but when compiled as a dll, it gets caught by AVs; so instead of using wininet, winhttp was used.
The payload uses event objects for process synchronization rather than a traditional mutex. The payload uses event objects for process synchronization rather than a traditional mutex.
The COM object is very reliable; it has been working for 6 months without crashes. The COM object is very reliable; it has been working for 6 months without crashes.