admin/Kudaes-Fiber
1
0
Fork 0
mirror of https://github.com/Kudaes/Fiber synced 2026-06-08 11:32:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
Kurosh Dabbagh Escalante
2023-06-26 10:36:09 +02:00
committed by GitHub
parent 0311ac1651
commit 1afc7a53b5
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -12,7 +12,7 @@ And this is exactly what this simple PoC does:
* First, we have a loader, which will use DInvoke to manually map the dll that contains our payload.
* After that, the loader will turn the current thread into a fiber (known from now on as the **control fiber**). The control fiber will enjoy of a "normal" stack since the loader is being run from a PE on disk.
* The loader will then create a new fiber to run the `run()` function exported by the manually mapped dll. This fiber will be known as the **payload fiber** from now on.
* The control fiber will switch to the payload fiber, which will execute whatever code the payload contains. Once the payload needs to enter on an alertable state (for example, when a call to Sleep is required), the payload fiber switches back to the control fiber, hiding its stack (which may contain several IOC os malicious activity).
* The control fiber will switch to the payload fiber, which will execute whatever code the payload contains. Once the payload needs to enter on an alertable state (for example, when a call to Sleep is required), the payload fiber switches back to the control fiber, hiding its stack (which may contain several IOC of malicious activity).
* The control fiber performs the call to Sleep. When the call returns, it will switch again to the payload fiber so it can continue its execution.
This process repeats indefinitely.