mirror of
https://github.com/TREXNEGRO/Research
synced 2026-06-21 13:45:57 +00:00
SixSixSix
c976b9f152
Companion artifact for https://trexnegro.github.io/posts/patchless-amsi-bypass-hwbp/ Ships the validated subset of the technique covered in the post: - BP_AMSI_HWBP : DR0 + VEH on amsi!AmsiScanBuffer - BP_ETW_PATCH : DR1 + VEH on ntdll!EtwEventWrite ~500 lines of C across six files. Cross-compiles from Linux via mingw-w64 (build.sh) into a self-test exe that calls AmsiScanBuffer on the standard AMSI test string and asserts AMSI_RESULT_CLEAN. Excluded from this entry (will land as separate entries once empirically validated against current EDR products in lab): - ntdll selective refresh from \KnownDlls - Indirect syscalls (Hells/Halos/Tartarus gate) OPSEC: author strings and engagement-specific notes scrubbed before publication. MIT-licensed (see root LICENSE).
36 lines
809 B
Bash
36 lines
809 B
Bash
#!/usr/bin/env bash
|
|
# Cross-compile the patchless AMSI / ETW HW BP test binary from Linux to
|
|
# Windows x64 via mingw-w64.
|
|
#
|
|
# Output: bin/patchless-amsi-test.exe
|
|
#
|
|
# Authorised testing only.
|
|
|
|
set -e
|
|
cd "$(dirname "$0")"
|
|
|
|
CC="${CC:-x86_64-w64-mingw32-gcc}"
|
|
mkdir -p bin
|
|
|
|
CFLAGS="-Wall -Wextra -Wno-unused-parameter -O2 -DNDEBUG \
|
|
-Iinclude -Isrc \
|
|
-fno-stack-protector \
|
|
-static-libgcc"
|
|
LDFLAGS="-lkernel32 -luser32 -lpsapi"
|
|
|
|
SRCS=(
|
|
src/helpers.c
|
|
src/veh_manager.c
|
|
src/amsi_hwbp.c
|
|
src/etw_hwbp.c
|
|
src/bypass_main.c
|
|
tests/test_minimal.c
|
|
)
|
|
|
|
echo "[*] Compiling with $CC ..."
|
|
"$CC" $CFLAGS "${SRCS[@]}" $LDFLAGS -o bin/patchless-amsi-test.exe
|
|
echo "[+] Built: bin/patchless-amsi-test.exe"
|
|
|
|
ls -l bin/patchless-amsi-test.exe
|
|
file bin/patchless-amsi-test.exe || true
|