Vith0r-StackSentry/THIRD_PARTY_NOTICES.md

Third-Party Notices

First off, a huge shoutout to all the projects and articles listed below. Full disclosure: I left out a ton of sources simply because I was too lazy to dig them up from my bookmarks. My bad!

StackSentry vendors small portions of third-party projects that are built into the analyzer and monitor binaries.

The sample corpus under samples/ also uses or adapts ideas from public offensive-security research projects. Those projects are credited separately below because they are part of the validation corpus, not analyzer/monitor runtime dependencies.

MinHook

• Project: https://github.com/TsudaKageyu/minhook
• Purpose: user-mode API hooking
• License: BSD 2-Clause style license
• Copyright: Copyright (C) 2009-2017 Tsuda Kageyu

The vendored MinHook source files in third_party/minhook retain their original copyright and license headers.

Hacker Disassembler Engine 64

• Project/component: HDE64, vendored as part of MinHook
• Purpose: instruction length decoding used by MinHook trampoline creation
• Copyright: Copyright (c) 2008-2009, Vyacheslav Patkov

The vendored HDE64 files in third_party/minhook/src/hde retain their original copyright headers.

Zydis

• Project: https://github.com/zyantific/zydis
• Vendored version: v4.1.1
• Purpose: x86/x64 instruction decoding for StackSentry callsite and proxy-gadget analysis
• License: MIT
• Copyright: Copyright (c) 2014-2024 Florian Bernd; Copyright (c) 2014-2024 Joel Höner

The full Zydis license is preserved at third_party/zydis/LICENSE.

krabsetw

• Project: https://github.com/microsoft/krabsetw
• Purpose: optional ETW process/thread/image-load timeline collection in /etw mode
• License: MIT
• Copyright: Copyright (c) Microsoft

The full krabsetw license is preserved at third_party/krabsetw/LICENSE.

Zycore

• Project: https://github.com/zyantific/zycore-c
• Vendored revision: dependency revision used by Zydis v4.1.1
• Purpose: support library required by Zydis
• License: MIT
• Copyright: Copyright (c) 2018-2024 Florian Bernd; Copyright (c) 2018-2024 Joel Höner

The full Zycore license is preserved at third_party/zydis/dependencies/zycore/LICENSE.

Research Credits

The /memory-audit mode is an original StackSentry implementation inspired by Forrest Orr's public Moneta research series on malicious memory artifacts:

• https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing
• https://www.forrest-orr.net/post/masking-malicious-memory-artifacts-part-ii-insights-from-moneta
• https://www.forrest-orr.net/post/masking-malicious-memory-artifacts-part-iii-bypassing-defensive-scanners

No Moneta source code is vendored in StackSentry; these links are credited as research inspiration for the artifact classes and defensive framing.

The /byoud-trace lab mode and the BYOUD_LoadNetworkDll.exe test harness are based on public BYOUD research by klezVirus. StackSentry uses that work as an adversarial test case for unwind metadata tampering; the detection and reporting code is original to StackSentry.

• https://github.com/klezVirus/BYOUD

The /shadow-stack research switch is inspired by Gabriel Landau and Elastic Security Labs' public ShadowStackWalk research. It explores the same defensive idea of comparing a classic stack walk with CET/HSP shadow-stack returns, but it is explicitly experimental and not part of /hunt until it can be validated on CET-capable hardware. StackSentry does not vendor ShadowStackWalk source into the shipped analyzer or monitor.

• Article: https://www.elastic.co/security-labs/finding-truth-in-the-shadows
• Reference project: https://github.com/gabriellandau/ShadowStackWalk

Sample Corpus / Test References

The files under samples/ are intentionally suspicious lab artifacts used to validate StackSentry behavior. Some are original small harnesses; others are inspired by, adapted from, or generated around the public projects listed here.

SilentMoonwalk

• Project: https://github.com/klezVirus/SilentMoonwalk
• Used for: synthetic/spoofed call-stack test cases, including direct and RDI-style network DLL load samples.

StackSentry uses SilentMoonwalk-style samples to validate callsite checks, origin tracing, register tracing, and stack-spoofing reporting.

BYOUD

• Project: https://github.com/klezVirus/BYOUD
• Used for: unwind metadata spoofing and BYOUD RDI payload tests.

The sample corpus uses BYOUD as an adversarial input for .pdata/.xdata/RUNTIME_FUNCTION tampering tests. StackSentry's detection and reporting logic is separate from the BYOUD project code.

Donut

• Project: https://github.com/TheWover/donut
• Used for: shellcode/RDI packaging around managed and native test payloads.

Donut-generated payloads are used to exercise realistic in-memory bootstrap behavior, including CLR/.NET loading and network-module staging.

ThreadPoolExecChain

• Project: https://github.com/klezvirus/ThreadPoolExecChain
• Used for: threadpool callback-chain proxy loading tests.

These samples help validate StackSentry's ability to preserve threadpool-chain context and attribute sensitive DLL loads that happen through callback chains.

MassDriver

• Project: https://github.com/Sizeable-Bingus/MassDriver
• Used for: cross-thread function-dispatch style tests.

MassDriver-style samples validate /dispatch-trace, especially cases where a clean worker thread performs LoadLibraryA on behalf of another requester.

LibTPLoadLib / API Proxying / RefinedPool

• LibTPLoadLib: https://github.com/AlmondOffSec/LibTPLoadLib
• API proxying article: https://0xdarkvortex.dev/hiding-in-plainsight/
• Proxy-DLL-Loads: https://github.com/paranoidninja/Proxy-DLL-Loads
• RefinedPool variant: https://github.com/Vith0r/RefinedPool/tree/main/RefinedPool

These references were used for the image .text proxy and code-cave/modified-image samples. The StackSentry samples exercise proxy DLL-load behavior, existing-module gadget use, and modified image-backed execution so the analyzer can validate BackedModified, origin-region, and .tag diff-map output.