7 Commits

Author	SHA1	Message	Date
loland	e646802bbd	-scan flag fixes ... LoadLibraryA("clr.dll") does not work. Load clr.dll via startCLR() instead	2025-12-10 22:54:24 +08:00
loland	400f763a0b	AMSI patching ... Novel technique that patches the g_amsiContext and AmsiScanBuffer global variables. It is not extensively tested. Use with care.	2025-12-10 12:04:11 +08:00
loland	1780e0ac41	Subscriber Bit Patching signature update ... Updated the signature to be compatible with older versions of clr.dll. Integrated into the BOF	2025-12-04 22:49:18 +08:00
loland	452d40dc56	Verbose logging fixes	2025-12-03 14:22:15 +08:00
loland	ccd89f8ea7	Subscriber Bit Patching integration ... Integration of the Subscriber Bit Patching technique into the BOF. Also properly unloads the sacrificial AppDomain before termination.	2025-12-03 13:11:28 +08:00
loland	b1f74b3a81	fixed crash ... fixed a strange crash that occurs when using a more comprehensive capture. logman create trace "DotNetFullTrace" -p "{e13c0d23-ccbc-4e12-931b-d9cc2eee27e4}" 0xFFFFFFFFFFFFFFFF 5 -o "C:\Users\root\Desktop\full_trace.etl" -ets	2025-12-01 01:57:25 +08:00
loland	5ba772f900	Initial commit	2025-11-29 16:37:28 +08:00