f2f6b64c53
Update PowerShell script. Fix file path bugs and exception handling
2020-09-14 09:13:58 -06:00
4aecf99235
Update build tools versions
2020-09-14 08:41:37 -06:00
975da56ce5
Fixed ebx register use bug in 32 bit
2020-09-10 17:01:11 -06:00
f7cf7a6f7b
Download .NET loader to 3.5 (additional)
2020-09-10 16:02:16 -06:00
2fc1d05a27
Downgrade .NET loader to 3.5
2020-09-10 16:01:49 -06:00
a25c02965c
Remove InteropTools class for NET loader
2020-09-10 15:37:49 -06:00
783d530084
Migrated core function lookup to ntdll
2020-04-15 17:45:08 -06:00
1c402304d9
Added exception handling for x64
...
Updated GetProcAddressR for clarity
Added /EHa to the testdll with a divide by 0 for testing
2019-11-21 13:20:23 -07:00
564933ff78
Cleaned up TestDLL project
2019-10-14 18:43:35 -06:00
94236228b7
Fix TLS callback issue (addesses are absolute). Rebuild blobs.
2019-10-10 15:07:26 -06:00
0bc9238e4d
Update blobs
2019-10-10 14:39:33 -06:00
75b7dfef21
Move relocation above IAT handling
2019-10-10 14:24:58 -06:00
7a31739ac1
Merge pull request #16 from coldfusion39/dev
...
Add ObfuscateImport arguments to ConvertToShellcode.py
2019-10-10 10:55:49 -06:00
a82075759d
Add ObfuscateImport arguments to ConvertToShellcode.py
2019-10-05 11:59:27 -04:00
eaf2f0b8ad
Update ShellcodeRDI.py
...
Quick small fix that's done in master, just hasn't been merged
2019-09-27 16:16:50 -04:00
c1c76f0423
Add ObfuscateImports flag to ConvertTo-Shellcode
...
Update README to reflect changes
2019-09-26 17:40:44 -04:00
c5dacf714c
Add new obfuscate_imports (0x4) flag
...
Finish refactor + fixes for x86 code.
Small code cleanup.
2019-09-26 16:49:05 -04:00
d939bae226
Huge re-factor of the base RDI code
2019-09-25 22:08:23 -04:00
7e73a4285b
Fix small offset error in is64BitDll
2019-07-31 12:57:42 -06:00
b2981d5e2f
Add ROTR function hashing to DotNet code.
...
Cleaned up is64BitDll dependencies in DotNet and converted to use simple offsets.
Cleaned lots of code from ConvertTo-Shellcode.ps1
Changed the ConvertTo-Shellcode function to take a function name as a string instead of a hash
Added a fixed copy of Matt Graeber's Invoke-Shellcode.ps1 to the repo
2019-07-31 12:31:27 -06:00
d69a262a71
Add code patching so it's easy to update blobs in the future
...
Migrate EncodeBlobs.py to lib folder - might add a build step later
Removed some stale logic
2019-07-22 14:29:32 -06:00
1a0fc5050e
Move NtFlushInstructionCache above TLS callbacks
2019-06-10 10:58:49 -06:00
71128b1ba3
Updated x86 stack frame code in posh, python, and .NET
...
Added bootstrap size sanity check to python
2019-01-10 17:36:39 -07:00
f2d0638a71
Merge branch 'dev' of https://github.com/monoxgas/sRDI into dev
...
# Conflicts:
# ShellcodeRDI/ShellcodeRDI.c
2019-01-10 17:32:33 -07:00
33127c2d3d
Update Get-PEHeader
2019-01-10 17:25:07 -07:00
1ae7cf6c6b
Added TLS callbacks
...
Cleaned x86 bootstrap with proper stack frames
2019-01-10 17:25:07 -07:00
141874723d
Updated blobs in Posh script
2019-01-10 17:25:07 -07:00
59b07c5c7d
Updated blobs
...
Remove code causing memset link
2019-01-10 17:25:06 -07:00
4d636bafa9
Add flags arg to function test
2019-01-10 17:25:06 -07:00
3ab9c81657
Add allocation for zero size sections
...
Clean some warnings
2019-01-10 17:25:06 -07:00
9de4ca7c60
Add allocation at preferred base address (Beacon short fix)
...
Added flag to clear memory after load (experimental)
2019-01-10 17:25:06 -07:00
9114664f6f
Powershell Speed Improvements
...
Modified files read and buffer copies to improve speed quite a bit
2018-07-26 19:19:37 -06:00
1c3c67dc97
Updated blobs in Posh script
2018-05-27 21:04:13 -06:00
8c9d5dc888
Updated blobs
...
Remove code causing memset link
2018-05-27 20:56:20 -06:00
fc67ccde43
Add flags arg to function test
2018-05-27 20:27:34 -06:00
53d0d9164b
Add allocation for zero size sections
...
Clean some warnings
2018-05-27 20:25:27 -06:00
57b3c7a352
Add allocation at preferred base address (Beacon short fix)
...
Added flag to clear memory after load (experimental)
2018-05-27 20:14:14 -06:00
ddb53bffc2
Remove pefile library dependency
2018-03-12 12:56:29 -06:00
1e4aa799fb
Remove some trailing semi-colons in python
2018-02-24 18:15:29 -07:00
27d34d7225
Update ReadMe
2018-02-21 17:03:04 -07:00
b6ba50888f
Added 5th argument for arbitrary flags to RDI
...
Moved the clear header capability to the flags arg
Moved stack alignment from the C project to the bootstrap
Updated Python and Powershell conversion scripts (missed this last time)
2018-02-21 16:57:52 -07:00
04e0e038d7
Added user data use for SayHello function
2018-02-21 16:53:59 -07:00
27f144d7c2
Updated solution/project relationships
...
Seperated DotNet project into x64 and x86
Remove post-build copy for debug on TestDLL
2018-02-21 16:53:15 -07:00
59202ba08c
Change sRDI blob to bytes from string
2018-02-11 17:29:04 -07:00
cc501b0553
Update ReadMe
2018-02-10 21:30:47 -08:00
bc72139f97
Remove uneeded typedefs
...
Linked up previously unused hash defines for function names
Added some sanity checks against the image (Memory Module)
Added page size alignment (Memory Module)
Updated memory allocations to set proper permissions instead of total RWX
Set the sRDI function to clear the majority of the DOS Header and Stub on load
2018-02-10 21:20:06 -08:00
8e49dd5b29
Added script for encoding sRDI blobs for embedding into other code
2018-02-10 21:17:04 -08:00
eff333353e
Add program for testing sRDI/ExecutePayload function
2018-02-10 21:15:40 -08:00
fa4e7d5512
Fixed mismatched project/solution build platforms
2018-02-10 21:14:52 -08:00
ca9b88bcb3
Update Readme title
2017-10-27 00:24:18 -06:00
Nick Landers