975da56ce5
Fixed ebx register use bug in 32 bit
2020-09-10 17:01:11 -06:00
783d530084
Migrated core function lookup to ntdll
2020-04-15 17:45:08 -06:00
1c402304d9
Added exception handling for x64
...
Updated GetProcAddressR for clarity
Added /EHa to the testdll with a divide by 0 for testing
2019-11-21 13:20:23 -07:00
94236228b7
Fix TLS callback issue (addesses are absolute). Rebuild blobs.
2019-10-10 15:07:26 -06:00
0bc9238e4d
Update blobs
2019-10-10 14:39:33 -06:00
c1c76f0423
Add ObfuscateImports flag to ConvertTo-Shellcode
...
Update README to reflect changes
2019-09-26 17:40:44 -04:00
c5dacf714c
Add new obfuscate_imports (0x4) flag
...
Finish refactor + fixes for x86 code.
Small code cleanup.
2019-09-26 16:49:05 -04:00
d939bae226
Huge re-factor of the base RDI code
2019-09-25 22:08:23 -04:00
7e73a4285b
Fix small offset error in is64BitDll
2019-07-31 12:57:42 -06:00
b2981d5e2f
Add ROTR function hashing to DotNet code.
...
Cleaned up is64BitDll dependencies in DotNet and converted to use simple offsets.
Cleaned lots of code from ConvertTo-Shellcode.ps1
Changed the ConvertTo-Shellcode function to take a function name as a string instead of a hash
Added a fixed copy of Matt Graeber's Invoke-Shellcode.ps1 to the repo
2019-07-31 12:31:27 -06:00
d69a262a71
Add code patching so it's easy to update blobs in the future
...
Migrate EncodeBlobs.py to lib folder - might add a build step later
Removed some stale logic
2019-07-22 14:29:32 -06:00
71128b1ba3
Updated x86 stack frame code in posh, python, and .NET
...
Added bootstrap size sanity check to python
2019-01-10 17:36:39 -07:00
141874723d
Updated blobs in Posh script
2019-01-10 17:25:07 -07:00
9114664f6f
Powershell Speed Improvements
...
Modified files read and buffer copies to improve speed quite a bit
2018-07-26 19:19:37 -06:00
b6ba50888f
Added 5th argument for arbitrary flags to RDI
...
Moved the clear header capability to the flags arg
Moved stack alignment from the C project to the bootstrap
Updated Python and Powershell conversion scripts (missed this last time)
2018-02-21 16:57:52 -07:00
40330af165
Fixed oversized function hash constants
2017-10-27 00:19:15 -06:00
ab6b57841d
Remove WriteLine in PowerShell
2017-08-01 16:41:11 -06:00
eb0382a347
Seperated python into library and script
...
Added powershell implementation
Updated ReadMe
2017-07-29 15:54:51 -06:00
Nick Landers