From 4660e098e29b412e9cd9a9c54bf31e9c97c848d4 Mon Sep 17 00:00:00 2001
From: thefLink <sebfeldm@gmail.com>
Date: Wed, 25 May 2022 00:16:55 +0200
Subject: [PATCH] Create README.md

---
 README.md | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 README.md

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..e224a33
--- /dev/null
+++ b/README.md
@@ -0,0 +1,48 @@
+# DeepSleep
+
+A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC.          
+
+Huge thanks to [@waldoirc](https://twitter.com/waldoirc) for documenting large parts of it on his [blog](https://www.arashparsa.com/bypassing-pesieve-and-moneta-the-easiest-way-i-could-find/)          
+This implementation is different in that it does not make use of any APCs and is fully implemented as PIC.
+
+## Description
+
+I have created this to better understand how to evade memory artifacts using a [Gargoyle](https://github.com/JLospinoso/gargoyle) like technique on x64.
+The idea is to set up a ROPChain calling VirtualProtect() -> Sleep() -> VirtualProtect() to mark my own page as **N/A** while Sleeping.  
+
+Unlike Gargoyle and other Gargoyle-like implementations, I fully rely on ROP and do not queue any APC.
+DeepSleep itself is implemented as fully PIC, which makes it easier to enumerate which memory pages have to be hidden from scanners.
+
+While the thread is active, a MessageBox pops up and DeepSleep's page is marked as executable. While Sleeping, the page is marked as **N/A**.
+
+This effectively bypasses [Moneta](https://github.com/forrest-orr/moneta) at the time of writing if DeepSleep is injected and the executing thread's base address 
+does not point to private commited memory. 
+
+I have verified this using the [Earlybird](https://www.ired.team/offensive-security/code-injection-process-injection/early-bird-apc-queue-code-injection)
+injection technique to inject DeepSleep.bin into notepad.exe
+
+![Moneta finding DeepSleep while showing msgbox](/Screens/MonetaFound.png?raw=true "Moneta finding DeepSleep while showing msgbox")
+![Moneta not finding DeepSleep while showing msgbox](/Screens/MonetaNotFound.png?raw=true "Moneta not finding DeepSleep while showing msgbox")
+
+## Usage
+Using Mingw:     
+Type ```make``` and a wild DeepSleep.bin appears.     
+Alternatively use the precompiled DeepSleep.bin :-)
+
+## Future Work
+
+I might release a loader for CS or other C2 agents. Similarly to [YouMayPasser](https://github.com/waldo-irc/YouMayPasser), the loader would hook sleep using HW breakpoints
+to avoid suspicious modifications of kernel32.dll.       
+
+## Detection
+
+The callstack to a thread in the ```DelayExecution``` state includes unknown/tampered memory regions and additionally includes addresses to VirtualProtect()      
+It may be possible to apply that metric to other C2 using a different technique to Sleep.
+
+![Weird Stack](/Screens/WeirdTrace.png?raw=true "Weird Trace")
+
+## Credits
+
+[@waldoirc](https://twitter.com/waldoirc) for documenting large parts the technique [here](https://www.arashparsa.com/bypassing-pesieve-and-moneta-the-easiest-way-i-could-find/)               
+[@forrest Orr](https://twitter.com/_forrestorr) [Moneta](https://github.com/forrest-orr/moneta)                
+[Josh Lospinoso](https://github.com/JLospinoso/) for the original [Gargoyle technique](https://github.com/JLospinoso/gargoyle)