mirror of
https://github.com/thomasxm/BOAZ_beta
synced 2026-06-06 16:54:29 +00:00
thomasxm
e38aa6d5d4
Threadless code execution primitive that utilises virtual table pointer’s inherent read and write permission and RtlUserThreadStart’s calling sequence (ntdll!kernel32ThreadInitThunkFunction (RW)). Threadless execution primitive that uses VEH to VEH hanlder sequences: PageGuard set up at arbitrary functions using: VirtualProtect(pRtlUserThreadStart, 1, PAGE_EXECUTE_READ | PAGE_GUARD, &old) (Typically targets a function frequently called by the target process.). Alternatively, change memory protection to PAGE_NOACCESS. Add encoded pointers to the Vectored Exception Handler (VEH) list at the correct offset relative to the base address of ntdll.dll in memory. This step requires temporarily modifying memory protection in .mrdata. Link the custom VEH handler into the existing doubly linked list of handlers. Set the CrossProcessFlags in TEB->PEB to 0x4 | 0x8 (The PEB can be directly modified due to its RW permissions.) VEH handler manages the STATUS_GUARD_PAGE_VIOLATION, performs required housekeeping, but does not execute shellcode directly. Manually remove VEH and VCH handlers from within the VCH handler itself, prior to shellcode execution. VCH executes the shellcode by: Redirecting the instruction pointer (RIP) or Modifying RDX when execution reaches BaseThreadInitThunk or Directly calling BaseThreadInitThunk, or Manually invoking the entry point of a loaded DLL hosting the shellcode. Added anti-forensic techniques. Added ETW patchless bypass method. Added post-execution self-deletion functions. Add target process mitigation policies. Added two new shellcode encryption and decryption: DES (SystemFunction002) and Rc4 (SystemFunction033)