mirror of
https://github.com/thomasxm/BOAZ_beta
synced 2026-06-06 16:54:29 +00:00
thomasxm
94765033d7
New features: DefWindowProcA is used as stack function as it has a long winded stack frame. use VEH and VCH to set up a hardware breakpoint on the syscall opcode when the breakpoint is hit, we emulate the syscall using the context of the thread VEH is used to do nothing and detect the HW breakpoint set up by security solutions as an anti-emulation measure. VCH is used to set up a hardware breakpoint on the syscall and ret code. VEH and VCH are removed manually by clearing the CrossProcessFlag from PEB to avoid forensic traces.