mirror of
https://github.com/thomasxm/amber
synced 2026-06-08 17:46:04 +00:00
Ege Balcı
fae3275b68
- Major loader update! - Added TLS callback support - Added forwarded imports support - Removed GetProcAddress and LoadLibrary WinAPI usage - Switched to NTDLL WinApi functions - Wiper code improved - Added lite loader option for appending PE files on the fly! - Added experimental raw syscall loader - Added static build flags in makefile - File name bug fixed - Dockerfile updated - Github workflows added - README updated
1020 B
1020 B
Amber Loader v3.0
Amber Loader is a reflective PE loader designed for manually loading (mapping, relocating, and resolving) and executing PE files from memory. It is written fully in assembly using the NASM syntax. The loader supports both 32- and 64-bit PE files with TLS callbacks and forwarded imports.
The lite version of the amber loader can be directly appended in front of a PE file for converting the file into a shellcode.
Example: Converting putty.exe into shellcode
wget https://github.com/EgeBalci/amber/raw/master/loader/loader-x64/amber_loader-x64-lite.bin -O shellcode
cat putty.exe >> shellcode && xxd -i shellcode
(!! lite version do not wipe itself from the memory !!)