Update README.md

2026-06-21 14:11:21 +00:00 · 2025-08-29 02:44:03 +02:00
parent c8801b264d
commit 20668e8a32
1 changed files with 42 additions and 1 deletions
@@ -1,2 +1,43 @@
+
 # KittyLoader
-KittyLoader is a highly evasive loader written in C / Assembly
+### About
+KittyLoader is a highly evasive loader written in C / Assembly.
+
+### Features
+- Hijacks early execution by replacing the C runtime entrypoint (__scrt_common_main_seh) with custom assembly.
+  
+- Hides all modules by walking PEB->Ldr lists and unlinking its module entry (LDR_DATA_TABLE_ENTRY) from :
+    - InLoadOrderModuleList
+    - InInitializationOrderModuleList
+    - InMemoryOrderModuleList
+      
+- Deploys a wide variety of anti-analysis techniques, including :
+    - Debugger Detection :
+          - IsDebuggerPresent, CheckRemoteDebuggerPresent, PEB flags, hardware breakpoints, timing checks (RDTSC + Sleep)
+    - Sandbox Detection :
+          - Heuristic evaluation of sandbox probability from > GetSystemInfo, GlobalMemoryStatusEx, GetDiskFreeSpaceEx, GetTickCount
+    - Self-Integrity checks by continously calculating checksum of its own code section to detect tampering.
+    - Delayed Execution :
+          - Sleeps for 30–40 seconds plus jitter based on PID and system tick count.
+
+- API Resolution via Export Hashing :
+    - Avoids static imports by resolving function addresses at runtime.
+    - Walks IMAGE_EXPORT_DIRECTORY and applies custom xor rotate hash algo.
+      
+- Embedded payload is encrypted at rest, with key and nonce derived at runtime from entropy sources: PID, TID, QPC, memory load, CPU info (CPUID), tick count.
+- Preferred algo is ChaCha20, but in case of failure falls back to RC4, decryption occurs in place after the encrypted blob is copied into memory.
+
+- Searches process memory via VirtualQuery for an already-executable region large enough for the shellcode.
+    - If none found, allocates new RW region with NtAllocateVirtualMemoryEx
+    - After decryption, if memory was RW, flips to RX with NtProtectVirtualMemory.
+    - Therefore, we intend to initially inject into pre-existing RWX memory page, but in case of failure, resort to custom resolved NtAllocateVirtualMemoryEx and flip RW-RX
+
+- Execute via LdrCallEnclave, normally intended for SGX/VBS enclaves. 
+
+![Preview](https://pbs.twimg.com/media/FHe1LP-X0AoPxav?format=png&name=medium)
+
+### Credits:
+- [@NinjaParanoid](https://twitter.com/NinjaParanoid): [PE Reflection: The King is Dead, Long Live the King](https://bruteratel.com/research/feature-update/2021/06/01/PE-Reflection-Long-Live-The-King/)
+- [@0xBoku](https://twitter.com/0xBoku): [User Defined Cobalt Strike Loader](https://github.com/boku7/CobaltStrikeReflectiveLoader)
+- [@ilove2pwn_](https://twitter.com/ilove2pwn_): [TitanLdr](https://github.com/SecIdiot/TitanLdr)
+- [trickster0](https://twitter.com/trickster012) [TartarusGate](https://github.com/trickster0/TartarusGate/) direct syscall method