From b3a80a3330f9970190d252a67ed85860ee569947 Mon Sep 17 00:00:00 2001 From: William Knowles Date: Wed, 8 Jan 2020 07:05:48 +0000 Subject: [PATCH] Update and rename README.md to Update readme --- README.md => Update readme | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename README.md => Update readme (84%) diff --git a/README.md b/Update readme similarity index 84% rename from README.md rename to Update readme index 7b134f3..7983a22 100644 --- a/README.md +++ b/Update readme @@ -2,10 +2,10 @@ Tools to support code coverage based module stomping. Based on the blog post: http://williamknowles.io/?p=14 -parse-drcov-identify-untouched.py - analyses DynamoRIO's drcov output. Run the script as follows, with the argument being the drcov output file. +parse-drcov-identify-untouched.py - analyses DynamoRIO's drcov output. Run the script as follows, with the argument being the drcov output file. It's Python3 with the only non-standard dependency being PrettyTable. ``` -parse-drcov-identify-untouched.py drcov.mspaint.exe.11520.0000.proc-win10-beacon.log +python3 parse-drcov-identify-untouched.py drcov.mspaint.exe.11520.0000.proc-win10-beacon.log ``` CodeCoverageModuleStomping - a simple C++ project for testing injecting into the memory regions of an already loaded module (DLL) at a particular offset. Shellcode should be included in the only header file of the project. It's designed for testing on Windows 10 and sets up call targets for Control Flow Guard (CFG); if you want to run this on older operating systems you'll probably need to comment this section of code out. Run the compiled binary as follows: