admin/zimnyaa-PhaseDive
1
0
Fork 0
mirror of https://github.com/zimnyaa/PhaseDive synced 2026-06-08 18:36:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' of https://github.com/zimnyaa/Ekko

Browse Source
This commit is contained in:
zimnyaa
2022-10-13 19:14:16 +03:00
parent 36c9f0aa2f 47b447710c
commit 34930db928
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -3,7 +3,7 @@
<br>
PhaseDive (Ekko fork)
</h1>
better explained at https://tishina.in/execution/phase-dive-sleep-obfuscation
This is a PoC for a change to Ekko to use trampoline calls to ZwContinue and a `jmp rax` gadget to call functions from the `CONTEXT` struct. The `ntdll.dll` gadget is static, you need to find your own `call <ntdll.ZwContinue>` to test this<br>