Vectored Exception Handling² en Rust: cuando las excepciones se convierten en flujo de control

En Windows, las excepciones suelen entenderse como un mecanismo defensivo: algo salió mal, el sistema interrumpe la ejecución y, con suerte,...

MalDev Myths

HInvoke and avoiding PInvoke

A very minimalistic approach of calling .net runtime functions or accessing properties using only hashes as identifiers. It does not leave any strings or import references since we dynamically resolve the required member from the mscorlib assembly on runtime.

Writing Migratory Payloads

Hi. I’m procrastinating again, but this time it’s related to the project I’m procrastinating. And according to a well respected hacker, this is a functional way to be productive. So you, the reader, benefit from everything. Besides, the deadline for the Phrack CFP isn’t for another few months, so I’ve got time. (Famous last words.) First of all, what the hell do I mean by migratory payload? That’s not a term in MITRE ATT&CK! In more technical terms, when I say “migratory payload,” I am referring to executables that can otherwise occupy the space of another executable after existing and operating in another state. Think of an executable that runs away from your mouse and injects itself into explorer.exe after you double-click it. It relies ultimately on process injection, which is a slightly different but similar technique to DLL injection. MITRE can be fun to rag on but they host a useful technical compendium.

GitHub - Whitecat18/Rust-for-Malware-Development: This repository contains complete resources and coding practices for malware development using Rust 🦀.

This repository contains complete resources and coding practices for malware development using Rust 🦀. - GitHub - Whitecat18/Rust-for-Malware-Development: This repository contains complete resourc...