I'm giving a remote presentation to the BSD masochistsWusers in New York City in an hour about weird code injection techniques on #FreeBSD
https://www.nycbug.org/media/March2026NYCBUG_Notice_of_Meeting.pdf
Jitsi meeting link: https://jitsi.sdf.org/NYCBUG-2026-03-04_01
YouTube stream: https://www.youtube.com/watch?v=QfGdMrmy0jw
New here 👋🏻. Looking forward to connect with other malware developing/red teaming enthusiasts, as well as with nice interesting people in general. Still trying to get the hang out of Mastodon, sorry if it shows 😂
#Introductions #pleaseboost #maldev #redteam #infosec #malware
New here 👋🏻. Looking forward to connect with other malware developing/red teaming enthusiasts, as well as with nice interesting people in general. Still trying to get the hang out of Mastodon, sorry if it shows 😂
#Introductions #pleaseboost #maldev #redteam #infosec #malware
HInvoke and avoiding PInvoke | drakonia’s blog
On my research list [Wayback/Archive] HInvoke and avoiding PInvoke | drakonia’s blog.
A very minimalistic approach of calling .net runtime functions or accessing properties using only hashes as identifiers. It does not leave any strings or import references since we dynamically resolve the required member from the mscorlib assembly on runtime.
The underlying code is at [Wayback/Archive] S4ntiagoP/donut: Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters.
It is being used by [Wayback/Archive] Convert binary to a shellcode with donut and create a C# self injector from it via a combo of “Dynamic P/Invoke + H/Invoke” calls
Related are:
Via:
Geekland
Shawn Webb
raptor
Jules
Jules
The Wiert Corner - irregular stream of stuffgithub.com/daem0nc0re/TangledWinExec #Pentesting #CyberSecurity”–jeroen
#CyberSecurity #dinvoke #hinvoke #infosec #maldev #pentest #Pentesting #redteam
A very minimalistic approach of calling .net runtime functions or accessing properties using only hashes as identifiers. It does not leave any strings or import references since we dynamically resolve the required member from the mscorlib assembly on runtime.