Mirrors_Framework/shellcode_loader_bypass
1
0
Fork 0
mirror of https://github.com/Answerr/shellcode_loader_bypass.git synced 2026-02-05 16:19:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
秋裤小清新
2025-01-20 17:33:07 +08:00
committed by GitHub
parent 16f8989e97
commit 0db19b4bf9
1 changed files with 49 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

97
README.md
View File

@@ -1,63 +1,66 @@
**Shellcode Loader Bypass Techniques**
This repository contains examples of advanced Shellcode Loader bypass techniques implemented in test.cpp and bypass1.cpp. These techniques are designed to evade detection and bypass modern security mechanisms such as EDR (Endpoint Detection and Response) and AV (Antivirus) solutions.
Note: Using binary files smaller than 100kb tends to be more stable due to memory allocation limits imposed by thread pool execution; otherwise, you may need to sacrifice stealth.
# Shellcode Loader Bypass Techniques
**Techniques in test.cpp**
The following bypass techniques are implemented in test.cpp:
This repository contains examples of advanced Shellcode Loader bypass techniques implemented in `test.cpp` and `bypass1.cpp`. These techniques are designed to evade detection and bypass modern security mechanisms such as EDR (Endpoint Detection and Response) and AV (Antivirus) solutions.
API Resolution and Dynamic Invocation
Dynamically resolve and call APIs at runtime to avoid static detection.
**Note:** Using binary files smaller than 100kb tends to be more stable due to memory allocation limits imposed by thread pool execution; otherwise, you may need to sacrifice stealth.
API Hammering
Repeatedly call benign APIs to obfuscate behavior-based detection mechanisms.
## Techniques in `test.cpp`
String Obfuscation and Decryption
Obfuscate sensitive strings (such as API names and Shellcode) and decrypt them at runtime to evade static analysis.
The following bypass techniques are implemented in `test.cpp`:
NTDLL Recovery and Unhooking
Restore the original, unhooked ntdll.dll to bypass user-mode hooks placed by EDR.
1. **API Resolution and Dynamic Invocation**
Dynamically resolve and call APIs at runtime to avoid static detection.
Thread Pool Execution of Shellcode
Use a thread pool to execute Shellcode, mimicking legitimate application behavior.
2. **API Hammering**
Repeatedly call benign APIs to obfuscate behavior-based detection mechanisms.
Remote Thread Injection
Inject Shellcode into a remote process to execute the payload stealthily.
3. **String Obfuscation and Decryption**
Obfuscate sensitive strings (such as API names and Shellcode) and decrypt them at runtime to evade static analysis.
Encrypted Shellcode File Loading (shellcode.bin)
Load and decrypt an encrypted Shellcode file (shellcode.bin) at runtime to avoid detection.
4. **NTDLL Recovery and Unhooking**
Restore the original, unhooked `ntdll.dll` to bypass user-mode hooks placed by EDR.
Techniques in bypass1.cpp
The following bypass techniques are implemented in bypass1.cpp:
5. **Thread Pool Execution of Shellcode**
Use a thread pool to execute Shellcode, mimicking legitimate application behavior.
API Hash Resolution Function
Use hashed names instead of plaintext strings to resolve API functions, circumventing static analysis.
6. **Remote Thread Injection**
Inject Shellcode into a remote process to execute the payload stealthily.
API Hammering
Similar to test.cpp, repeatedly call benign APIs to obfuscate behavior-based detection mechanisms.
7. **Encrypted Shellcode File Loading (`shellcode.bin`)**
Load and decrypt an encrypted Shellcode file (`shellcode.bin`) at runtime to avoid detection.
Dynamic API Resolution
Dynamically resolve API functions at runtime to avoid static detection.
## Techniques in `bypass1.cpp`
Unhooking ntdll.dll
Restore the original, unhooked ntdll.dll to bypass user-mode hooks.
The following bypass techniques are implemented in `bypass1.cpp`:
Encrypted Shellcode File Loading (shellcode.bin)
Load and decrypt an encrypted Shellcode file (shellcode.bin) at runtime to avoid detection.
1. **API Hash Resolution Function**
Use hashed names instead of plaintext strings to resolve API functions, circumventing static analysis.
Thread Pool Execution
Use a thread pool to execute Shellcode, mimicking legitimate application behavior.
2. **API Hammering**
Similar to `test.cpp`, repeatedly call benign APIs to obfuscate behavior-based detection mechanisms.
Stealthy Memory Allocation
Allocate memory for Shellcode in a stealthy manner to avoid triggering detection caused by suspicious patterns.
3. **Dynamic API Resolution**
Dynamically resolve API functions at runtime to avoid static detection.
Usage Instructions
Use your preferred method to generate a .bin file of the raw Shellcode.
4. **Unhooking `ntdll.dll`**
Restore the original, unhooked `ntdll.dll` to bypass user-mode hooks.
Rename the file to input.bin and run xor.py. This will generate an encrypted file named output.bin.
5. **Encrypted Shellcode File Loading (`shellcode.bin`)**
Load and decrypt an encrypted Shellcode file (`shellcode.bin`) at runtime to avoid detection.
Rename output.bin to shellcode.bin and place it in the same directory as the executable.
6. **Thread Pool Execution**
Use a thread pool to execute Shellcode, mimicking legitimate application behavior.
7. **Stealthy Memory Allocation**
Allocate memory for Shellcode in a stealthy manner to avoid triggering detection caused by suspicious patterns.
## Usage Instructions
1. Use your preferred method to generate a `.bin` file of the raw Shellcode.
2. Rename the file to `input.bin` and run `xor.py`. This will generate an encrypted file named `output.bin`.
3. Rename `output.bin` to `shellcode.bin` and place it in the same directory as the executable.
4. Execute the payload.
Execute the payload.
Shellcode Loader Bypass Screenshots
@@ -73,14 +76,12 @@ Shellcode Loader Bypass Screenshots
### 4. Tencent Bypass
![Tencent Bypass](https://github.com/Answerr/shellcode_loader_bypass/blob/main/images/tencent_bypass1.png)
Summary
test.cpp: Can bypass Tencent, Huorong, and Defender, but fails to bypass 360 due to the addition of remote injection targeting RuntimeBroker.exe.
# Summary
bypass1.cpp: Can bypass Tencent, Huorong, and 360, but fails to bypass Defender.
- **`test.cpp`:** Can bypass Tencent, Huorong, and Defender, but fails to bypass 360 due to the addition of remote injection targeting `RuntimeBroker.exe`.
- **`bypass1.cpp`:** Can bypass Tencent, Huorong, and 360, but fails to bypass Defender.
## Disclaimer
Disclaimer:
This repository is for educational and research purposes only. The techniques demonstrated here should not be used for malicious purposes. Always ensure compliance with applicable laws and regulations.
> **Disclaimer:**
> This repository is for educational and research purposes only. The techniques demonstrated here should not be used for malicious purposes. Always ensure compliance with applicable laws and regulations.
---