Record · corpus.blog/posts/01a08796-34ba-7152-bb84-2ca6fc740483

SilentMoonwalk: Implementing a dynamic Call Stack Spoofer

klezvirus.github.io · published 8 December 2022

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at klezvirus.github.io Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 28
Words captured: 3,303

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://twitter.com/waldo-irc

twitter.com

https://twitter.com/trickster012

twitter.com

https://twitter.com/klezVirus

twitter.com

https://twitter.com/namazso

twitter.com

https://twitter.com/rad9800

twitter.com

https://fool.ish.wtf/2022/11/detecting-indirect-syscalls.html

fool.ish.wtf

https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html

unknowncheats.me

https://github.com/waldo-irc/YouMayPasser

github.com

https://www.arashparsa.com/bypassing-pesieve-and-moneta-the-easiest-way-i-could-find/

arashparsa.com

https://github.com/hasherezade/pe-sieve

github.com

https://twitter.com/hasherezade

twitter.com

https://github.com/forrest-orr/moneta

github.com

https://twitter.com/_ForrestOrr

twitter.com

https://twitter.com/joehowwolf

twitter.com

https://codemachine.com/articles/x64_deep_dive.html

codemachine.com

https://twitter.com/namazso/status/1442314742488567808

twitter.com

https://twitter.com/_Kudaes_/status/1594753842310434816

twitter.com

https://github.com/WithSecureLabs/CallStackSpoofer

github.com

https://labs.withsecure.com/publications/spoofing-call-stacks-to-confuse-edrs

labs.withsecure.com

https://github.com/Kudaes/Unwinder

github.com

https://twitter.com/_kudaes_

twitter.com

https://klezvirus.github.io/imgs/blog/006Spoofing/win64_stack_frame.png

klezvirus.github.io

https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/windows-x64-calling-convention-stack-frame

ired.team

https://learn.microsoft.com/en-us/cpp/build/prolog-and-epilog?view=msvc-170

learn.microsoft.com

https://klezvirus.github.io/imgs/blog/006Spoofing/runtime_exception_table.png

klezvirus.github.io

https://learn.microsoft.com/en-us/cpp/build/exception-handling-x64?view=msvc-170

learn.microsoft.com

https://klezvirus.github.io/imgs/blog/006Spoofing/stack_spoof_high_level_workflow.png

klezvirus.github.io

https://github.com/klezVirus/SilentMoonwalk

github.com