corpus.blog
42,697 blogs · 5,350,595 posts Claim your blog
Record · corpus.blog/posts/01a08c63-3a3c-7371-bd50-29e4b65f51ce

MemFuck: Bypassing User-Mode Hooks

winternl.com · published 8 September 2020

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at winternl.com Wayback capture
1blogs citing
First cited
4 Jan 2025
Most recent
4 Jan 2025
Rank this month
not ranked
External links
16
Words captured
2,842

Cited by

Blog
In the post
Date
rwxstoned.github.io
How is my Browser blocking RWX execution ? Read at the source ↗
4 Jan 2025

Links from this post

Link
Host
https://www.mdsec.co.uk/2020/08/firewalker-a-new-approach-to-generically-bypass-user-space-edr-hooking/
mdsec.co.uk
https://blog.malwarebytes.com/threat-analysis/2018/01/a-coin-miner-with-a-heavens-gate/
blog.malwarebytes.com
https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/
outflank.nl
https://github.com/rwfpl/rewolf-wow64ext
github.com
https://web.archive.org/web/20190407064851/https://blog.ensilo.com/globeimposter-ransomware-technical
web.archive.org
https://cdn2.hubspot.net/hubfs/487909/ENSILO%20WHITEPAPER%20ENTER%20THE%20DARK%20GATE.pdf
cdn2.hubspot.net
https://blog.malwarebytes.com/threat-analysis/2018/03/hancitor-fileless-attack-with-a-copy-trick/
blog.malwarebytes.com
https://gynvael.coldwind.pl/?id=93
gynvael.coldwind.pl
https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-kuser_shared_data
docs.microsoft.com
https://twitter.com/aionescu/status/677599528409677824?lang=en
twitter.com
https://twitter.com/PetrBenes
twitter.com
https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntallocatevirtualmemory
docs.microsoft.com
https://stackoverflow.com/questions/50429365/what-is-the-most-reliable-portable-way-to-allocate-memory-at-low-addresses-on
stackoverflow.com
https://github.com/jackullrich/ShellcodeStdio
github.com
https://docs.microsoft.com/en-us/windows/win32/winprog64/exception-handling-under-wow64
docs.microsoft.com
https://github.com/jackullrich/memfuck
github.com