Ever wanted to make your sketchy sys calls look squeaky clean? I wrote a blog demonstrating a PoC which calls NtOpenProcess to grab a handle to lsass with an arbitrary/spoofed call stack: labs.withsecure.com/blog/spoofing-
PoC: github.com/countercept/Ca
Conversation
It is possible to achieve the same without doing suspending or VEH, just combine this to recover control flow: unknowncheats.me/forum/anti-che
very nice - will check it out. Veh was pretty painful and I wanted a better mechanism to handle the thread but ran out of time.
1
neat trick using nonvol reg. I think it might be easy to detect by looking for obvious jump gadget or more generically looking for missing call instruction before ret address
1
1
