search

BishopFox / sliver

Adversary Emulation Framework
GNU General Public License v3.0
8.26k stars 1.09k forks source link

refresh dll using direct syscall #352

Open timwhitez opened 3 years ago

timwhitez commented 3 years ago

https://github.com/timwhitez/Doge-Unhook/blob/main/FullDllunhook/unhook.go

moloch-- commented 3 years ago

This is already implemented and controlled via the evasion setting:

https://github.com/BishopFox/sliver/blob/master/implant/sliver/taskrunner/task_windows.go#L287

moloch-- commented 3 years ago

Ahh you're using direct syscalls, we can probably add that.

timwhitez commented 3 years ago

:) you guys have done a good job! i have learn a lot from this project.