search

klezVirus / inceptor

Template-Driven AV/EDR Evasion Framework
Other
1.6k stars 263 forks source link

Dinvoke Syscall #8

Closed Mantraufo closed 3 years ago

Mantraufo commented 3 years ago

python inceptor.py dotnet -t donut client.exe -o kiwi.exe --sgn --sign --delay 120 -m syscalls

[-] SyscallsModule requires -m dinvoke!

python inceptor.py dotnet -t donut client.exe -o kiwi.exe --sgn --sign --delay 120 -m syscalls -m dinvoke

[-] No template found with given criteria

klezVirus commented 3 years ago

Hi Mantraufo, thanks for reaching out. This is expected, we don't have a syscalls template for self-execution (please feel free to submit one if you think it can be useful for the community ;)! ). If you add (-P|--pinject), Inceptor will locate the right template. Closing this for now. Feel free to reopen if anything is not working as expected.