search

optiv / ScareCrow

ScareCrow - Payload creation framework designed around EDR bypass.
2.71k stars 503 forks source link

Memory Protection (Feature Request) #31

Open Simon-Davies opened 2 years ago

Simon-Davies commented 2 years ago

Are you aware of the below?

https://github.com/mgeeky/ShellcodeFluctuation

It would be worth implementing into ScareCrow

Tylous commented 2 years ago

I will take a look at implementing this. Thank you

Simon-Davies commented 2 years ago

Also worth checking out:

https://github.com/mgeeky/ThreadStackSpoofer

Tylous commented 1 year ago

After looking into this in-depth I belive this is a limitation of GO, in the sense of finding and mapping the address of GO functions in memory.