Pinned Repositories
dearg-thread-ipc-stealth
A novel technique to communicate between threads using the standard ETHREAD structure
delete-self-poc
A way to delete a locked file, or current running executable, on disk.
elf-strings
elf-strings will programmatically read an ELF binary's string sections within a given binary. This is meant to be much like the strings UNIX utility, however is purpose built for ELF binaries.
go-malwarebazaar
MalwareBazaar public API bindings for Go
librini
Rini is a tiny, non-libc dependant, .ini file parser programmed from scratch in C99.
ntqueueapcthreadex-ntdll-gadget-injection
This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret gadget can be used for stealthy code injection.
process-enumeration-stealth
shellcode-plain-sight
Hiding shellcode in plain sight within a large memory region. Inspired by technique used by Raspberry Robin's Roshtyak
Windows-API-Hashing
This is a simple example and explanation of obfuscating API resolution via hashing
wsb-detect
wsb-detect enables you to detect if you are running in Windows Sandbox ("WSB")
LloydLabs's Repositories
LloydLabs/delete-self-poc
A way to delete a locked file, or current running executable, on disk.
LloydLabs/wsb-detect
wsb-detect enables you to detect if you are running in Windows Sandbox ("WSB")
LloydLabs/ntqueueapcthreadex-ntdll-gadget-injection
This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret gadget can be used for stealthy code injection.
LloydLabs/Windows-API-Hashing
This is a simple example and explanation of obfuscating API resolution via hashing
LloydLabs/shellcode-plain-sight
Hiding shellcode in plain sight within a large memory region. Inspired by technique used by Raspberry Robin's Roshtyak
LloydLabs/elf-strings
elf-strings will programmatically read an ELF binary's string sections within a given binary. This is meant to be much like the strings UNIX utility, however is purpose built for ELF binaries.
LloydLabs/dearg-thread-ipc-stealth
A novel technique to communicate between threads using the standard ETHREAD structure
LloydLabs/process-enumeration-stealth
LloydLabs/librini
Rini is a tiny, non-libc dependant, .ini file parser programmed from scratch in C99.
LloydLabs/go-malwarebazaar
MalwareBazaar public API bindings for Go
LloydLabs/sgrm-research
Repository to compliment my blog post on System Guard Runtime Monitor
LloydLabs/pafish-macos
A macOS pafish-like port to detect analysis/virtual environments
LloydLabs/pefile
pefile is a Python module to read and work with PE (Portable Executable) files
LloydLabs/yara
The pattern matching swiss knife