Pinned Repositories
AppContainerBypass
AppContainerBypass
CVE-2019-0708-EXP-Windows
CVE-2019-0708-EXP-Windows版单文件exe版,运行后直接在当前控制台反弹System权限Shell
CVE-2020-0787-EXP-ALL-WINDOWS-VERSION
Support ALL Windows Version
CVE-2020-1066-EXP
CVE-2020-1066-EXP支持Windows 7和Windows Server 2008 R2操作系统
DIYDynamoRIO
动态二进制插桩框架DynamoRIO通过将程序代码进行反复插桩(Instrumentation)执行构建了源程序代码与操纵代码之间的桥梁,使DynamoRIO的客户端编写者能够在更高的层面上驾驭原有的程序代码.虽然程序的载体还是被编译成原生的汇编指令集执行,但是不管是原生代码还是程序行为逻辑DynamoRIO为我们提供丰富的API已经把这些封装成了足够友好操作方式暴露给客户端编写者使用,用户可以透明的修改原有的程序代码(HotPatch),执行追踪,Hook,调试,模拟等高级运行时操纵(Runtime Code Manipulation )技术.本文主要分析DynamoRIO插桩的主要流程和实现原理,深入源码片段中几个有意思的小节体现作者构思的巧妙之处,并附加相关demo分析让读者加深对DynamoRIO的认识.
llvmanalyzer
笔者在一款基于LLVM编译器架构的retdec开源反编译器工具的基础上,融合了klee符号执行工具,通过符号执行(Symbolic Execution)引擎动态模拟反编译后的llvm的ir(中间指令集)运行源程序的方法,插桩所有的对x86指令集的thiscall类型函数对this指针结构体(也就是rcx寄存器,简称this结构)偏移量引用,经行分析汇总后自动识别this结构体的具体内容,并自动集成导入ida工具辅助分析.
poolfengshui
笔者的在原作者池风水利用工具(以下简称工具)基础上进行二次开发,新增了全自动获取内核调试模块符号的偏移量及配置参数和不同漏洞利用方式优化等功能, 解决了不同Windows版本适配问题,工具包括适配驱动和利用程序两部分组成,实现了在Windows 10 19H1之后任意版本包括满补丁系统上的稳定利用.
unicorn-whpx
跨平台模拟执行unicorn框架基于Qemu的TCG模式(Tiny Code Generator),以无硬件虚拟化支持方式实现全系统的虚拟化,支持跨平台和架构的CPU指令模拟,本文讨论是一款笔者的实验性项目采用Windows Hypervisor Platform虚拟机模式提供了另一种CPU指令的模拟方式,在保持原有unicorn导出接口不变的情况下,采用Hyper-v支持带硬件虚拟化支持的Windows Hypervisor Platform API接口扩展了底层CPU模拟环境实现,支持X86指令集二进制程序模拟平台和调试器.
windbg-uefi
这篇文章的目的是介绍一款实验性项目基于COM命名管道或者Windows Hyper-V虚拟机Vmbus通道实现的运行在uefi上的windbg调试引擎开发心得
windbg-wireshark
windbg调试协议wireshark抓包解析插件
cbwang505's Repositories
cbwang505/CallbackHell
Exploit for CVE-2021-40449 - Win32k Elevation of Privilege Vulnerability (LPE)
cbwang505/CVE-2021-33739-POC
cbwang505/Kernelhub
:palm_tree:Windows Kernel privilege escalation vulnerability collection, with compilation environment, demo GIF map, vulnerability details, executable file (Windows提权漏洞合集)
cbwang505/MicrosoftWontFixList
A list of vulnerabilities or design flaws Microsoft does not intend to fix. Since the number is growing, I decided to make a list.
cbwang505/stlkrn
C++ STL in the Windows Kernel with C++ Exception Support
cbwang505/Backstab
A tool to kill antimalware protected processes
cbwang505/CVE-2021-34486
Windows Etw LPE
cbwang505/diagnostics
This repository contains the source code for various .NET Core runtime diagnostic tools and documents.
cbwang505/DMF
Driver Module Framework
cbwang505/DriverBuddyReloaded
Driver Buddy Reloaded is an IDA Pro Python plugin that helps automate some tedious Windows Kernel Drivers reverse engineering tasks.
cbwang505/EfsPotato
Exploit for EfsPotato(MS-EFSR EfsRpcOpenFileRaw with SeImpersonatePrivilege local privalege escalation vulnerability).
cbwang505/Godzilla
哥斯拉
cbwang505/Gotato
Generic impersonation and privilege escalation with Golang. Like GenericPotato both named pipes and HTTP are supported.
cbwang505/hAFL1
cbwang505/Harmony
A library for patching, replacing and decorating .NET and Mono methods during runtime
cbwang505/hypervisor
lightweight hypervisor SDK written in C++ with support for Windows, Linux and UEFI
cbwang505/llvm-mctoll
llvm-mctoll
cbwang505/miasm
Reverse engineering framework in Python
cbwang505/MonoMod
C# modding swiss army knife, powered by cecil.
cbwang505/MTuner
MTuner is a C/C++ memory profiler and memory leak finder for Windows, PlayStation 4 and 3, Android and other platforms
cbwang505/none
UNONE and KNONE is a couple of open source base library that makes it easy to develop software on Windows.
cbwang505/npcap
Nmap Project's Windows packet capture and transmission library
cbwang505/NS_repo
cbwang505/PrintNightmare
cbwang505/PSSW100AVB
A list of useful Powershell scripts with 100% AV bypass (At the time of publication).
cbwang505/s7netplus
S7.NET+ -- A .NET library to connect to Siemens Step7 devices
cbwang505/StochFuzz
Sound and Cost-effective Fuzzing of Stripped Binaries by Incremental and Stochastic Rewriting
cbwang505/Windows-driver-samples
This repo contains driver samples prepared for use with Microsoft Visual Studio and the Windows Driver Kit (WDK). It contains both Universal Windows Driver and desktop-only driver samples.
cbwang505/WinSpy
Enhanced version of the classic Spy++ tool
cbwang505/xntsv
XNTSV program for detailed viewing of system structures for Windows.