Skip to content

POC of Flink/Blink swap with base entry point, CLEARS PEB-TEB-LDR-MODULE Flags and deletes cache

Notifications You must be signed in to change notification settings

efibootkit/zero-entrypoint

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

6 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Overview

This is a POC of module manipulation, it is manipulating the loaded module list within the PEB loader data table then swaps the Flink and Blink pointers with the BaseAddress and Entrypoint fields of LDR_MODULE structure, the memory is zeroed out which clears these fields. The EntryPoint / BaseAddress of the module is nulled and not accessible by any debugger.

Entry Point searched from its base address: Entry Point searched from its base address

About

POC of Flink/Blink swap with base entry point, CLEARS PEB-TEB-LDR-MODULE Flags and deletes cache

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages