Pinned Tweet
Presenting D-Generate , syscall tracing as its supposed to be!
raw.githubusercontent.com/jo…
usage:
dg cmd.exe - displays all syscalls done by process with cmd.exe as imagefile.
dg 4736 - by pid 4736
dg - just everything
example of recording:
raw.githubusercontent.com/jo…
raw.githubusercontent.com/jo…
This is a very powerfull and unique attack ive been working on-it do require run as system, then input pid of ppl process, write the code you want done on the process memory.
I never finished this as there is some xfactor that do it work on some pc only
read this very well executed attack blog.slowerzs.net/posts/ppls…
the method for converting the arb mem read into a privelegie escalation would also work for this.
it is some really nice work done by Slowerzs i hadnt read before- highy recommend








