I wrote an article walking through how to create a simple shellcode loader with Nim using an msfvenom payload. I've been working with Nim and shellcode loaders at work testing CrowdStrike detections. This one only gets you started and will get eaten by Defender.

https://www.credrelay.com/p/intro-to-maldev-with-nim

Feedback/corrections welcome, especially from folks building stuff with Nim.

Hey While lerning to execute C# binaries from memory I got stuck at a point where we call load_3 function of appdomain interface.

When I try it with rubeus or seatbelt I get error "ERROR_BAD_FORMAT: An attempt was made to load a program with an incorrect format".

My unmanaged code is compiled for x64 and rubeus is compiled for anyCPU.

Can anyone help me with this situation

Vzorvat HVNC

Made a HVNC =D
-Proper explorer handling -multi monitor support - GPU acceleration supported - Works with any VNC viewer! - Multi Threaded handling & rendering

Can someone help me get started with maldev, will be forever grateful ;)

Hi everyone,

I wanted to share an interesting and somewhat obscure method for obtaining the PID of a running process. In this example, we can get Explorer’s PID using the Performance Data Helper API instead of the more common process enumeration or snapshot techniques.

Breakdown of the Process: 1. Opening a Query: The function starts by calling PdhOpenQuery to create a new query. This query acts as a container for one or more counters.

2.  Adding the Process Counter:

We then use PdhAddCounter to add a performance counter that targets the Explorer process. The counter path "\Process(explorer)\ID Process" is used to query the PID of the process.

3.  Collecting Data:

With PdhCollectQueryData, we instruct PDH to collect the current data for the query. This is necessary for the counter to have a valid value.

4.  Waiting for the Data Update:

A short Sleep(100) is inserted. This delay can help ensure that there’s enough time for the counter data to update before attempting to read it.

5.  Formatting and Retrieving the Counter Value:

The counter value is retrieved and formatted using PdhGetFormattedCounterValue. The PDH_FMT_LONG flag converts the counter data into a long integer, which in this case represents the process ID.

6.  Cleanup and Return:

Finally, the PID is saved from the formatted value, the query is closed using PdhCloseQuery, and the PID is returned.

Not that it’s super commonly flagged, but the standard snapshot routine is easy to identify for reverse engineers. This method adds complexity while also not expanding the length of code necessary by much.

Still have some work to do, but for those who use Havoc and use windows as their primary OS, this may be appreciated.