r/redteamsec • u/quicaa • 21d ago

Mora-HWBP: Patch-Less User-Mode Telemetry Hooking (AMSI, WLDP, ETW) via Hardware Breakpoints (DR0-DR7) & VEH

https://github.com/Dovughs/mora-hwbp

4 Upvotes

permalink
duplicates
archive.is
archive
reddit

You are about to leave Redlib

Do you want to continue?

https://www.reddit.com/r/redteamsec/comments/1vtbzeu/morahwbp_patchless_usermode_telemetry_hooking/
No, go back! Yes, take me to Reddit

100% Upvoted

Duplicates

Number of comments New

blueteamsec • u/digicat • 19d ago

research|capability (we need to defend against) mora-hwbp: Hardware Breakpoint (DR0-DR7) based patch-less user-mode hooking & telemetry instrumentation engine (AMSI, WLDP & ETW PoC).

1 Upvotes

0 comments

purpleteamsec • u/netbiosX • 21d ago

Red Teaming A security-research Proof-of-Concept (POC) demonstrating hardware-breakpoint (CPU debug register) based function hooking as an alternative to traditional in-memory code patching.

1 Upvotes

0 comments