This is a POC of module manipulation, it is manipulating the loaded module list within the PEB loader data table then swaps the Flink and Blink pointers with the BaseAddress and Entrypoint fields of LDR_MODULE structure, the memory is zeroed out which clears these fields. The EntryPoint / BaseAddress of the module is nulled and not accessible by any debugger.
-
Notifications
You must be signed in to change notification settings - Fork 1
efibootkit/zero-entrypoint
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
About
POC of Flink/Blink swap with base entry point, CLEARS PEB-TEB-LDR-MODULE Flags and deletes cache
Topics
Resources
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published