Activity
Stars and mentions · Last 30 days, Oct 6 – Nov 4
Top repositories
SilentisVox’s repositories ranked by new forks, as on trending.
Contributes to
Repositories outside SilentisVox’s account where SilentisVox opened or reviewed pull requests in the past 365 days.
Who noticed SilentisVox
Everyone who starred or forked SilentisVox’s repositories since the archive began in 2011.
Notable accounts
Ordered by the stars their own repositories have received.
Biggest fans
Accounts that starred the most of these repositories.
Breakout weeks
Each repository’s best week of new stars, with the release published around it.
Achievements
Awards earned by the repositories SilentisVox owns. Select an award to embed its badge.
No awards yet
Repositories earn awards by reaching the top three in a completed trending day or week.
A repository earns an award for finishing first, second or third in a completed trending day or week, ranked by new stars, new forks or pull request authors. Awards follow a repository through renames and transfers and count toward its current owner. Weeks run Monday to Sunday, UTC.
Mentions
มึงบอกลา EDR/AV แบบเก่าได้เลย ตัวนี้เทคนิคโหดกว่าสัสเลยล่ะ SilentisVox/SyscallRevenant
#tools #Offensive_security SyscallRevenant: Surpassing EDRs & AVs SilentisVox/SyscallRevenant // new method of performing clean indirect syscalls. The main component resolves System Service Numbers and syscall instruction addresses dynamically. This is done by enabling the trap flag during execution. The secondary component is tampering via parameter replacement before a syscall. This combination is designed to bypass userland hooks during the subsequent syscall invocation while substituting the initially presented parameters. cyberpocket.org
SyscallRevenant - a new method of performing clean indirect syscalls. The main component resolves System Service Numbers (SSNs) and syscall instruction addresses dynamically SilentisVox/SyscallRevenant
Detection Gaps with Indirect Syscalls and Parameter Tampering
Indirect Syscalls, Return Address Spoofing, and Parameter Tampering
Detection Gaps with Indirect Syscalls and Parameter Tampering What would you look for to catch this? Would the tracing or call stack give it away, or would you focus on what the syscall actually does? I’d be interested to hear where you think this falls apart and how you’d test it.
Indirect Syscalls, Return Address Spoofing, and Parameter Tampering Is there a way to stop this outside of QPC timestamps?