. NoThrowForwardIt

Most Common Calling Conventions

Most commons are cdecl, stdcall, fastcall

In function calls, parameters are pushed onto the stack from right to left.

int func(int x, int y, int z, int m, int k);
 
int a, b, c, d, e, ret;

PE Injection/Impersonation:

I've transformed this gist into a git repository.

Whenever you research a certain vulnerability ask yourself these questions and please answer them for us

Does the exploited service write a log?
(check ls -lrt /var/log or lsof +D /var/log/ or lsof | grep servicename)

	Name	Description
	Solarwinds	Compromised company used to spread the Sunburst malware through the Orion platform.
	Orion Platform	Compromised platform used to deliver the Sunburst malware in a supply chain attack.
	Sunspot	Malware name attributed by CrowdStrike and used to insert the Sunburst backdoor.
	Sunburst	Malware name attributed by FireEye and inserted in the Orion platform. AKA Solorigate.
	Solorigate	Malware name attributed by Microsoft and inserted in the Orion platform. AKA Sunburst.
	Teardrop	Additional payload delivered by the Sunburst backdoor used to deploy a custom Cobalt Strike Beacon.
	Raindrop	Loader which delivers a payload of Cobalt Strike. Similar to Teardrop.
	Beacon	Malware name used by FireEye to define custom Cobalt Strike payload.
	GoldMax	Written in Go GoldMax acts as command-and-control backdoor for the actor. AKA Sunshuttle.

	Private Declare PtrSafe Function GetModuleHandleA Lib "KERNEL32" (ByVal lpModuleName As String) As LongPtr
	Private Declare PtrSafe Function GetProcAddress Lib "KERNEL32" (ByVal hModule As LongPtr, ByVal lpProcName As String) As LongPtr
	Private Declare PtrSafe Sub CopyMemory Lib "KERNEL32" Alias "RtlMoveMemory" (ByVal Destination As LongPtr, ByVal Source As LongPtr, ByVal Length As Long)

	'VBA Macro that detects hooks made by EDRs
	'PoC By Juan Manuel Fernandez (@TheXC3LL) based on a post from SpecterOps (https://posts.specterops.io/adventures-in-dynamic-evasion-1fe0bac57aa)


	Public Function checkHook(ByVal target As String, hModule As LongPtr) As Integer
	Dim address As LongPtr

	using System;
	using System.Diagnostics;
	using System.IO;
	using System.Runtime.InteropServices;

	namespace DinjectorWithQUserAPC
	{


	public class Program

	#!/usr/bin/env python
	from multiprocessing.pool import ThreadPool
	from time import time as timer
	from urllib.request import urlopen
	import sys
	import re
	import os.path

	start = timer()