Timer Callbacks Spoofing to Improve your SLEAP and SWAPPALA Untold :: Vincenzo — Blog
oldboy21.github.io
Hello, Hello, Aloooooooo. After some time away from coding I am here again talking about sleeping masks. Thanks to the great cybersec community there is always something to work on 😄 Last time in my blog I have talked how to hide a memory mapping (where in my case a ReflectiveDLL is loaded) from memory scanners. Particularly, SLEAPING and SWAPPALA techniques are used to swap the malicious mapping with a legit Microsoft DLL at the same address, at sleeping time.
The original post: /r/netsec by /u/oldboy21 on 2024-09-18 05:45:28.

Original Title: Improved SLEAPING sleepmask using Timers and APCs in order to spoof Timer Callback addresses at sleeping time achieving a more resilient sleep mask that works against great in-memory scanner like HSB, Moneta, etc. Also call stack return address detection is addressed in the SWAPPALA implementation.