MCPcopy Create free account

hub / github.com/arosenmund/defcon33_silence_kill_edr / functions

Functions76 in github.com/arosenmund/defcon33_silence_kill_edr

⨍ Functions 76◇ Types & classes 2
↓ 25 callersFunctionWriteLog
Logging
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/main.cpp:26
↓ 10 callersFunctionWriteLog
2-custom-edr-evasion/1-Custom-BYOD/driver_loader.cpp:8
↓ 9 callersFunctionWriteLog
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/offset-calc/headers/logging.h:6
↓ 8 callersFunctionReadVA
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/main.cpp:140
↓ 7 callersFunctionLog
2-custom-edr-evasion/1-Custom-BYOD/dump-that-lsass.cpp:14
↓ 7 callersFunctionReadPhys
Memory access
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/main.cpp:92
↓ 3 callersFunctionRemotePEBWalk
--- Remote PEB Walk via InMemoryOrderModuleList ---
2-custom-edr-evasion/2-Custom-API/c++/detect-att.cpp:66
↓ 3 callersFunctionToHexString
Convert to hex string
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/offset-calc/offset-calc.cpp:12
↓ 3 callersFunctionUnloadMatchesInProcess
2-custom-edr-evasion/2-Custom-API/c++/unload-dlls.cpp:112
↓ 3 callersFunctionWriteLog
2-custom-edr-evasion/1-Custom-BYOD/system-that-lsass.cpp:7
↓ 3 callersFunctionfindTargetIPs
()
2-custom-edr-evasion/2-Custom-API/golang/catwatch.go:231
↓ 3 callersFunctiontolower_ascii
2-custom-edr-evasion/2-Custom-API/c++/unload-dlls.cpp:43
↓ 2 callersFunctionFindEP
Find EPROCESS of target
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/main.cpp:147
↓ 2 callersFunctionOpenDriver
Open handle to driver
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/main.cpp:33
↓ 2 callersFunctionUsage
2-custom-edr-evasion/2-Custom-API/c++/unload-dlls.cpp:152
↓ 2 callersFunctionrunDropWatch
()
2-custom-edr-evasion/2-Custom-API/golang/catwatch.go:115
↓ 2 callersFunctionrunFileWatch
(reader *bufio.Reader)
2-custom-edr-evasion/2-Custom-API/golang/catwatch.go:135
↓ 2 callersFunctionrunRouteWatch
()
2-custom-edr-evasion/2-Custom-API/golang/catwatch.go:100
↓ 2 callersFunctionrunServiceKill
(reader *bufio.Reader)
2-custom-edr-evasion/2-Custom-API/golang/catwatch.go:167
↓ 2 callersFunctionrunWireWatch
()
2-custom-edr-evasion/2-Custom-API/golang/catwatch.go:188
↓ 1 callersFunctionBatchScanAllProcesses
2-custom-edr-evasion/2-Custom-API/c++/detect-att.cpp:149
↓ 1 callersFunctionCheckInlineHook
2-custom-edr-evasion/2-Custom-API/c++/detect-hooks-dlls.cpp:53
↓ 1 callersFunctionCompareFuncBytes
2-custom-edr-evasion/2-Custom-API/c++/detect-hooks-dlls.cpp:75
↓ 1 callersFunctionComparePEHeaders
2-custom-edr-evasion/2-Custom-API/c++/unhooker.cpp:15
↓ 1 callersFunctionDumpAndEncodeMemory
2-custom-edr-evasion/1-Custom-BYOD/dump-that-lsass.cpp:58
↓ 1 callersFunctionDumpHookTarget
2-custom-edr-evasion/2-Custom-API/c++/unhooker.cpp:32
↓ 1 callersFunctionDumpLSASS
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/main.cpp:187
↓ 1 callersFunctionDumpLsassToMemoryBuffer
2-custom-edr-evasion/1-Custom-BYOD/nikito/dump-that-lsass-nikito.cpp:131
↓ 1 callersFunctionEnableDebugPrivilege
2-custom-edr-evasion/1-Custom-BYOD/dump-that-lsass.cpp:40
↓ 1 callersFunctionEnablePrivilege
2-custom-edr-evasion/2-Custom-API/c++/unload-dlls.cpp:48
↓ 1 callersFunctionEnableSeDebugPrivilege
2-custom-edr-evasion/1-Custom-BYOD/nikito/dump-that-lsass-nikito.cpp:108
↓ 1 callersFunctionFindLSASSPid
2-custom-edr-evasion/1-Custom-BYOD/dump-that-lsass.cpp:21
↓ 1 callersFunctionFindLsassPid
2-custom-edr-evasion/1-Custom-BYOD/nikito/dump-that-lsass-nikito.cpp:86
↓ 1 callersFunctionFindRemoteKernel32
2-custom-edr-evasion/2-Custom-API/c++/unload-dlls.cpp:69
↓ 1 callersFunctionGetKernelBase
Retrieve kernel base address
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/offset-calc/offset-calc.cpp:19
↓ 1 callersFunctionGetWindowsBuildNumber
Get Windows build number
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/offset-calc/offset-calc.cpp:30
↓ 1 callersFunctionIsBackedByFileRemote
--- Check if a module base is backed by a file in the target process ---
2-custom-edr-evasion/2-Custom-API/c++/detect-att.cpp:35
↓ 1 callersFunctionIsFileBackedModule
2-custom-edr-evasion/2-Custom-API/c++/unload-dlls.cpp:60
↓ 1 callersFunctionIsSuspiciousModule
2-custom-edr-evasion/2-Custom-API/c++/detect-hooks-dlls.cpp:18
↓ 1 callersFunctionIsSuspiciousModule
2-custom-edr-evasion/2-Custom-API/c++/detect-att.cpp:27
↓ 1 callersFunctionListModules
2-custom-edr-evasion/2-Custom-API/c++/detect-hooks-dlls.cpp:26
↓ 1 callersFunctionLoadDriver
2-custom-edr-evasion/1-Custom-BYOD/driver_loader.cpp:14
↓ 1 callersFunctionLoadDriver
Driver loading
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/main.cpp:38
↓ 1 callersFunctionReadRemoteUnicodeString
--- Read remote UNICODE_STRING contents into std::wstring ---
2-custom-edr-evasion/2-Custom-API/c++/detect-att.cpp:51
↓ 1 callersFunctionResolveRemoteFreeLibrary
2-custom-edr-evasion/2-Custom-API/c++/unload-dlls.cpp:85
↓ 1 callersFunctionRestoreFunctionFromDisk
2-custom-edr-evasion/2-Custom-API/c++/unhooker.cpp:90
↓ 1 callersFunctionShouldTargetModule
2-custom-edr-evasion/2-Custom-API/c++/unload-dlls.cpp:102
↓ 1 callersFunctionStealHandle
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/main.cpp:169
↓ 1 callersFunctionTranslateVAtoPA
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/main.cpp:105
↓ 1 callersFunctionaddDropRule
(ip string)
2-custom-edr-evasion/2-Custom-API/golang/firewall-rule.go:49
↓ 1 callersFunctionaddRoute
(ip string)
2-custom-edr-evasion/2-Custom-API/golang/re-route.go:61
↓ 1 callersFunctionfindTargetIPs
()
2-custom-edr-evasion/2-Custom-API/golang/snuff-traffic.go:46
↓ 1 callersFunctionlaunchCLIMenu
()
2-custom-edr-evasion/2-Custom-API/golang/catwatch.go:37
↓ 1 callersFunctionlaunchDashboard
()
2-custom-edr-evasion/2-Custom-API/golang/catwatch.go:73
↓ 1 callersFunctionselfRemoveDriver
()
2-custom-edr-evasion/2-Custom-API/golang/snuff-traffic.go:109
↓ 1 callersFunctionstartPacketDrop
(ipList []string)
2-custom-edr-evasion/2-Custom-API/golang/snuff-traffic.go:77
↓ 1 callersFunctionstopService
(name string)
2-custom-edr-evasion/2-Custom-API/golang/disable-service.go:19
FunctionMiniDumpCallback
2-custom-edr-evasion/1-Custom-BYOD/nikito/dump-that-lsass-nikito.cpp:24
Functioniequals_ascii
2-custom-edr-evasion/2-Custom-API/c++/unload-dlls.cpp:33
Functionmain
2-custom-edr-evasion/1-Custom-BYOD/decode-that-lsass.cpp:7
Functionmain
2-custom-edr-evasion/1-Custom-BYOD/dump-that-lsass.cpp:83
Functionmain
2-custom-edr-evasion/1-Custom-BYOD/system-that-lsass.cpp:13
Functionmain
2-custom-edr-evasion/1-Custom-BYOD/driver_loader.cpp:76
Functionmain
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/main.cpp:209
Functionmain
2-custom-edr-evasion/1-Custom-BYOD/driver-dumper/offset-calc/offset-calc.cpp:39
Functionmain
2-custom-edr-evasion/1-Custom-BYOD/nikito/dump-that-lsass-nikito.cpp:315
Functionmain
()
2-custom-edr-evasion/2-Custom-API/golang/file-stomp.go:22
Functionmain
()
2-custom-edr-evasion/2-Custom-API/golang/firewall-rule.go:11
Functionmain
()
2-custom-edr-evasion/2-Custom-API/golang/re-route.go:17
Functionmain
()
2-custom-edr-evasion/2-Custom-API/golang/catwatch.go:26
Functionmain
()
2-custom-edr-evasion/2-Custom-API/golang/snuff-traffic.go:24
Functionmain
()
2-custom-edr-evasion/2-Custom-API/golang/disable-service.go:8
Functionmain
2-custom-edr-evasion/2-Custom-API/c++/detect-hooks-dlls.cpp:110
Functionmain
2-custom-edr-evasion/2-Custom-API/c++/detect-att.cpp:181
Functionmain
2-custom-edr-evasion/2-Custom-API/c++/unhooker.cpp:199
Functionwmain
2-custom-edr-evasion/2-Custom-API/c++/unload-dlls.cpp:160