https://github.com/mdsecactivebreach/firewalker

https://github.com/mdsecactivebreach/firewalker

Last synced: 16 days ago
JSON representation

• Host: GitHub
• URL: https://github.com/mdsecactivebreach/firewalker
• Owner: mdsecactivebreach
• Created: 2020-08-17T10:16:58.000Z (over 4 years ago)
• Default Branch: master
• Last Pushed: 2020-08-17T14:40:40.000Z (over 4 years ago)
• Last Synced: 2024-11-21T08:35:13.110Z (21 days ago)
• Language: C
• Size: 4.88 KB
• Stars: 147
• Watchers: 10
• Forks: 33
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - mdsecactivebreach/firewalker - (C)

README

        
# FireWalker Instructions

This repo contains a simple library which can be used to add FireWalker hook bypass capabilities to existing code; the FireWalker concept is described on the MDSec blog at https://www.mdsec.co.uk/2020/08/firewalker-a-new-approach-to-generically-bypass-user-space-edr-hooking/.

To use the library just `#include` the FireWalker.h source file within existing C++ code and wrap API calls which may be hooked with `FIREWALK`, e.g.:

```c++

    if (!FIREWALK(QueueUserAPC((PAPCFUNC)lpvRemote, hRemoteThread, NULL)))

    {

        printf("QueueUserAPC failed\n");

        return 1;

    }

```

At present FireWalker only supports 32-bit code with 32-bit hooks; x64 and WoW64 support may be added if the concept is popular.