Giters

JLospinoso / gargoyle

A memory scanning evasion technique

Home Page:https://jlospinoso.github.io/security/assembly/c/cpp/developing/software/2017/03/04/gargoyle-memory-analysis-evasion.html

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Does not work with the current Windows 10 version of "mshtml.dll"

ccooper21 opened this issue · comments

commented

Current Windows 10 installations use mshtml.dll version 11.0.14393.953. The ROP gadget offset for this version is not the same as the default value (i.e. 0x006D55DD) used by Gargoyle. The correct offset for this version of mshtml.dll is 0x003CBD4D. Due to this discrepancy, the Gargoyle process just crashes when attempting to leverage the ROP gadget.