efibootkit / zero-entrypoint

POC of Flink/Blink swap with base entry point, CLEARS PEB-TEB-LDR-MODULE Flags and deletes cache

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Overview

This is a POC of module manipulation, it is manipulating the loaded module list within the PEB loader data table then swaps the Flink and Blink pointers with the BaseAddress and Entrypoint fields of LDR_MODULE structure, the memory is zeroed out which clears these fields. The EntryPoint / BaseAddress of the module is nulled and not accessible by any debugger.

Entry Point searched from its base address: Entry Point searched from its base address

About

POC of Flink/Blink swap with base entry point, CLEARS PEB-TEB-LDR-MODULE Flags and deletes cache


Languages

Language:C++ 100.0%