Win32 Message Box

Name hash module (via PEB) and API (via EAT) resolution hash - pops MessageBoxA to desktop window session

Architecture

Size

Mixed code/data

x86

545 bytes

No

Supports API Forwarding

Yes

License

Supported OS

GNU GPLv3

Windows 7 x64

Windows 8.1 x64

Windows 10 x64

Win64 WinExec

Name hash module (via PEB) and API (via EAT) resolution hash - executes notepad.exe

Architecture

Size

Mixed code/data

x64

 621 bytes

No

Supports API Forwarding

Yes

License

Supported OS

GNU GPLv3

Windows 7 x64

Windows 8.1 x64

Windows 10 x64

Win64 EggHunter

Ideal for for a stage one JIT sprayed egg hunter to find and disable DEP on a stage two shellcode - used in Double Star

Architecture

Size

Mixed code/data

x64

673 bytes

No

Supports API Forwarding

Optional

License

Supported OS

GNU GPLv3

Windows 7 x64

Windows 8.1 x64

Windows 10 x64

Win32 WinExec

Name hash module (via PEB) and API (via EAT) resolution hash - executes notepad.exe

Architecture

Size

Mixed code/data

x86

494 bytes

No

Supports API Forwarding

Yes

License

Supported OS

GNU GPLv3

Windows 7 x64

Windows 8.1 x64

Windows 10 x64

Win64 Message Box

Name hash module (via PEB) and API (via EAT) resolution hash - pops MessageBoxA to desktop window session

Architecture

Size

Mixed code/data

x64

704 bytes

No

Supports API Forwarding

Yes

License

Supported OS

GNU GPLv3

Windows 7 x64

Windows 8.1 x64

Windows 10 x64