Shellcode Loader Bypass Techniques

This repository contains examples of advanced shellcode loader bypass techniques implemented in test.cpp and bypass1.cpp. These techniques are designed to evade detection and bypass modern security mechanisms, such as EDR (Endpoint Detection and Response) and AV (Antivirus) solutions.

---

Techniques in test.cpp

The following bypass techniques are implemented in test.cpp:

1. API Resolution and Dynamic Invocation
   Resolves and invokes APIs dynamically at runtime to avoid static detection.

2. API Hammering
   Repeatedly calls benign APIs to confuse behavior-based detection mechanisms.

3. String Obfuscation and Decryption
   Obfuscates sensitive strings (e.g., API names, shellcode) and decrypts them at runtime to evade static analysis.

4. NTDLL Restoration and Anti-Hooking
   Restores the original, unhooked version of ntdll.dll to bypass user-mode hooks placed by EDRs.

5. Thread Pool Execution of Shellcode
   Executes shellcode using thread pools to blend in with legitimate application behavior.

6. Remote Thread Injection
   Injects shellcode into a remote process to execute payloads stealthily.

7. Encrypted Shellcode File Loading (shellcode.bin)
   Loads and decrypts an encrypted shellcode file (shellcode.bin) at runtime to avoid detection.

---

Techniques in bypass1.cpp

The following bypass techniques are implemented in bypass1.cpp:

1. API Hashing for Function Resolution
   Resolves API functions using hashed names instead of plaintext strings to evade static analysis.

2. API Hammering
   Similar to test.cpp, repeatedly calls benign APIs to confuse behavior-based detection mechanisms.

3. Dynamic API Resolution
   Dynamically resolves API functions at runtime to avoid static detection.

4. Unhooking ntdll.dll
   Restores the original, unhooked version of ntdll.dll to bypass user-mode hooks.

5. Encrypted Shellcode File Loading (shellcode.bin)
   Loads and decrypts an encrypted shellcode file (shellcode.bin) at runtime to avoid detection.

6. Thread Pool Execution
   Executes shellcode using thread pools to mimic legitimate application behavior.

7. Stealthy Memory Allocation
   Allocates memory for shellcode in a stealthy manner, avoiding suspicious patterns that could trigger detection.

---

Shellcode Loader Bypass Images

1. 360 Bypass

2. Defender Test

3. Huorong Bypass

4. Tencent Bypass

Summary

Both test.cpp and bypass1.cpp demonstrate a variety of techniques to bypass modern security mechanisms. These techniques focus on:

• Evading static and dynamic analysis.
• Avoiding detection by EDR and AV solutions.
• Leveraging stealthy execution methods to blend in with legitimate processes.

Disclaimer:
This repository is for educational and research purposes only. The techniques demonstrated here should not be used for malicious purposes. Always ensure compliance with applicable laws and regulations.

---