| #!/usr/bin/env bash | |
| # Helpful reading on the compromise: | |
| # https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised | |
| # https://news.ycombinator.com/item?id=45169794 | |
| # https://x.com/P3b7_/status/1965094840959410230 | |
| # https://news.ycombinator.com/item?id=45169657 | |
| # NOTE: Requires `jq` and `rg` | |
| # Both can be installed with brew: |
FYI (July 24, 2025): I've been away since July 11, dealing with an emergency move. I'll be back working on all the amazing comments y'all have been putting down, most possibly by the first weekend of August. I appreciate all the contributions everybody has been making and all the time everybody has put to make all of our lives better.
Last Updated On: July 10, 2025
Last Updated Platform: Peacock
| BOOL TransportSend( LPVOID Data, SIZE_T Size, PVOID* RecvData, PSIZE_T RecvSize ) | |
| { | |
| #ifdef TRANSPORT_HTTP | |
| HANDLE hConnect = NULL; | |
| HANDLE hSession = NULL; | |
| HANDLE hRequest = NULL; | |
| DWORD HttpFlags = 0; | |
| LPVOID RespBuffer = NULL; |
| #include <Windows.h> | |
| #include <winternl.h> | |
| #pragma comment(linker, "/ENTRY:entry") | |
| // Define hashing algorithm to use | |
| #define HASHALGO HashStringDjb2 | |
| // Define how large you'd like cache to be | |
| #define CACHE 50 |
| #include "Windows.h" | |
| #include "stdio.h" | |
| #include "strsafe.h" | |
| #include "winternl.h" | |
| #define STATUS_INFO_LENGTH_MISMATCH 0xC0000004 | |
| typedef struct _FILE_PROCESS_IDS_USING_FILE_INFORMATION | |
| { | |
| ULONG NumberOfProcessIdsInList; |
| #ifndef PATCHLESS_AMSI_H | |
| #define PATCHLESS_AMSI_H | |
| #include <windows.h> | |
| static const int AMSI_RESULT_CLEAN = 0; | |
| PVOID g_amsiScanBufferPtr = nullptr; | |
| unsigned long long setBits(unsigned long long dw, int lowBit, int bits, unsigned long long newValue) { |
Thank you to SpecterOps for supporting this research and to Duane and Matt for proofreading and editing! Crossposted on the SpecterOps Blog.
TLDR: You may use this header file for reliable compile time string encryption without needing any additional dependencies.
Programmers of DRM software, security products, or other sensitive code bases are commonly required to minimize the amount of human readable strings in binary output files. The goal of the minimization is to hinder others from reverse engineering their proprietary technology.
Common approaches that are taken to meet this requirement often add an additional maintenance burden to the developer and are prone to error. These approaches will be presented along with t
| /* | |
| This was the first version - the newer version also includes *When* it was loaded also. | |
| https://gist.github.com/olliencc/e166a64ca211c51eb69111f26ce57bc1 | |
| */ |
