AceLdr: Cobalt Strike UDRL for memory scanner evasion
AceLdr – Avoid Memory Scanners
Easy to Use
Import a single CNA script before generating shellcode.
Dynamic Memory Encryption
Creates a new heap for any allocations from Beacon and encrypts entries before sleep.
Code Obfuscation and Encryption
Changes the memory containing CS executable code to non-executable and encrypts it (FOLIAGE).
Return Address Spoofing at Execution
Certain WinAPI calls are executed with a spoofed return address (InternetConnectA, NtWaitForSingleObject, RtlAllocateHeap).
Sleep Without Sleep
Delayed execution using WaitForSingleObjectEx.
All encryption is performed with SystemFunction032.
- Not compatible with loaders that rely on the shellcode thread staying alive.
Copyright (c) 2022 Kyle Avery