Doge-MemX

KO | EN

gitlite — search

#java #javascript #android #php #nodejs #xml #wordpress #rust #python #elixir #cli #websockets

★ 62 Open GitHub ↗

Golang implementation of Reflective load PE from memory

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

![Doge-Assembly](https://socialify.git.ci/timwhitez/Doge-MemX/image?description=1&font=Raleway&forks=1&issues=1&language=1&logo=https%3A%2F%2Favatars1.githubusercontent.com%2Fu%2F36320909&owner=1&pattern=Circuit%20Board&stargazers=1&theme=Light)

- 🐸Frog For Automatic Scan

- 🐶Doge For Defense Evasion & Offensive Security

# Doge-MemX
Golang implementation of Reflective load PE from memory

Only Supports x64 unmanaged PE

Supports Zip file ,auto unzip

sleep to bypass Windows Defender

ETW bypass & AMSI bypass (default not use)

## Usage
- change black list https://github.com/timwhitez/Doge-MemX/blob/main/main.go#L349
```
blacklist := []string{
		//warning!! may cause panic!
		}
```

- change arguments https://github.com/timwhitez/Doge-MemX/blob/main/main.go#L404
```
tmpArgs := []string{"coffee"}
```

- new Thread or not https://github.com/timwhitez/Doge-MemX/blob/main/main.go#L409
```
//peLoader(&shellcode,"syscall")
peLoader(&shellcode,"createthread")
```

- go build

- run
```
Usage:
        Doge-MemX.exe mimikatz.exe
	Doge-MemX.exe mimikatz.zip
       
```

## Limitations
Reflect-pe only works for x64 dynamic executables.

Reflect-pe only works for x64 unmanaged PE

It's not stable.

## References
https://github.com/frkngksl/Huan

https://github.com/ayoul3/reflect-pe

https://github.com/Binject/debug

https://github.com/Binject/universal

# 🚀Star Trend
[![Stargazers over time](https://starchart.cc/timwhitez/Doge-MemX.svg)](https://starchart.cc/timwhitez/Doge-MemX)

Doge-MemX

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README