AceLdr - GitLite

KO | EN

gitlite — search

#react #ai #typescript #llm #android #machine-learning #windows #cli #kubernetes #vue #security #mcp #ios #open-source

AceLdr

(★ 1,031)

Cobalt Strike UDRL for memory scanner evasion.

파일 탐색기

최종 버전 다운로드 (.zip)

- AceLdr.cna
- extract.py
- hashstring.py
- - misc.asm
  - spoof.asm
  - start.asm
- - delay.c
  - heap.c
  - hooks.h
  - spoof.c
- ace.c
- include.h
- link.ld
- native.h
- retaddr.c
- retaddr.h
- util.c
- util.h
.gitignore
demo.gif
example.profile
LICENSE
Makefile
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/kyleavery/AceLdr

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd AceLdr

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Make

보통 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Make Linux/macOS는 보통 기본 설치되어 있습니다. Windows는 별도 설치(예: MSYS2, WSL)가 필요합니다.

make

생성된 빌드 설정을 바탕으로 실제 컴파일을 진행해 실행 파일을 만듭니다.

✅ 에러 없이 끝나면 성공입니다. 생성된 실행 파일을 직접 실행해보세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# AceLdr - Avoid Memory Scanners
A position-independent reflective loader for Cobalt Strike. Zero results from [Hunt-Sleeping-Beacons](https://github.com/thefLink/Hunt-Sleeping-Beacons), [BeaconHunter](https://github.com/3lp4tr0n/BeaconHunter), [BeaconEye](https://github.com/CCob/BeaconEye), [Patriot](https://github.com/joe-desimone/patriot), [Moneta](https://github.com/forrest-orr/moneta), [PE-sieve](https://github.com/hasherezade/pe-sieve), or [MalMemDetect](https://github.com/waldo-irc/MalMemDetect).
![AceLdr Demo](https://raw.githubusercontent.com/kyleavery/AceLdr/main/demo.gif)

## Features

#### Easy to Use
Import a single CNA script before generating shellcode.

#### Dynamic Memory Encryption
Creates a new heap for any allocations from Beacon and encrypts entries before sleep.

#### Code Obfuscation and Encryption
Changes the memory containing CS executable code to non-executable and encrypts it (FOLIAGE).

#### Return Address Spoofing at Execution
Certain WinAPI calls are executed with a spoofed return address (InternetConnectA, NtWaitForSingleObject, RtlAllocateHeap).

#### Sleep Without Sleep
Delayed execution using WaitForSingleObjectEx.

#### RC4 Encryption
All encryption performed with SystemFunction032.

## Known Issues
- Not compatible with loaders that rely on the shellcode thread staying alive.

## References
This project would not have been possible without the following:
- [FOLIAGE](https://github.com/secidiot/FOLIAGE)
- [x64 return address spoofing (source + explanation)](https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html)

Other features and inspiration were taken from the following:
- [https://www.arashparsa.com/bypassing-pesieve-and-moneta-the-easiest-way-i-could-find/](https://www.arashparsa.com/bypassing-pesieve-and-moneta-the-easiest-way-i-could-find/)
- [https://github.com/secidiot/TitanLdr](https://github.com/secidiot/TitanLdr)
- [https://github.com/JLospinoso/gargoyle](https://github.com/JLospinoso/gargoyle)
- [https://www.forrest-orr.net/post/masking-malicious-memory-artifacts-part-ii-insights-from-moneta](https://www.forrest-orr.net/post/masking-malicious-memory-artifacts-part-ii-insights-from-moneta)
- [https://www.arashparsa.com/hook-heaps-and-live-free/](https://www.arashparsa.com/hook-heaps-and-live-free/)
- [https://blog.f-secure.com/hunting-for-gargoyle-memory-scanning-evasion/](https://blog.f-secure.com/hunting-for-gargoyle-memory-scanning-evasion/)
- [https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures](https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures)