options to mask PE about bokuloader HOT 3 CLOSED

ok that's convincing :) yes I'm actually trying test with and without malleable c2 and tweaking params in the rdlloader and checking for each change. thx anyways.

from bokuloader.

Hey fendi1989, I haven't been able to figure out how all the different malleable C2 options work with user defined reflective loader. There is not much documentation on it. I suggest placing a breakpoint in the reflectiveloader.c, compiling, and running the beacon with a debugger. If it hits the break point you know it didn't revert to the default loader. With evading Defender you're going to have to do modifications to make things bypass. Typically shortly after releasing things publically, they become signatured by Defender. The public source code makes it allot easier, since signature analysts don't even need to do any reversing to make signatures.
If you find out any new things about getting the malleable C2 flags working with user defined reflective loader, or any ways to help with evasion let me know. Also if you want to make it better this project is open to PR :)

from bokuloader.

Sorry I couldn't be more help! This project has been like a exploration journey into the new UDRL and how it fits in with the rest of CS. Allot of moving parts. Still a long ways to go before I figure it all out lol. Good luck!

from bokuloader.