maldev - ⚠️ malware development

项目说明

⚠️ Malware De

<p align="center" width="100%">
<img width="30%" src="
</p>

This repository was created to archive and document all of my attempts to learn and develop malware. I'm brand new to all of this. We'll start from the absolute beginning and see how far we can get. This repository houses the code (often updated to reflect my current "skills" — or lack thereof) from my on YouTube or my blog.

> [!Important]
> I can't believe this has to be said but I am _not_ a professional de... _at all_. I will be making _a lot_ of mistakes (as a consequence of my being green to the scene) and I will ne that any of my code is the best/most efficient or that any of these techniques are things that I'/discovered. My repeated cringing at my old code has conditioned me to be rather self-conscious of my code and abilities as a whole, but as time progresses, I hope that my coding skills get better and better and that it reflects in this repository. But again, I'm new and learning like all of you were at some point.

The techniques I'd love to learn are:

🟢 Shellcode Injection

🟢 DLL Injection

🟢 Using NTDLL

🟢 Full NTDLL Implementation

🟢 Using Direct System Calls

🟢 Indirect Syscalls

...

> [!Note]
> As I come across more stuff, I'll add more to the list. Moreover, as I complete the techniques above, I'll also update this list. My goal is to populate this repository with a of techniques related to process injection, thread hijacking, token-related stuff, kernel-related stuff, e stuff, etc. etc.

📚 Prerequisites

We're going to be dealing with a lot of low-le. As such, it's important to familiarize yourself with languages like C, C++, Assembly, etc. I might create another repository solely for documenting my progression with the aforementioned topics, but that's _far_ back in the pipeline for now.

👨‍💻 Compilation

If a technique specifically does _not_ contain a Makefile, then it's meant to be compiled using Studio. Otherwise, you can just compile the program(s) with make. I'm sure all of these can be compiled with a Makefile, but I haven't had the time to give it much attention yet.

> [!Warning]
> Ob, the stuff in this repository is explicitly for educational purposes. Not that you'll be able to run this in a patched en (especially with the shellcode generated with msfvenom thrown into the mix) without getting the absolute sh*t flagged out of it. Regardless, I do not condone the use of these programs for any malicious acti.

🛑 Common Pitfalls

Since there has been a lot of attention on the and thus, a ton of people trying out the techniques for themselves, a _lot_ of problems have been encountered. However, they're all (mostly) very easy to diagnose and remedy.
#### Crashing Process

If a process is crashing, make sure that the architecture that you compiled your program in matches the architecture of the target process you're trying to inject into. This is the single most common pitfall I see when diagnosing/ someone's issues with their program and it can be _very_ annoying and tedious.

A crashing process could also be indicative of some incomplete/missing/borked shellcode, so make sure your shellcode didn't get cut out halfway during copying and pasting it.

This could also be a consequence of _how_ you're generating your payload. Make sure to explicitly define EXITFUNC=thread during your msfvenom generation which will allow the process to exit gracefully instead of shredding the process and killing it. The included shellcode already has this set, so if you're facing the crashing issue, that would need further in.

On a slight tangent, if you're injecting a process and _nothing_ is happening — it's not e, then, this again, could be a consequence of an architectural mismatch or borked shellcode.

#### Interference

A look into Windows Defender might be warranted since it can also interfere with our program's execution, so make sure to set exclusions accordingly.

You get a reverse shell or something after injecting a remote target process and for the first few seconds, it's fine. Then, the second you issue a command, Windows Defender (or some other security solution) kills your process/connection. This can be due to how signatured (msfvenom | metasploit) payloads, listeners, handlers, etc. are. Encrypt your traffic or use something less signatured. A reverse shell by itself is almost always suspicious so more techniques are going to be needed in conjunction with what we' above.

The (in)direct syscalls technique isn't working! This could be due to API Hooking. EDRs/security solutions will sometimes inject their own DLL into your process to hook commonly abused functions. The function(s) responsible for scraping the syscall numbers and instructions currently don't incorporate a way to fight/circumna API Hooking and will fall apart due to the offsets being borked. So, you're going to have to be stuck in limbo for a while and research how to do that yourself. E (TM), I'll add a way to account for hooks, in which case, I'll just remove this line from the common pitfalls section.

🫂 Contributing

I'm only going to be accepting bug fixes or typo fixes. Since this repository was created to document my personal growth with malware de, I don't want to cheat myself by having you contribute a technique which I myself am not currently capable of implementing. If I'm doing something super inefficently (which most of the time I am), then depending on what it is, it _might_ get accepted as a pull request. Either way, contributions are accepted based on those two (2) conditions. Thank you very much to e who helps out!

💖 Acknowledgements

I'd be nothing without the support and research of my incredible (and insanely smart) friends who' much taught me e I know — in some way or another, as well as directly influenced me on this ongoing and amazing journey. In no particular order, thanks to:

La, Zetty, Xor, Spider, Rektsu, Bakki, Nigerald, Snow, Aqua, Geistmeister, Urien, and many _many_ more.

项目信息

开发语言：C

Star 数：731

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕⚠️ malware development展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。