-
๐ธ Frog For Automatic Scan -
๐ถ Doge For Defense Evasion & Offensive Security
Doge-MemX
Golang implementation of Reflective load PE from memory
Only Supports x64 unmanaged PE
Supports Zip file ,auto unzip
sleep to bypass Windows Defender
ETW bypass & AMSI bypass (default not use)
Usage
- change black list https://github.com/timwhitez/Doge-MemX/blob/main/main.go#L349
blacklist := []string{
//warning!! may cause panic!
}
- change arguments https://github.com/timwhitez/Doge-MemX/blob/main/main.go#L404
tmpArgs := []string{"coffee"}
- new Thread or not https://github.com/timwhitez/Doge-MemX/blob/main/main.go#L409
//peLoader(&shellcode,"syscall")
peLoader(&shellcode,"createthread")
-
go build
-
run
Usage:
Doge-MemX.exe mimikatz.exe
Doge-MemX.exe mimikatz.zip
Limitations
Reflect-pe only works for x64 dynamic executables.
Reflect-pe only works for x64 unmanaged PE
It's not stable.
References
https://github.com/frkngksl/Huan
https://github.com/ayoul3/reflect-pe
https://github.com/Binject/debug
https://github.com/Binject/universal