DarthTon/Blackbone
Blackbone
Blackbone es una colección de herramientas especializadas para escaneo de memoria, inyección de procesos e interfaces de controladores de kernel utilizadas para manipular el entorno de ejecución de Windows. Proporciona un framework para ejecutar código remoto, mapear imágenes ejecutables portátiles y gestionar hilos a través de diferentes límites de procesos.
El proyecto incluye un controlador de memoria de kernel para acceder a la memoria del kernel y modificar derechos de manejo para ocultar asignaciones de la detección en modo usuario. También cuenta con una librería para interceptar llamadas a funciones en procesos remotos usando interrupciones de software y puntos de interrupción de hardware.
El kit de herramientas cubre capacidades más amplias en la manipulación de memoria virtual, como leer, escribir y asignar memoria en procesos locales o remotos. Además, proporciona utilidades para la búsqueda de patrones de memoria para localizar secuencias de bytes específicas y gestión de módulos para inyectar o expulsar binarios.
Features
- Kernel-Level Operations - Ships a kernel memory driver to access kernel memory and modify handle rights to hide user-mode allocations.
- Process Injection Frameworks - Provides a comprehensive framework for deploying code into active processes and bridging host and target memory.
- Memory Pattern Searching - Includes tools for scanning process virtual address space for unique byte sequences to locate functional code.
- Windows API Hooking Engines - Ships a general-purpose engine for intercepting and altering Windows API function calls.
- Cross-Process Code Execution - Enables the execution of custom assembly instructions within a separate process using various calling conventions.
- Offensive Kernel Drivers - Implements a kernel-mode driver for low-level system manipulation and hiding memory allocations from detection.
- Kernel Memory Access - Enables reading and modifying data within the kernel address space using a privileged driver.
- Process Memory Allocation - Creates and modifies memory regions within target processes for storing dynamic data.
- Process Memory Scanners - Searches process memory segments for specific byte patterns to locate data or code.
- Remote Thread Injection - Provides capabilities for executing custom assembly and code in external processes via remote thread creation.
- Runtime Memory Manipulation - Provides tools for modifying the memory of running Windows processes to alter their state or behavior.
- Virtual Memory Mappers - Provides utilities for manually adding and modifying pages in the virtual memory map of remote processes.
- Remote Memory Manipulation - Provides capabilities for modifying memory and system state in remote Windows targets.
- Remote Process Hooking - Provides a library for intercepting function calls in remote processes using software interrupts and hardware breakpoints.
- Manual PE Mapping - Manually maps Portable Executable sections into memory, resolving imports and relocations without the native system loader.
- Thread Management - Implements primitives for creating, terminating, suspending, and resuming threads across different session boundaries.
- Binary - Enumerates, injects, and ejects binary modules and retrieves exported function addresses.
- Interrupt-Based Hooks - Intercepts target function calls using software interrupts and hardware breakpoints to redirect execution flow.
- Process Injection Modules - Handles the injection and ejection of custom libraries into external process address spaces.
- Binary Analysis - Offers a library for Windows memory hacking.
- Development Libraries - Windows library for advanced memory editing and process manipulation.
- Penetration Testing Toolkits - A library for Windows memory hacking and injection.
