DarthTon/Blackbone
Blackbone
Blackbone is a collection of specialized tools for memory scanning, process injection, and kernel-driver interfaces used to manipulate the Windows execution environment. It provides a framework for executing remote code, mapping portable executable images, and managing threads across different process boundaries.
The project includes a kernel memory driver to access kernel memory and modify handle rights to hide allocations from user-mode detection. It also features a library for intercepting function calls in remote processes using software interrupts and hardware breakpoints.
The toolkit covers broader capabilities in virtual memory manipulation, such as reading, writing, and allocating memory in local or remote processes. It further provides utilities for memory pattern searching to locate specific byte sequences and module management for injecting or ejecting binaries.
Features
- Kernel-Level Operations - Ships a kernel memory driver to access kernel memory and modify handle rights to hide user-mode allocations.
- Process Injection Frameworks - Provides a comprehensive framework for deploying code into active processes and bridging host and target memory.
- Memory Pattern Searching - Includes tools for scanning process virtual address space for unique byte sequences to locate functional code.
- Windows API Hooking Engines - Ships a general-purpose engine for intercepting and altering Windows API function calls.
- Cross-Process Code Execution - Enables the execution of custom assembly instructions within a separate process using various calling conventions.
- Offensive Kernel Drivers - Implements a kernel-mode driver for low-level system manipulation and hiding memory allocations from detection.
- Kernel Memory Access - Enables reading and modifying data within the kernel address space using a privileged driver.
- Process Memory Allocation - Creates and modifies memory regions within target processes for storing dynamic data.
- Process Memory Scanners - Searches process memory segments for specific byte patterns to locate data or code.
- Remote Thread Injection - Provides capabilities for executing custom assembly and code in external processes via remote thread creation.
- Runtime Memory Manipulation - Provides tools for modifying the memory of running Windows processes to alter their state or behavior.
- Virtual Memory Mappers - Provides utilities for manually adding and modifying pages in the virtual memory map of remote processes.
- Remote Memory Manipulation - Provides capabilities for modifying memory and system state in remote Windows targets.
- Remote Process Hooking - Provides a library for intercepting function calls in remote processes using software interrupts and hardware breakpoints.
- Manual PE Mapping - Manually maps Portable Executable sections into memory, resolving imports and relocations without the native system loader.
- Thread Management - Implements primitives for creating, terminating, suspending, and resuming threads across different session boundaries.
- Binary - Enumerates, injects, and ejects binary modules and retrieves exported function addresses.
- Interrupt-Based Hooks - Intercepts target function calls using software interrupts and hardware breakpoints to redirect execution flow.
- Process Injection Modules - Handles the injection and ejection of custom libraries into external process address spaces.
- Binary Analysis - Offers a library for Windows memory hacking.
- Development Libraries - Windows library for advanced memory editing and process manipulation.
- Penetration Testing Toolkits - A library for Windows memory hacking and injection.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
