Rusty Ekko - Sleep Obfuscation in Rust

Last update: Apr 10, 2023

Related tags

Command-line ekko-rs

Overview

Ekko in Rust

A small sleep obfuscation technique that uses the CreateTimerQueueTimer Win32 API function ported from C https://github.com/Cracked5pider/Ekko/ to Rust.

Example

PS C:\Users\memN0ps\Documents\GitHub\ekko-rs\target\debug\ekko-rs.exe
[*] Ekko Sleep Obfuscation by @memN0ps and @trickster0. Full credits to Cracked5pider (@C5pider), Austin Hudson (@SecIdiot), Peter Winter-Smith (@peterwintrsmith)
[+] Queue timers
[+] Wait for hEvent
[+] Finished waiting for event
[+] Queue timers
[+] Wait for hEvent
[+] Finished waiting for event
[+] Queue timers
[+] Wait for hEvent
[+] Finished waiting for event
[+] Queue timers
[+] Wait for hEvent
[+] Finished waiting for event
[+] Queue timers
[+] Wait for hEvent
[+] Finished waiting for event
[+] Queue timers
[+] Wait for hEvent
[+] Finished waiting for event
[+] Queue timers
[+] Wait for hEvent
[+] Finished waiting for event
[+] Queue timers
[+] Wait for hEvent
[+] Finished waiting for event

Credits / References

@C5pider https://github.com/Cracked5pider/Ekko/
Austin Hudson (@SecIdiot) https://suspicious.actor/2022/05/05/mdsec-nighthawk-study.html / https://web.archive.org/web/20220702162943/https://suspicious.actor/2022/05/05/mdsec-nighthawk-study.html
Originally discovered by Peter Winter-Smith and used in MDSec’s Nighthawk
Thanks for contributing @trickster012
https://learn.microsoft.com/
Rust Lang Community Discord: https://discord.com/invite/rust-lang-community (MaulingMonkey)

You might also like...

Rust-advent - Learning Rust by solving advent of code challenges (Streaming live on Twitch every Monday)

Rust advent 🦀 🐚 Learning Rust by implementing solutions for Advent of Code problems. 🎥 HEY, we are live-streaming our attempts to solve the exercis

20 Nov 11, 2022

Rust-clippy - A bunch of lints to catch common mistakes and improve your Rust code

Clippy A collection of lints to catch common mistakes and improve your Rust code. There are over 450 lints included in this crate! Lints are divided i

8.7k Dec 31, 2022

Rust-battery - Rust crate providing cross-platform information about the notebook batteries.

battery Rust crate providing cross-platform information about the notebook batteries. Table of contents Overview Supported platforms Install Examples

326 Dec 21, 2022

A Rust-based shell script to create a folder structure to use for a single class every semester. Mostly an excuse to use Rust.

A Rust Course Folder Shell Script PROJECT IN PROGRESS (Spring 2022) When completed, script will create a folder structure of the following schema: [ro

1 Apr 10, 2022

Rust Imaging Library's Python binding: A performant and high-level image processing library for Python written in Rust

ril-py Rust Imaging Library for Python: Python bindings for ril, a performant and high-level image processing library written in Rust. What's this? Th

13 Dec 6, 2022

FTL Rust Demangler is a command-line tool for demangling symbol names that are mangled with the Rust convention

FTL Rust Demangler is a command-line tool for demangling symbol names that are mangled with the Rust convention. It takes a mangled symbol name as input and returns the demangled name

7 Mar 30, 2023

rpm (Rust project manager) is a tool that helps you to manage your rust projects

rpm rpm (Rust project manager) is a open source tool for managing your rust project in an organized way Installation # make sure you have rust install

4 May 4, 2023

auto-rust is an experimental project that aims to automatically generate Rust code with LLM (Large Language Models) during compilation, utilizing procedural macros.

Auto Rust auto-rust is an experimental project that aims to automatically generate Rust code with LLM (Large Language Models) during compilation, util

6 May 14, 2023

This rust compiler backend emmits valid CLR IR, enambling you to use Rust in .NET projects

What is rustc_codegen_clr? NOTE: this project is a very early proof-of-concept This is a compiler backend for rustc which targets the .NET platform an

252 Sep 7, 2023

Comments

Logging w/ conditional compilation for debug

Use if statement with cfg attribute for debugging output only when compiled withdebug target. When compiling in release target, the log::debug will be skipped and the block within the if statement as well. Additionally, set the RUST_LOG environment variable at runtime.

opened by am0nsec 1
fixes + skeleton

Hey man, made some fixes here and there and added the rest of the code. Right now it crashes in the copying from the context of the thread to the other contexts in line 56-61. Take a look when you can to fix it.

opened by trickster0 1

Rusty Ekko - Sleep Obfuscation in Rust

Related tags

Overview

Ekko in Rust

Example

Credits / References

You might also like...

Rust-advent - Learning Rust by solving advent of code challenges (Streaming live on Twitch every Monday)

Rust-clippy - A bunch of lints to catch common mistakes and improve your Rust code

Rust-battery - Rust crate providing cross-platform information about the notebook batteries.

A Rust-based shell script to create a folder structure to use for a single class every semester. Mostly an excuse to use Rust.

Rust Imaging Library's Python binding: A performant and high-level image processing library for Python written in Rust

FTL Rust Demangler is a command-line tool for demangling symbol names that are mangled with the Rust convention

rpm (Rust project manager) is a tool that helps you to manage your rust projects

auto-rust is an experimental project that aims to automatically generate Rust code with LLM (Large Language Models) during compilation, utilizing procedural macros.

This rust compiler backend emmits valid CLR IR, enambling you to use Rust in .NET projects

Comments

Logging w/ conditional compilation for debug

fixes + skeleton

Owner

Technically, this does exactly what sleep does but completes much faster!

macOS Sleep / Wake notifications

Rusty Shellcode Reflective DLL Injection (sRDI) - A small reflective loader in Rust 4KB in size for generating position-independent code (PIC) in Rust.

REC2 (Rusty External Command and Control) is client and server tool allowing auditor to execute command from VirusTotal and Mastodon APIs written in Rust. 🦀

rusty-donut - ASCII raymarching inside a terminal

⌚ A command-line tool (and library) for the rusty Swatch Internet Time.

🎄 My Rusty Solutions to AOC 2021

My Rusty Solutions For Advent of Code

Rusty fast cross-platform 2D drawing library

Dispe(rs)e, basically disperse but more rusty