BingusLdr

BingusLdr is a DLL loader built with Crystal Palace that uses a CET compatible stack spoofing technique.

Features

• CET compatible stack spoofing
• EAF compatible API resolution
• Heap masking
• Image masking

See the blog post: BingusLdr: CET Compatible Stack Spoofing

Prerequisites

• mingw-w64
• Crystal Palace link should be present in dist/
• libtcg.x64.zip should bepresent in tcg/libtcg/

Cobalt Strike

• make
• Place crystalpalace.jar in the Cobalt Strike client directory
• Import bingus.cna

Other DLLs

• make DLL_64=<PAYLOAD>.dll
• Output at ./bin/go.x64.bin

References

• Eden
• OdinLdr
• Finding Truth in the Shadows
• Crystal Palace