citronneur

ttddbg 1.1.0 is out with new tracing feature ! Based on #IDA database, arguments and return value are pretty-printed !

Impressive works, It allows you to knock on 80 and 443 ports without drivers!

I made a little fix, if you want to retry

Lateral movement for example

You have also https://github.com/pathtofile/bad-bpf or https://github.com/Gui774ume/ebpfkit which are good references also

You need uretprobe but also need to read an arg by ref so no I don't think so... But thanks for the tip

Thanks I will check that!

Thanks!

thanks !

Yes we also use for https://github.com/airbus-cert/dirtypipe-ebpf_detection which is a dirtypipe detection program!

Exactly, we have to found the address to hook on the system, so we need the path of the currently use of libpam by other process

Planned in next release

An exemple of node-rdpjs -> https://github.com/citronneur/mstsc.js