$ show VoldeSec/PatchlessInlineExecute-Assembly
This repository implements a Cobalt Strike Beacon Object File (BOF) that loads .NET assemblies directly into memory while employing hardware breakpoint-based techniques to bypass AMSI and ETW monitoring without patching memory. The core functionality resides in the C source file which handles .NET runtime initialization, assembly loading, and the innovative hardware breakpoint mechanism for security bypass. The project includes an Aggressor script for integration with Cobalt Strike's command framework. The code demonstrates advanced Windows API manipulation, COM interop for .NET hosting, and stealth techniques that avoid traditional memory patching detectable by EDR solutions.
The LLM identified 1 files worth highlighting for reuse:
The core implementation that demonstrates innovative use of hardware debug registers to bypass AMSI and ETW without memory patching. It manages .NET runtime hosting via COM interfaces, handles command-line argument parsing for Cobalt Strike integration, and implements a robust exception handling mechanism that redirects execution flow when hardware breakpoints are triggered. The code shows careful resource management, proper error handling, and sophisticated Windows API usage that avoids common detection vectors.