Runtime obfuscation

active return address spoofing (synthetic stackframes, moonwalk)

• https://dtsec.us/2023-09-15-StackSpoofin/

• https://labs.withsecure.com/publications/spoofing-call-stacks-to-confuse-edrs

• https://maxdcb.github.io/DreamWalkers/

• https://www.elastic.co/security-labs/peeling-back-the-curtain-with-call-stacks

• https://hulkops.gitbook.io/blog/red-team/x64-call-stack-spoofing

• https://klezvirus.github.io/posts/Moonwalk-plus-plus/

• https://github.com/WithSecureLabs/CallStackSpoofer

• https://github.com/klezVirus/SilentMoonwalk

• https://github.com/susMdT/LoudSunRun

• https://github.com/maxDcb/DreamWalkers

• https://github.com/NtDallas/Draugr

https://github.com/NtDallas/Draugr https://github.com/HulkOperator/Spoof-RetAddr

• rust: https://github.com/joaoviictorti/uwd
• https://github.com/rasta-mouse/GadgetHunter