
Archived
illusion-rs
Rusty Hypervisor - Windows UEFI Blue Pill Type-1 Hypervisor in Rust (Codename: Illusion)
defensive-toolsmemory-forensicspersistence-mechanisms+7

Rusty Hypervisor - Windows UEFI Blue Pill Type-1 Hypervisor in Rust (Codename: Illusion)

A program written in C++ for remotely dumping manual mapped modules.

Parses Windows MiniDump (MDMP) files with Kaitai Struct, extracting memory strings and scanning them against YARA rules for forensic and malware…

It encrypts the text section and set the protection to NO_ACCESS.