The screenshots shows the sleep stack of a side-loaded DLL during the C2 sleep stage. (Only legitimate pythonw.exe is visible on the stack)
btw, no memory edits, no RIP hijacking, no VEH/SEH.
New call-site spoofing under Windows 11 Strict CET and maximum process mitigations.
Valid NTSTATUS recovery. No SSP forgery required. Hardware-compliant.
#IntelCET#ShadowStack#Infosec#RedTeam
@ZzN1NJ4 Yes, it similar. My current implementation extends it
with synchronous execution, 0–7 arguments, NTSTATUS capture, state restoration, target validation, and strict CET support(test).