Navigation



ReFrameworker – General Purpose Framework Modifier

Last updated: September 9, 2015 | 5,059 views

ReFrameworker is a general purpose Framework modifier, used to reconstruct framework Runtimes by creating modified versions from the original implementation that was provided by the framework vendor. ReFrameworker performs the required steps of runtime manipulation by tampering with the binaries containing the framework’s classes, in order to produce modified binaries that can replace the original ones.

It was developed to experiment with and demonstrate deployment of MCR (Managed Code Rootkits) code into a given framework.

Features

  • Performs all the required steps needed for modifying framework binaries (disassemble, code injection, reassemble, precompiled images cleaning, etc.)
  • Fast development and deployment of a modified behavior into a given framework
  • Auto generated deployers
  • Modules: a separation between general purpose “building blocks” that can be injected into any given binary, allowing the users to create small pieces of code that can be later combined to form a specific injection task.
  • Can be easily adapted to support multiple frameworks by minimal configuration (currently comes preconfigured for the .NET framework)
  • Comes with many “preconfigured” proof-of-concept attacks (implemented as modules) that demonstrate its usage that can be easily extended to perform many other things.

ReFrameworker, as a general purpose framework modification tool, can be used in other contexts besides security such as customizing frameworks for performance tuning, Runtime tweaking, virtual patching, hardening, and probably other usages – It all depends on what it is instructed to do.

You can download ReFrameworker v1.1 here:

Software – ReFrameworker_V1.1.zip
Source Code: ReFrameworker_V1.1_Source_Code.zip

Or read more here.

Share8
Tweet
Share
Buffer
WhatsApp
Email
8 Shares
Posted in: Hacking Tools, Malware, Secure Coding

, ,


Latest Posts:


Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
November 1, 2019 - 107 Shares
UBoat - Proof Of Concept PoC HTTP Botnet Project UBoat – Proof Of Concept PoC HTTP Botnet Project
UBoat is a PoC HTTP Botnet designed to replicate a full weaponised commercial botnet like the famous large scale infectors Festi, Grum, Zeus and SpyEye.
October 24, 2019 - 102 Shares
LambdaGuard - AWS Lambda Serverless Security Scanner LambdaGuard – AWS Lambda Serverless Security Scanner
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
October 7, 2019 - 146 Shares
exe2powershell - Convert EXE to BAT Files exe2powershell – Convert EXE to BAT Files
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.
September 23, 2019 - 144 Shares
HiddenWall - Create Hidden Kernel Modules HiddenWall – Create Hidden Kernel Modules
HiddenWall is a Linux kernel module generator used to create hidden kernel modules to protect your server from attackers.
September 7, 2019 - 193 Shares
Anteater - CI/CD Security Gate Check Framework Anteater – CI/CD Security Gate Check Framework
Anteater is a CI/CD Security Gate Check Framework to prevent the unwanted merging of filenames, binaries, deprecated functions, staging variables and more.
August 31, 2019 - 77 Shares


Comments are closed.