[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-92467":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":16,"stars7d":16,"stars30d":17,"stars90d":16,"forks30d":16,"starsTrendScore":16,"compositeScore":18,"rankGlobal":10,"rankLanguage":10,"license":19,"archived":20,"fork":20,"defaultBranch":21,"hasWiki":22,"hasPages":20,"topics":23,"createdAt":10,"pushedAt":10,"updatedAt":34,"readmeContent":35,"aiSummary":36,"trendingCount":16,"starSnapshotCount":16,"syncStatus":37,"lastSyncTime":38,"discoverSource":39},92467,"XeraLdr","xec412\u002FXeraLdr","xec412","A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Sleep Obfuscation.","",null,"C",60,8,53,1,0,5,43.36,"GNU General Public License v3.0",false,"main",true,[24,25,26,27,28,29,30,31,32,33],"edr-evasion","malware-development","module-stomping","proxyapi","red-team","shellcode-loader","sleep-obfuscation","stealth-loader","win32api","zilean","2026-07-22 04:02:06","# XeraLdr\n\nA stealthy and modular Windows loader developed by **xec412**.\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"docs\u002Fscreenshots\u002Fbanner.png\" width=\"800\" alt=\"XeraLdr Banner\">\n\u003C\u002Fp>\n\n## ⚠️ Disclaimer\n\nThis project is for **educational and research purposes only**.  \nUnauthorized use against systems you do not own is illegal.\n\n---\n\n## Overview\n\nXeraLdr is a custom loader designed to execute payloads with high stealth against modern EDR solutions.\n\n**Tested Against:** Microsoft Defender for Endpoint (MDE)  \n**Result:** No alerts appeared after several hours of activity.\n\n**Video Demonstration:** [Bypassing MDE - XeraLdr Showcase](https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=Y_QTzyn_hFA)\n\n**Payload Used:** Custom written reverse TCP shellcode\n\n---\n\n## Core Techniques & Why They Were Chosen\n\n### 1. Module Stomping (Sacrificial DLL Technique)\n- **Why?** Most memory scanners focus on newly allocated private memory regions. By stomping a legitimate system DLL, we operate inside an image-backed trusted memory space.\n- **Strength:** Very strong against memory scanners and heuristic detection.\n\n### 2. IAT Camouflage + Library Proxy Loading\n- **Why?** Many EDRs monitor suspicious Import Address Tables and API resolutions.\n- **Strength:** Provides excellent protection against static and behavioral analysis.\n\n### 3. Proxy Execute API\n- **Why?** Direct API calls are heavily monitored. Using proxy functions helps evade behavioral detection.\n- **Strength:** Reduces suspicious API call patterns.\n\n### 4. Advanced Anti-Analysis\n- **Why?** Prevents execution in virtual machines, debuggers, and sandboxes.\n- **Strength:** Protects the loader during initial execution phase.\n- **Reference:** [Sandbox-Detection-Techniques](https:\u002F\u002Fgithub.com\u002Farxhr007\u002FSandbox-Detection-Techniques)\n\n### 5. ChaCha20 Encryption + BaseN Encoding\n- **Why?** Strong encryption makes static signature detection significantly harder.\n- **Strength:** Payload remains encrypted until runtime.\n- **Reference:** [LibTomCrypt](https:\u002F\u002Fgithub.com\u002Flibtom\u002Flibtomcrypt)\n\n### 6. CRT-Free Binary\n- **Why?** Removes dependency on the Visual C++ Runtime, resulting in a smaller binary with a minimal Import Address Table (IAT). This reduces static signatures commonly flagged by EDRs and AVs.\n\n### 7. Zilean Sleep Obfuscation (with Stack Duplication & Heap Encryption)\n- **Why?** Classic `Sleep()` is easily detected. Using `SystemFunction040\u002F041` (RtlEncryptMemory \u002F RtlDecryptMemory) for heap encryption + stack duplication makes sleep periods much stealthier.\n- ** - **Warning:** If you are using a transient payload like `calc.exe`, the process will execute the payload and immediately invoke `ExitThread`. As a result, the sleep obfuscation mechanism will not trigger. For this technique to work as intended, ensure you are using a persistent payload (e.g., a reverse shell) that keeps the thread execution flow alive.\n- **Reference:** [C5pider's Tweet](https:\u002F\u002Fx.com\u002FC5pider\u002Fstatus\u002F1743209459533435308)\n\n---\n\n## Screenshots\n\n### 1. IAT Camouflage\n![IAT Camouflage](docs\u002Fscreenshots\u002FIAT-Demo.png)\n\n### 2. Call Stack Analysis\n![Call Stack](docs\u002Fscreenshots\u002FCallStack-DEMO.png)\n\n### 3. Successful Reverse Shell\n![Reverse Shell](docs\u002Fscreenshots\u002FReverseShell-Demo.png)\n\n---\n\n## Build Instructions\n\n1. Clone the repository:\n   ```bash\n   git clone https:\u002F\u002Fgithub.com\u002Fxec412\u002FXeraLdr.git\n   ```\n\n2. Open the solution file `XeraLdr.slnx` with Visual Studio.\n\n3. Select **Release | x64** configuration.\n\n4. Go to **Build -> Rebuild Solution**.\n\nAll necessary build settings are already configured in the project. No additional changes are required.\n\n---\n\nIf you find the engineering choices or the implementation useful, dropping a star on the repository would be highly appreciated! ⭐\n\n---\n\n## Learning Resources\n\n- [Maldev Academy](https:\u002F\u002Fmaldevacademy.com)\n\n---\n\n## References\n\n- [Sandbox-Detection-Techniques](https:\u002F\u002Fgithub.com\u002Farxhr007\u002FSandbox-Detection-Techniques)\n- [LibTomCrypt](https:\u002F\u002Fgithub.com\u002Flibtom\u002Flibtomcrypt)\n- [C5pider's Tweet on Sleep Obfuscation](https:\u002F\u002Fx.com\u002FC5pider\u002Fstatus\u002F1743209459533435308)\n\n---\n\n## Legal\n\nThis project is licensed under the **GPL-3.0 License**.  \nSee the [LICENSE](LICENSE) file for details.\n","XeraLdr 是一个面向红队演练的隐蔽式 Windows Shellcode 加载器，专为绕过现代终端检测与响应（EDR）系统而设计。它采用模块覆写（Module Stomping）、IAT 伪装、代理 API 调用、Zilean 风格睡眠混淆（含堆加密与栈复制）、ChaCha20 加密及 CRT-Free 构建等关键技术，实现高隐蔽性内存执行。项目不依赖 C 运行时，静态特征精简，支持加密 payload 的运行时解密与持久化线程控制。适用于合法授权的渗透测试、EDR 规避技术研究与防御对抗演练场景，需严格遵循法律法规和授权范围使用。",2,"2026-07-09 02:30:05","CREATED_QUERY"]