diff --git a/README.md b/README.md index 43b0d68..08d8767 100644 --- a/README.md +++ b/README.md @@ -1,21 +1,21 @@ -# PowerLoaderEx -* Advanced Code Injection Technique for x32 / x64 -* More Info: http://goo.gl/3CdZHw - -# Original PowerLoader -* Known since ~2013 -* Loader used in many different dropper families (Gapz / Redyms / Carberp / Vabushky ...) -* First injection technique via Return Oriented Programming technique (ROP). -* “explorer.exe” is injected using Shell_TrayWnd / NtQueueApcThread (32bit / 64bit) - -# PowerLoaderEx -* Injection via shared desktop heap -* Remove dependency in Explorer.exe shared sections (more generic) -* Injection without reading memory from the target process -* 32 and 64-bit versions (same technique) - -#Tested Environments -* Windows 7 32 and 64 bit. - -# Authors -* BreakingMalware.com +# PowerLoaderEx +* Advanced Code Injection Technique for x32 / x64 +* More Info: http://goo.gl/3CdZHw + +# Original PowerLoader +* Known since ~2013 +* Loader used in many different dropper families (Gapz / Redyms / Carberp / Vabushky ...) +* First injection technique via Return Oriented Programming technique (ROP). +* “explorer.exe” is injected using Shell_TrayWnd / NtQueueApcThread (32bit / 64bit) + +# PowerLoaderEx +* Injection via shared desktop heap +* Remove dependency in Explorer.exe shared sections (more generic) +* Injection without reading memory from the target process +* 32 and 64-bit versions (same technique) + +# Tested Environments +* Windows 7 32 and 64 bit. + +# Authors +* BreakingMalware.com