Merge pull request #1997 from HackTricks-wiki/research_update_src_binary-exploitation_windows-vectored-overloading_20260313_131252

Research Update Enhanced src/binary-exploitation/windows-vec...

Author: carlospolop

src/binary-exploitation/windows-vectored-overloading.md

@@ -53,6 +53,30 @@ At this point the process owns a RWX-capable view whose backing object is still
 
 Because the syscalls are never executed, kernel callbacks (ETWti, minifilter, etc.) do not observe the suspicious `NtOpenSection`/`NtMapViewOfSection` events, drastically lowering telemetry. From the loader’s point of view everything succeeded and `amsi.dll` is in memory, so it proceeds with import/TLS resolution against the attacker’s bytes.
 
+### PoC implementation notes (2025)
+
+The public PoC shows a few practical details that are easy to miss when re-implementing the technique:
+
+- **HWBPs are per-thread**. The PoC sets `CONTEXT_DEBUG_REGISTERS` on the **current thread** before calling `LoadLibrary`, so the VEH must run on the same thread that triggers the loader.
+- **Syscall emulation**: the VEH sets `RAX = 0` and advances `RIP` to the `ret` inside the `ntdll` stub (it scans for `0xC3`) so the kernel transition never happens, then resumes with `NtContinue`.
+- **Output parameters**: for `NtMapViewOfSection`, the VEH overwrites the returned `BaseAddress`, `ViewSize`, and `Win32Protect` outputs so the loader believes the mapping succeeded and continues with imports/TLS using the attacker’s view.
+
+Minimal HWBP setup used by the PoC (x64):
+
+```c
+CONTEXT ctx = {0};
+ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
+GetThreadContext(GetCurrentThread(), &ctx);
+ctx.Dr0 = (DWORD64)NtOpenSection;
+ctx.Dr7 = 1;
+SetThreadContext(GetCurrentThread(), &ctx);
+AddVectoredExceptionHandler(1, VehHandler);
+```
+
+### Stealth variation
+
+Recent VEH research highlights that handlers can be registered by **manually manipulating the VEH list** instead of calling `AddVectoredExceptionHandler`, which reduces reliance on user-mode APIs that may be monitored or hooked. This is not required for Vectored Overloading but can be combined with it to reduce observable API activity.
+
 ## Stage 3 – Execute the payload
 
 - **EXE payload**: The injector simply jumps to the original entry point once relocations are done. When the loader thinks it would call `DllMain`, the custom code instead executes the EXE-style entry.
@@ -64,5 +88,6 @@ When combined with a Node.js native addon (`.node` file), all of the Windows-int
 
 - [Check Point Research – GachiLoader: Defeating Node.js Malware with API Tracing](https://research.checkpoint.com/2025/gachiloader-node-js-malware-with-api-tracing/)
 - [VectoredOverloading – PoC implementation](https://github.com/CheckPointSW/VectoredOverloading)
+- [IBM X-Force – You just got vectored: Using VEH for defense evasion and process injection](https://www.ibm.com/think/x-force/using-veh-for-defense-evasion-process-injection)
 
 {{#include ../banners/hacktricks-training.md}}