← Back to Dashboard

Ekko

// Sleep Obfuscation Masterclass

8
Modules
C
Language
x64
Architecture
3
Difficulty Tiers

Master timer queue-based sleep obfuscation with RC4 encryption and ROP gadgets. Learn how Ekko encrypts beacon memory during sleep using CreateTimerQueueTimer callbacks, NtContinue context switching, and SystemFunction032 RC4 encryption to defeat memory scanners. By Cracked5pider / C5pider.

01 Beginner

Why Sleep Obfuscation Matters

Beacon sleep cycles, memory scanners during idle, the detection window problem, and why encrypted sleep is essential for modern implants.

 02 Beginner

Timer Queues & Waitable Timers

CreateTimerQueueTimer internals, NtWaitForSingleObject, callback mechanisms, and how Windows timer queues schedule deferred execution.

 03 Beginner

RC4 Encryption in Evasion

SystemFunction032 from advapi32, how the RC4 stream cipher works, the USTRING interface, and why RC4 is ideal for sleep masks.

 04 Intermediate

ROP Gadgets & NtContinue

What Return-Oriented Programming is, finding gadgets in ntdll, how NtContinue restores thread context, and building ROP-driven execution.

 05 Intermediate

The Ekko Timer Chain

The 6-timer callback chain: VirtualProtect RW, RC4 encrypt, sleep delay, RC4 decrypt, VirtualProtect RX, signal event.

 06 Intermediate

Context Manipulation

The CONTEXT structure, capturing state with RtlCaptureContext, RSP pivoting via Rsp-=8, and controlling RIP for each timer stage.

 07 Advanced

Stack & Return Address Handling

Stack alignment requirements, gadget selection for clean returns, making the call stack look legitimate during the sleep window.

 08 Advanced

Full Chain, Detection & Variants

Cronos, DeathSleep, Foliage comparisons, Ekko detection vectors, BeaconEye, Hunt-Sleeping-Beacons, and defensive countermeasures.

References & Resources