← Back to Dashboard

ShellcodeFluctuation

// Memory Fluctuation Evasion Masterclass

8
Modules
C++
Language
x64
Architecture
3
Difficulty Tiers

Master in-memory evasion through shellcode memory fluctuation — dynamically toggling page permissions and XOR-encrypting shellcode contents during sleep to defeat memory scanners like Moneta, pe-sieve, and BeaconEye. Learn how to hook Sleep, implement the full encrypt-sleep-decrypt cycle, track shellcode regions, and integrate with ThreadStackSpoofer for dual-layer evasion. By mgeeky (Mariusz Banach).

01 Beginner

Memory Scanning Threat Model

What Moneta, pe-sieve, and BeaconEye look for, the idle-time detection window, and why sleeping shellcode is vulnerable.

 02 Beginner

XOR Encryption for Memory Evasion

Single-byte vs multi-byte XOR, why XOR is ideal for in-place toggling, XOR32 key generation, and performance.

 03 Beginner

VirtualProtect & Page Permissions

Toggling RW ↔ RX, PAGE_NOACCESS as an alternative, avoiding RWX entirely, and working-set implications.

 04 Intermediate

Sleep Function Hooking

Intercepting kernel32!Sleep, inline hooking with a trampoline, the MySleep handler architecture, and unhooking during sleep.

 05 Intermediate

The Fluctuation Algorithm

The complete cycle: flip to RW, XOR encrypt, unhook Sleep, sleep, re-hook, XOR decrypt, flip to RX.

 06 Intermediate

Shellcode Region Tracking

Identifying shellcode allocation boundaries, VirtualQuery for page-aligned operations, and multi-region support.

 07 Advanced

Thread Stack Spoofing Integration

Combining fluctuation with ThreadStackSpoofer, dual-layer evasion during sleep, and return address overwriting.

 08 Advanced

Full Chain, Detection & Comparison

Ekko vs Fluctuation vs FOLIAGE, detection vectors, Moneta/pe-sieve bypass proof, limitations and future work.

References & Resources