Syringe – DLL and Shellcode Process Injection Utility

If you remember about an old post of ours – Shellcodeexec, you might have a faint idea of what Syringe does. Shellcodeexec is a small script to execute in memory a sequence of opcodes. What it does is it spawns a new thread where the shellcode is executed in a structure exception handler (SEH). Syringe is a general purpose injection utility for the Windows platform. It supports injection of DLLs, and shellcode into remote processes as well execution of shellcode (via the same method of shellcodeexec). It can be very useful for executing Metasploit payloads while bypassing many popular anti-virus implementations as well as executing custom made DLLs.


Syringe can inject this modified version into the remote process and successfully execute shellcode in its context, interact with our shellcode and exit out of it, without damaging the remote process. Implimenting this technique, it provides users an easy way of injecting shellcode into 32-bit processes while bypassing most forms of antiviruses! Simply put, this technique is implimented by Syringe follows these steps:


Opens a handle to the remote process.
Uses VirtualAllocEx to allocate memory in the remote process with the necessary permissions of read, write, and execute.  Then uses WriteProcessMemory to copy the shellcode to the remote buffer.
Repeats step #2 with the assembly stub.
Starts the assembly stub via a call to CreateRemoteThread, with a pointer to the assembly stub as the function to execute and a pointer to the remote shellcode as the argument.

Gigabyte releases Sandy Bridge SATA checker utility

The past few days have seen some of the world's biggest companies in the computer industry announce replacement and repair programs to deal with Intel's 6-Series chipset flaw. PC makers including Hewlett-Packard, Dell, and Toshiba have pulled systems from their online and retail stores, while motherboard makers Asus, Gigabyte and MSI have pledged to offer customers hassle-free solutions in what is expected to be a costly recall for the chip giant.

For now a simple workaround is to plug any hard drives or optical drives into the unaffected SATA III 6Gbps ports on your motherboard. But Gigabyte is aware not everyone knows how to do that and has come up with a simple utility to guide less tech-savvy users. Interestingly, it seems the utility isn't tied solely to Gigabyte motherboards either.

Essentially the Gigabyte 6 Series SATA Check tool will detect any devices hooked up to the SATA II 3Gbps ports and provide guidance as to which ports to use instead. Needless to say the utility does not fix the problem with the chipset, but merely makes it super-easy to identify whether you're using the affected ports or not. In case you are using three or more SATA devices the company reasonably advises users to prioritize important devices on the SATA III ports (e.g. the hard drive with your operating system on it), and the less important devices on the SATA II ports (e.g. a DVD ROM).

Revised P67 and H67 boards are expected to begin appearing in April and manufacturers should start offering replacements accordingly. In the meantime, if you are already stuck with one of the faulty ones and need some help with your SATA ports -- or know someone who does -- you can get Gigabyte's 6 Series SATA Check tool here.