Stealthy Code Execution: Exploiting Continue Handlers and Data Corruption to Evade Windows Defence

In this presentation, we unveil novel code execution primitives and memory evasion techniques that bypass Windows security mitigations such as Control Flow Guard (CFG), eXtended Flow Guard (XFG), and mainstream antivirus (AV) and Endpoint Detection and Response (EDR) solutions. We introduce innovative methods leveraging Vectored Exception Handlers (VEH), Vectored Continue Handlers (VCH), hardware breakpoints, and page guards (PG) to execute arbitrary code while evading memory scanners and detection mechanisms. Additionally, we present a new data corruption attack that exploits writable virtual method table (VMT) pointers in the .data section of legitimate modules, enabling stealthy, threadless code execution in remote processes without generating classic indicators of compromise (IoCs) or using thread creation or memory protection alterations. Our research includes the development of a binary generator, a multi-layered evasion tool that integrates these techniques, demonstrating their effectiveness against prominent AV and EDR products. The new version of this tool will be released in due course. We discuss the implications of these findings on current defensive strategies and propose potential countermeasures to enhance system security.