Jared Atkinson

For this example can't you specify the return type as [bool]? I think the marshaling would happen automatically. Something like: (func user32 EnumChildWindows ([bool]) @( [IntPtr], [IntPtr], [IntPtr] )) Sent...

This is a good data point. Unfortunately this is also marked as malicious by Windows Defender. The main problem stems from the PSReflect module that it is based on. While...

Yea this is a tough one. I typically use this module in non production use cases like when I'm researching an attack technique and want more granular control over different...

Hey Scott, Unfortunately the module is built on PSReflect which is not inherently malicious, but has been used with a lot of PowerShell based hacking tools. This is a situation...

Hey @JohnLaTwC! Nice catch! I'll take a look and see if I can get these fixed. Now I'm wondering if there are handles from win32 functions that aren't being closed...

Yea a quick survey shows that I basically don't free any of the buffers created by AllocHGlobal :(