stack-spoofing-dev

SUSPICIOUS / high risk. The skill's stated purpose is operational Windows stack spoofing and EDR evasion, with concrete indirect-syscall and credential-access use cases. This is offensive security capability, not a benign general-purpose developer helper. The supplied material does not show confirmed malware, credential exfiltration, or a dangerous load-time command, so malware likelihood remains low; risk is driven by the explicit evasion and process-access functionality.

This excerpt describes scanners and setup guidance for Windows x64 stack-frame spoofing, including selecting CALL-containing functions and planting fake return-address/RBP state to create a chained unwind path. Such behavior can conceal call origins and is suspicious in a larger syscall or evasion workflow, but the shown pseudocode does not itself establish malware or data theft. Severity is moderate to high for software intended to run in an untrusted environment; no domains, URLs, IPs, credentials, or environment variables appear in this excerpt.

This fragment implements Windows x64 syscall trampolines that build synthetic unwind frames, execute a caller-selected syscall gadget, and restore the original execution state. Its explicit aim of disguising syscall call stacks from EDR inspection is a significant defense-evasion indicator. No network indicators, credential targets, persistence, or direct data theft are shown. Severity is high for security monitoring and dual-use contexts; the fragment alone does not establish broader malicious payload behavior.