Recon techniques

← maldev README · docs/index

The recon/* package tree groups discovery + environmental awareness primitives:

• Anti-analysis — debugger / VM / sandbox detection (antidebug, antivm, sandbox, timing).
• Hijack discovery — DLL search-order hijack opportunities (dllhijack).
• Hook detection — hardware breakpoint inspection (hwbp).
• System enumeration — drives, special folders, network (drive, folder, network).

flowchart TB
    subgraph anti [Anti-analysis]
        AD[antidebug]
        AV[antivm]
        TIME[timing]
        SB[sandbox<br>orchestrator]
        AD --> SB
        AV --> SB
        TIME --> SB
    end
    subgraph discovery [System discovery]
        DRV[drive]
        FLD[folder]
        NET[network]
    end
    subgraph hooks [Hook detection]
        HWBP[hwbp<br>DR0-DR3]
    end
    subgraph hijack [Hijack discovery]
        DLL[dllhijack<br>services + procs +<br>tasks + autoElevate]
    end
    SB --> BAIL[bail-on-detect]
    HWBP --> CLEAR[clear + unhook]
    DLL --> EXPLOIT[validate + deploy]
    DRV --> STAGE[USB-stage / SMB-share lateral]
    FLD --> PERSIST[persistence path resolution]
    NET --> C2[source-aware C2]

Packages

Quick decision tree

MITRE ATT&CK

See also

• Operator path: pre-flight discovery
• Detection eng path
• evasion/unhook — pair with hwbp.ClearAll for full hook clear.
• win/syscall — direct/indirect syscalls bypass both inline + HWBP.
• persistence/* — consumes folder.Get for path resolution.