NocturneLdr — Windows x64 loader with call stack spoofing

NocturneLdr — Windows x64 loader with call stack spoofing

NocturneLdr is a shellcode loader designed to produce clean, fully unwindable call stacks that appear indistinguishable from those of legitimate Windows threads, even during manual analysis. The tool injects the payload into the .text section of windows.storage.dll, uses real unwind metadata, and is designed to run long-lived payloads.

Features: • Working with RUNTIME_FUNCTION and unwind metadata. • CET-compatible call stack spoofing, along with analysis of how spoofed stacks appear in WinDbg. • Compile-time resolution of Win32/NT APIs by DJB2 hashes without directly accessing loader data in the PEB. • Concealing execution state during extended sleep periods using return chains, image encryption, and duplication of a legitimate thread's stack. • Research into EAF bypass techniques, memory reads using existing code snippets, and concealing internal data in the heap.

Tool: https://github.com/xec412/NocturneLdr