sleepmask_ekko_cfg

Code snippets to add on top of cobalt strike sleepmask kit so that ekko can work in a CFG protected process.

All credits to @Icebreaker

Usage

1. Enable ekko sleep in sleepmask kit
2. Include cfg.c
3. Add below codes before ekko sleep

   PVOID NtContinue = KERNEL32$GetProcAddress(KERNEL32$GetModuleHandleA("ntdll.dll"),"NtContinue");
   //PVOID NtContinue = NTDLL$NtContinue; //<-- this should be the same as above
   if (!markCFGValid_nt(NtContinue))
    {
        return;
    }

4. Put cfg.c in folder
5. Append the contents in bofdefs.h
6. Compile

Caveat

1. Sleep 0 will terminate the process, meaning that socks cannot be used (However, if interactive process is needed, its pointless to use ekko, just revert back to use original sleep)

Reference

1. https://github.com/IcebreakerSecurity/Ekko_CFG_Bypass