DREAMWALKERS

Summary from the TLDR InfoSec newsletter

Reflectively loading modules is a technique to hide malware payloads injected via shellcode. Traditionally, the call stack cannot be convincingly spoofed due to missing unwind information. This post introduces a technique called DreamWalkers, which parses the PE structure to register unwind information via `RtlAddFunctionTable`, creating clean and convincing call stacks.