fixes

2026-07-18 09:30:07 +01:00
commit 99f45673ef
10 changed files with 480 additions and 0 deletions
@@ -0,0 +1,56 @@
+# Kage <sub>影</sub>
+
+<p align="center">
+  <img src="assets/Kage.png" alt="Kage">
+</p>
+
+> 影に潜む
+
+Shellcode loader using indirect syscalls. Self-injection, jitter between steps.
+
+## Build
+
+```bash
+# 1. place your shellcode as valak.bin in this directory
+# 2. embed it into the source:
+python3 embed.py
+# 3. compile:
+zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
+# → zig-out/bin/kage.exe
+```
+
+Single binary output, no external files needed at runtime.
+
+## Why Zig
+
+No CRT. C programs pull in the C Runtime Library which adds DLL imports to your IAT. Zig just calls the OS. Means less for AV to see.
+
+Detection engines mostly know C, C++, Rust, Go. Zig flies under the radar. Lower VirusTotal scores.
+
+Ghidra struggles with Zig binaries (there's an open bug for it). IDA doesn't properly support it either. Makes reverse engineering harder.
+
+## 仕掛け
+
+- **影探し** — ntdll via PEB walk (`gs:[0x60]`)
+- **闇渡り** — indirect syscall dispatch
+- **血判** — Hell's Gate SSN resolution
+- **影纏い** — XOR-encoded asm dispatch globals
+
+For evasion use [Valak](https://git.churchofmalware.org/JYenn/valak).
+
+## Layout
+
+```
+src/
+├── main.zig       entry, execution
+├── win32.zig      types & externs
+├── pe.zig         PE parser, export resolver
+├── syscall.zig    Hell's Gate extraction + PEB ntdll finder
+├── hells_gate.s   asm dispatch (XOR globals)
+build.zig
+embed.py           embeds valak.bin into main.zig
+```
+
+## License
+
+MIT