SISTA
f9eba1ed1b
- freshycalls sorted export rva table instead of hells gate for SSNs - 64 syscall;ret gadgets in a pool, picks random via xorshift64 - hells_gate.s pushes fake ntdll return before syscall now - got rid of the 5 wrapper functions, just one syscall_dispatch - deleted win32.zig, using std.os.windows. named structs for peb - asm volatile and enum fixes so this compiles on zig 0.16 - build.zig: added .abi = .gnu, .Windows subsystem
1.3 KiB
1.3 KiB
Kage 影
影に潜む
Shellcode loader using indirect syscalls. Self-injection, FreshyCalls SSN extraction, random gadget pool, callstack spoofing, per-build XOR key, jitter.
Why Zig
Zig's build system handles everything: random XOR key generation, comptime shellcode encryption, cross-compilation. One command, no external tools needed. No CRT linked, minimal import table.
zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
# → zig-out/bin/kage.exe
仕掛け
- 影探し — ntdll via PEB walk (
gs:[0x60]) - 闇渡り — indirect syscall dispatch (64 random gadgets)
- 血判 — FreshyCalls SSN extraction (sorted export RVA, immune to inline hooks)
- 封印 — comptime shellcode XOR with per-build 128-bit random key
- 影纏い — XOR-encoded asm dispatch globals + callstack spoofing
For evasion use Valak.
Layout
src/
├── main.zig entry, unified syscall dispatch
├── nt.zig NT pseudo-handles not in stdlib
├── pe.zig PE parser, export resolver, section headers
├── syscall.zig PEB walk, FreshyCalls table, gadget pool, PRNG
├── hells_gate.s asm dispatch (XOR globals, stack spoof)
build.zig
License
MIT