SISTA
f9eba1ed1b
- freshycalls sorted export rva table instead of hells gate for SSNs - 64 syscall;ret gadgets in a pool, picks random via xorshift64 - hells_gate.s pushes fake ntdll return before syscall now - got rid of the 5 wrapper functions, just one syscall_dispatch - deleted win32.zig, using std.os.windows. named structs for peb - asm volatile and enum fixes so this compiles on zig 0.16 - build.zig: added .abi = .gnu, .Windows subsystem
45 lines
1.3 KiB
Markdown
45 lines
1.3 KiB
Markdown
# Kage <sub>影</sub>
|
|
|
|
<p align="center">
|
|
<img src="assets/Kage.png" alt="Kage">
|
|
</p>
|
|
|
|
> 影に潜む
|
|
|
|
Shellcode loader using indirect syscalls. Self-injection, FreshyCalls SSN extraction, random gadget pool, callstack spoofing, per-build XOR key, jitter.
|
|
|
|
## Why Zig
|
|
|
|
Zig's build system handles everything: random XOR key generation, comptime shellcode encryption, cross-compilation. One command, no external tools needed. No CRT linked, minimal import table.
|
|
|
|
```bash
|
|
zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
|
|
# → zig-out/bin/kage.exe
|
|
```
|
|
|
|
## 仕掛け
|
|
|
|
- **影探し** — ntdll via PEB walk (`gs:[0x60]`)
|
|
- **闇渡り** — indirect syscall dispatch (64 random gadgets)
|
|
- **血判** — FreshyCalls SSN extraction (sorted export RVA, immune to inline hooks)
|
|
- **封印** — comptime shellcode XOR with per-build 128-bit random key
|
|
- **影纏い** — XOR-encoded asm dispatch globals + callstack spoofing
|
|
|
|
For evasion use [Valak](https://git.churchofmalware.org/JYenn/valak).
|
|
|
|
## Layout
|
|
|
|
```
|
|
src/
|
|
├── main.zig entry, unified syscall dispatch
|
|
├── nt.zig NT pseudo-handles not in stdlib
|
|
├── pe.zig PE parser, export resolver, section headers
|
|
├── syscall.zig PEB walk, FreshyCalls table, gadget pool, PRNG
|
|
├── hells_gate.s asm dispatch (XOR globals, stack spoof)
|
|
build.zig
|
|
```
|
|
|
|
## License
|
|
|
|
MIT
|