Valak evasion DLL for Sliver implants. ChaCha20 encrypted sleep, synthetic callstack frames via indirect syscalls, HWBP AMSI/ETW bypass, FreshyCalls, CRT-free.

docs/BUILD.md

@@ -0,0 +1,32 @@
+## build the dll
+
+requires zig 0.16.x
+
+```bash
+cd evasion
+zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
+# → zig-out/bin/valak.dll
+```
+
+cross-compiles from any OS. output is a PE32+ DLL for x64 Windows, about 80KB.
+
+## build the loader (optional)
+
+if you need a minimal shellcode loader to get your implant running:
+
+```bash
+cd ../kage
+zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
+# → zig-out/bin/kage.exe
+```
+
+## embed into sliver implant
+
+see [sliver-integration.md](sliver-integration.md) for wiring it into the implant source.
+
+build the implant with garble:
+
+```bash
+go install mvdan.cc/garble@latest
+garble -tiny -literals -seed=random build -tags evasion -ldflags="-s -w -H windowsgui"
+```