JYenn/Valak
1
3
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Valak evasion DLL for Sliver implants. ChaCha20 encrypted sleep, synthetic callstack frames via indirect syscalls, HWBP AMSI/ETW bypass, FreshyCalls, CRT-free.

Browse Source
This commit is contained in:
SISTA
2026-07-18 09:30:00 +01:00
parent fe2726a430
commit 7ecc30f1cd
24 changed files with 727 additions and 466 deletions
Download Patch File Download Diff File Expand all files Collapse all files
evasion/win32.zig
+4 -4
View File
@@ -1,4 +1,4 @@
// Win32 type aliases, constants, and struct definitions ??? data layout only, no function types.
// Win32 type aliases, constants, and struct definitions.
const std = @import("std");
pub const WINAPI = std.builtin.CallingConvention.winapi;
@@ -47,7 +47,7 @@ pub const PULONG = *ULONG;
pub const PSIZE_T = *SIZE_T;
pub const PBOOL = *BOOL;
pub const FARPROC = *const fn() callconv(WINAPI) isize;
pub const FARPROC = *const fn () callconv(WINAPI) isize;
pub inline fn NT_SUCCESS(status: NTSTATUS) bool {
return status >= 0;
@@ -85,7 +85,7 @@ pub const STARTUPINFOEXA = extern struct {
pub const CREATE_NO_WINDOW: DWORD = 0x08000000;
// Section access rights ??? for NtOpenSection / NtMapViewOfSection
// Section access rights for NtOpenSection / NtMapViewOfSection
pub const SECTION_MAP_READ: DWORD = 0x0004;
pub const SECTION_MAP_WRITE: DWORD = 0x0002;
pub const SECTION_MAP_EXECUTE: DWORD = 0x0008;
@@ -466,4 +466,4 @@ pub const CRITICAL_SECTION = extern struct {
SpinCount: ULONG_PTR,
};
pub const PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE: DWORD_PTR = 0x00020016;
pub const PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE: DWORD_PTR = 0x00020016;