Valak
Zig DLL for Sliver implants. ChaCha20 encrypted sleep via indirect syscalls with synthetic callstack frames. HWBP AMSI/ETW bypass, no memory touched. FreshyCalls syscall extraction immune to inline hooks. CRT-free.
For initial delivery use Kage, minimal syscall-based shellcode loader.
Why Zig over C
No CRT linked, smaller binary, fewer imports for AV to flag. Comptime guarantees struct layouts match the PE spec without padding bugs. All the Win32 types, inline assembly, and raw pointer math of C but the compiler refuses to build if you get a struct offset wrong.
Valak replaces time.Sleep() in your implant's beacon loop with ChaCha20-encrypted sleep via indirect syscalls. During sleep your implant's .text is PAGE_NOACCESS, scanners get access violation. On wake, it restores and decrypts.
How it works
Every time Sliver would normally call time.Sleep(interval), Valak runs this instead:
1. ChaCha20 encrypts Sliver's .text section in memory (SystemFunction040)
2. Protects .text to PAGE_NOACCESS — read, write, and execute all blocked
3. NtDelayExecution(interval) via indirect syscall with random gadget
4. EDR scanner sees encrypted garbage or access violation, not Go runtime
5. On wake: protects back to PAGE_EXECUTE_READ, ChaCha20 decrypts
6. Returns to Sliver, which continues normal beacon operations
The callstack during sleep shows kernel32!BaseThreadInitThunk → ntdll!RtlUserThreadStart — what every legitimate Windows thread looks like. No gap, no zeroed return address.
Evasion stack
| Technique | How |
|---|---|
| ChaCha20 encrypted .text sleep | SystemFunction040/041 → NtDelayExecution + PAGE_NOACCESS |
| Synthetic callstack frames | kernel32!BaseThreadInitThunk → ntdll!RtlUserThreadStart |
| HWBP AMSI bypass | DR0 + VEH, no memory modified |
| HWBP ETW bypass | DR0 + VEH, no memory modified |
| FreshyCalls syscall extraction | ntdll export table sorted by RVA, immune to inline hooks |
| Indirect syscalls | Random gadget pool (64+ syscall;ret from ntdll .text) |
| CRT-free | No libc import, minimal IAT footprint |
Build
cd evasion && zig build -Doptimize=ReleaseFast
# → zig-out/bin/valak.dll
Sliver integration
See docs/sliver-integration.md. TL;DR:
- Embed valak.dll bytes into
go-bridge/embed_dll.go - Drop
go-bridge/into Sliver'simplant/sliver/evasion/valak/ - Replace
time.Sleep(d)withvalak.EvasionSleep(d)in runner.go - Build:
garble -tiny -literals -seed=random build -tags evasion -ldflags="-s -w -H windowsgui"