T

SISTA fe2726a430 valak evasion dll for sliver

evasion/ - zig dll with rc4 encrypted sleep, hwbp amsi/etw bypass,
freshycalls indirect syscall dispatch, callstack spoofing via asm
trampoline, ntdll unhooking, module stomping, token manipulation.
all techniques verified against dbgman edr tradecraft (may 2026).
ret patch removed (instant detection). comments updated with
detection status on each technique.

go-bridge/ - reflective pe loader + clean go api for sliver
integration. drop this package into sliver's implant/ dir,
replace time.sleep with evasionsleep.

build: zig build -doptimize=releaseFast -> embed dll bytes

2026-07-18 09:30:00 +01:00

evasion

valak evasion dll for sliver

2026-07-18 09:30:00 +01:00

go-bridge

valak evasion dll for sliver

2026-07-18 09:30:00 +01:00

README.md

valak evasion dll for sliver

2026-07-18 09:30:00 +01:00

README.md

Valak

What

Standalone Zig evasion DLL for C2 implants. Drop-in sleep obfuscation, AMSI/ETW bypass, callstack spoofing. Protocol-agnostic — built for Sliver but works with any C2 that can call syscall.SyscallN.

Evasion Stack

Technique	File	Detection Status (DbgMan, May 2026)
RC4 encrypted .text sleep	sleep.zig	70% effective — core evasion primitive
Callstack return-address zeroing	arch/hells_gate.s	55% effective — terminates EDR frame walks
HWBP AMSI bypass (DR0-VEH)	amsi.zig	60% effective — no memory modification
HWBP ETW bypass (DR0-VEH)	etw.zig	65% effective — no memory modification
FreshyCalls SSN extraction	syscall.zig	65% effective — immune to inline hooks
Indirect syscall dispatch	syscall.zig	60% effective — random gadget pool
KnownDlls ntdll unhooking	unhook.zig	95% DETECTED by CrowdStrike/S1
Module stomping	stomp.zig	80% DETECTED — backing-file integrity checks
Token manipulation	token.zig	90% DETECTED — lsass token access is T1 alert

Build

cd evasion
zig build -Doptimize=ReleaseFast
# → zig-out/bin/valak.dll

Then embed the DLL bytes into go-bridge/embed_dll.go:

var embeddedDLL = []byte{
    // paste compiled .dll bytes
}

Sliver Integration

Copy go-bridge/ into implant/sliver/evasion/valak/

In Sliver's implant init:

import "github.com/BishopFox/sliver/implant/sliver/evasion/valak"

func init() {
    valak.Start()
    go func() {
        time.Sleep(2 * time.Second) // wait for DLL load
        valak.PatchAll()
    }()
}

Replace time.Sleep(d) with valak.EvasionSleep(d) in Sliver's beacon loop
Build with: go build -tags evasion

Verified Against

Microsoft x64 ABI (shadow space, 16-byte alignment)
PE/COFF .drectve section spec
Go compiler no-auto-vectorize behavior
DbgMan "EDR Tradecraft" (May 2026)
CrowdStrike 2026 Global Threat Report