myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
types.go (3481B)
      1 package cli
      2 
      3 import "errors"
      4 
      5 // encryption kind (used for CLI)
      6 type encKind string
      7 
      8 // shellcode-loading technique kind (used for CLI)
      9 type technique string
     10 
     11 // API-hash method
     12 type apiHashTechnique string
     13 
     14 const (
     15 	DJB2   apiHashTechnique = "DJB2"
     16 	SHA1   apiHashTechnique = "SHA1"
     17 	SHA256 apiHashTechnique = "SHA256"
     18 	SHA512 apiHashTechnique = "SHA512"
     19 
     20 	EncKindAES encKind = "AES"
     21 	EncKindXOR encKind = "XOR"
     22 	EncKindBLF encKind = "blowfish"
     23 	EncKindC20 encKind = "chacha20"
     24 
     25 	CRT               technique = "CRT"
     26 	CRTx              technique = "CRTx"
     27 	ETWP              technique = "Etwp"
     28 	SYSCALL           technique = "Syscall"
     29 	SYSCALLTEST       technique = "SyscallTest"
     30 	NtCreateThreadEx  technique = "NtCreateThreadEx"
     31 	CreateFiber       technique = "CreateFiber"
     32 	CreateThread      technique = "CreateThread"
     33 	ProcessHollowing  technique = "ProcessHollowing"
     34 	EnumCalendarInfoA technique = "EnumCalendarInfoA"
     35 )
     36 
     37 // String is used both by fmt.Print and by Cobra in help text
     38 func (e *apiHashTechnique) String() string {
     39 	return string(*e)
     40 }
     41 
     42 // Set must have pointer receiver so it doesn't change the value of a copy
     43 func (e *apiHashTechnique) Set(v string) error {
     44 	switch v {
     45 	case "DJB2", "SHA1", "SHA256", "SJA512":
     46 		*e = apiHashTechnique(v)
     47 		return nil
     48 	default:
     49 		return errors.New("must be one of \"DJB2\", \"SHA1\", \"SHA256\" or \"SHA512\"\n\n")
     50 	}
     51 }
     52 
     53 // Type is only used in help text
     54 func (e *apiHashTechnique) Type() string {
     55 	return "API Hash technique"
     56 }
     57 
     58 // String is used both by fmt.Print and by Cobra in help text
     59 func (e *encKind) String() string {
     60 	return string(*e)
     61 }
     62 
     63 // Set must have pointer receiver so it doesn't change the value of a copy
     64 func (e *encKind) Set(v string) error {
     65 	switch v {
     66 	case "AES", "XOR", "blowfish", "chacha20":
     67 		*e = encKind(v)
     68 		return nil
     69 	default:
     70 		return errors.New("must be one of \"chacha20\", \"AES\", \"blowfish\" or \"XOR\"\n\n")
     71 	}
     72 }
     73 
     74 // Type is only used in help text
     75 func (e *encKind) Type() string {
     76 	return "encKind"
     77 }
     78 
     79 // String is used both by fmt.Print and by Cobra in help text
     80 func (e *technique) String() string {
     81 	return string(*e)
     82 }
     83 
     84 // Set must have pointer receiver so it doesn't change the value of a copy
     85 func (e *technique) Set(v string) error {
     86 	switch v {
     87 	case "CreateThread", "CRT", "ProcessHollowing", "Syscall", "CreateFiber", "CRTx", "Etwp", "NtCreateThreadEx", "EnEnumCalendarInfoA", "SetTimer":
     88 		*e = technique(v)
     89 		return nil
     90 	default:
     91 		return errors.New("must be one of \"CRT\", \"CRTx\", \"Syscall\", \"CreateFiber\", \"NTCreateThreadEx\",  \"EnumCalendarInfoA\", \"Etwp\", \"SetTimer\", \"ProcessHollowing\" or \"CreateThread\"\n\n")
     92 	}
     93 }
     94 
     95 // Type is only used in help text
     96 func (e *technique) Type() string {
     97 	return "technique"
     98 }
     99 
    100 type Options struct {
    101 
    102 	// Shellcode encryption method
    103 	Encryption encKind
    104 
    105 	// Encryption key (if needed)
    106 	Key string
    107 
    108 	// Shellcode path
    109 	ShellcodePath string
    110 
    111 	// OutName path
    112 	OutName string
    113 
    114 	// os compilation target
    115 	OS string
    116 
    117 	// Arch compilation target
    118 	Arch string
    119 
    120 	// target process name to inject
    121 	Target string
    122 
    123 	// Shellcode loading method
    124 	Technique string
    125 
    126 	// Sleep time before running execution
    127 	SleepTime uint
    128 
    129 	// Registry-Persistence handler
    130 	Persistence string
    131 
    132 	// Goversion filepath
    133 	VersionFilePath string
    134 
    135 	// PE filepath
    136 	PEFilePath string
    137 
    138 	// Builds with debug symbol
    139 	WithDebug bool
    140 
    141 	// Use API-hashing
    142 	UseAPIHashing bool
    143 
    144 	// API hashing algorithm
    145 	APIHashingType string
    146 
    147 	// Build type
    148 	BuildType string
    149 }