myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
utils.go (1727B)
      1 package loaders
      2 
      3 func InformExpermimental() {
      4 	println("[!] The API hashing feature is still in an an experimental stage!!")
      5 	println("Only a few methods are supported for now:")
      6 	println("\t-Syscall\n\t-CreateThread\n\t-NtCreateThreadEx\n")
      7 }
      8 
      9 func InformProcessUnused(process string) {
     10 	_ = process
     11 
     12 	println("[!] PLEASE NOTE:\n\tshellcode will not be injected into new process with this method.")
     13 }
     14 
     15 func DownloadMyphInternals(path string) error {
     16 
     17 	println("[!] While internals module is not published, we will manually copy it.")
     18 	println("Please ensure (temporarily) that you use myph from its root repository.")
     19 
     20 	return nil
     21 }
     22 
     23 type Templater interface {
     24 	Init() string
     25 	Import() string
     26 	Const() string
     27 	Process() string
     28 	GetTemplate(targetProcess string) string
     29 }
     30 
     31 func SelectTemplate(templateName string, useApiHashing bool, apiHashTechnique string) func(string) string {
     32 
     33 	// TODO(djnn): finish transitionning methods here
     34 	var methodes = map[string]Templater{
     35 		"Syscall":           SysTemplate{UseApiHashing: useApiHashing, HashMethod: apiHashTechnique},
     36 		"CRT":               CRTTemplate{},
     37 		"CRTx":              CRTxTemplate{},
     38 		"CreateThread":      CreateTTemplate{UseApiHashing: useApiHashing, HashMethod: apiHashTechnique},
     39 		"ProcessHollowing":  ProcHollowTemplate{},
     40 		"EnumCalendarInfoA": EnumCalendarTemplate{},
     41 		"CreateFiber":       CreateFiberTemplate{},
     42 		"Etwp":              ETWPTemplate{},
     43 		"NtCreateThreadEx":  NtCreateThreadExTemplate{UseApiHashing: useApiHashing, HashMethod: apiHashTechnique},
     44 		"SetTimer":          SetTimerTemplate{},
     45 	}
     46 
     47 	if useApiHashing {
     48 		InformExpermimental()
     49 	}
     50 
     51 	template, exist := methodes[templateName]
     52 	if exist {
     53 		return template.GetTemplate
     54 	}
     55 	return nil
     56 }