Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security Policy
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

evasion

package

Go to main page

Versions in this module

v0

v0.2.1

Oct 27, 2024

v0.2.0

May 23, 2024

Changes in this version

+ const LOAD_LIBRARY_AS_DATAFILE

+ const SEC_IMAGE

+ const THREAD_SUSPEND_RESUME

+ var CryptDecrypt = windows.NewLazySystemDLL("advapi32.dll").NewProc("CryptDecrypt")

+ var CryptEncrypt = windows.NewLazySystemDLL("advapi32.dll").NewProc("CryptEncrypt")

+ var Debug = true

+ var GetCurrentProcessId = windows.NewLazySystemDLL("kernel32.dll").NewProc("GetCurrentProcessId")

+ var NtdllPath = "C:\\Windows\\System32\\ntdll.dll"

+ var OpenThread = windows.NewLazySystemDLL("kernel32.dll").NewProc("OpenThread")

+ var ResumeThread = windows.NewLazySystemDLL("kernel32.dll").NewProc("ResumeThread")

+ var RtlRestoreContext = windows.NewLazySystemDLL("ntdll.dll").NewProc("RtlRestoreContext")

+ var SetEvent = windows.NewLazySystemDLL("kernel32.dll").NewProc("SetEvent")

+ var SuspendThread = windows.NewLazySystemDLL("kernel32.dll").NewProc("SuspendThread")

+ var VirtualProtect = windows.NewLazySystemDLL("kernel32.dll").NewProc("VirtualProtect")

+ var WaitForSingleObject = windows.NewLazySystemDLL("kernel32.dll").NewProc("WaitForSingleObject")

+ func AMSIByPass(pn string)

+ func CodeBrainfuck(input string) string

+ func DecodeBrainfuck(code string, input string) string

+ func EkkoObf(duration int, newKey [16]byte)

+ func ExtractMatchedStringFromURL(url, pattern string) (string, error)

+ func FuckETW() error

+ func RandLlave() ([16]byte, error)

+ func Rander() int

+ func UnhookNTDLL(hNtdll windows.Handle, pMapping uintptr) error

+ type Context struct

+ R8 uintptr

+ R9 uintptr

+ Rcx uintptr

+ Rdx uintptr

+ Rip uintptr

+ Rsp uintptr

+ type IMAGE_DATA_DIRECTORY struct

+ Size uint32

+ VirtualAddress uint32

+ type IMAGE_DOS_HEADER struct

+ E_cblp uint16

+ E_cp uint16

+ E_cparhdr uint16

+ E_crlc uint16

+ E_cs uint16

+ E_csum uint16

+ E_ip uint16

+ E_lfanew int32

+ E_lfarlc uint16

+ E_magic uint16

+ E_maxalloc uint16

+ E_minalloc uint16

+ E_oemid uint16

+ E_oeminfo uint16

+ E_ovno uint16

+ E_res [4]uint16

+ E_res2 [10]uint16

+ E_sp uint16

+ E_ss uint16

+ type IMAGE_FILE_HEADER struct

+ Characteristics uint16

+ Machine uint16

+ NumberOfSections uint16

+ NumberOfSymbols uint32

+ PointerToSymbolTable uint32

+ SizeOfOptionalHeader uint16

+ TimeDateStamp uint32

+ type IMAGE_NT_HEADERS struct

+ FileHeader IMAGE_FILE_HEADER

+ OptionalHeader IMAGE_OPTIONAL_HEADER64

+ Signature uint32

+ type IMAGE_OPTIONAL_HEADER64 struct

+ AddressOfEntryPoint uint32

+ BaseOfCode uint32

+ CheckSum uint32

+ DataDirectory [16]IMAGE_DATA_DIRECTORY

+ DllCharacteristics uint16

+ FileAlignment uint32

+ ImageBase uint64

+ LoaderFlags uint32

+ Magic uint16

+ MajorImageVersion uint16

+ MajorLinkerVersion uint8

+ MajorOperatingSystemVersion uint16

+ MajorSubsystemVersion uint16

+ MinorImageVersion uint16

+ MinorLinkerVersion uint8

+ MinorOperatingSystemVersion uint16

+ MinorSubsystemVersion uint16

+ NumberOfRvaAndSizes uint32

+ SectionAlignment uint32

+ SizeOfCode uint32

+ SizeOfHeaders uint32

+ SizeOfHeapCommit uint64

+ SizeOfHeapReserve uint64

+ SizeOfImage uint32

+ SizeOfInitializedData uint32

+ SizeOfStackCommit uint64

+ SizeOfStackReserve uint64

+ SizeOfUninitializedData uint32

+ Subsystem uint16

+ Win32VersionValue uint32

+ type IMAGE_SECTION_HEADER struct

+ Characteristics uint32

+ Name [8]byte

+ NumberOfLinenumbers uint16

+ NumberOfRelocations uint16

+ PointerToLinenumbers uint32

+ PointerToRawData uint32

+ PointerToRelocations uint32

+ SizeOfRawData uint32

+ VirtualAddress uint32

+ VirtualSize uint32

+ type ImageDosHeader struct

+ E_cblp uint16

+ E_cp uint16

+ E_cparhdr uint16

+ E_crlc uint16

+ E_cs uint16

+ E_csum uint16

+ E_ip uint16

+ E_lfanew int32

+ E_lfarlc uint16

+ E_magic uint16

+ E_maxalloc uint16

+ E_minalloc uint16

+ E_oemid uint16

+ E_oeminfo uint16

+ E_ovno uint16

+ E_res [4]uint16

+ E_res2 [10]uint16

+ E_sp uint16

+ E_ss uint16

+ type ImageNtHeaders struct

+ FileHeader [20]byte

+ OptionalHeader struct{ ... }

+ Signature uintptr

v0.1.1

Mar 24, 2022

v0.1.0

Mar 20, 2022

Changes in this version

+ func CheckMouse(sec int)

+ func CheckNameEXE(name string)

+ func CheckScreen()

+ func CheckVMFilepath() bool

+ func GetNameEXE() string

+ func GetPID(name string) int

+ func SendPID(name string, url_target string)