evasion

Documentation

Index

• func Patch(module string, proc string, data *[]byte) (string, error)
• func Read(module string, proc string, byteLength int) ([]byte, error)
• func ReadBanana(module string, proc string, byteLength int) ([]byte, error)
• func Write(module string, proc string, data *[]byte) error
• func WriteBanana(module string, proc string, data *[]byte) error

Functions

func Patch

func Patch(module string, proc string, data *[]byte) (string, error)

Patch will find the target procedure and overwrite the start of its function with the provided bytes. Used to for evasion to patch things like amsi.dll!AmsiScanBuffer or ntdll.dll!EtwEvenWrite

func Read

func Read(module string, proc string, byteLength int) ([]byte, error)

Read will find the target module and procedure address and then read its byteLength

func ReadBanana

func ReadBanana(module string, proc string, byteLength int) ([]byte, error)

ReadBanana will find the target procedure and overwrite the start of its function with the provided bytes directly using the NtReadVirtualMemory syscall

func Write

func Write(module string, proc string, data *[]byte) error

Write will find the target module and procedure and overwrite the start of the function with the provided bytes

func WriteBanana

func WriteBanana(module string, proc string, data *[]byte) error

WriteBanana will find the target module and procedure and overwrite the start of the function with the provided bytes using the ZwWriteVirtualMemory syscall directly