v0.0.2

2026-10-14 05:48:22 +00:00 · 2026-05-31 11:23:07 +01:00
parent 1d51b29b92
commit 5ea458fb06
18 changed files with 1367 additions and 220 deletions
@@ -1,39 +1,121 @@
+//go:build darwin
+
 package syscallobf

-import "syscall"
+import (
+	"crypto/rand"
+	"syscall"
+	"unsafe"
+)
+
+var (
+	obfPtraceTrap   ObfuscatedCall
+	obfGetpidTrap   ObfuscatedCall
+	obfKillTrap     ObfuscatedCall
+	obfOpenTrap     ObfuscatedCall
+	obfCloseTrap    ObfuscatedCall
+	obfReadTrap     ObfuscatedCall
+	obfLseekTrap    ObfuscatedCall
+	obfMmapTrap     ObfuscatedCall
+	obfMprotectTrap ObfuscatedCall
+)
+
+func init() {
+	var key [4]byte
+	if _, err := rand.Read(key[:]); err != nil {
+		panic("syscallobf: failed to generate random key: " + err.Error())
+	}
+
+	obfPtraceTrap = encode(0x200001A, key)
+	obfGetpidTrap = encode(0x2000027, key)
+	obfKillTrap = encode(0x2000025, key)
+	obfOpenTrap = encode(0x2000005, key)
+	obfCloseTrap = encode(0x2000006, key)
+	obfReadTrap = encode(0x2000003, key)
+	obfLseekTrap = encode(0x20000C7, key)
+	obfMmapTrap = encode(0x20000C5, key)
+	obfMprotectTrap = encode(0x200004A, key)
+}

 func ObfPtrace(request int, pid uintptr, addr uintptr, data uintptr) (uintptr, uintptr, syscall.Errno) {
-	return 0, 0, syscall.ENOSYS
+	trap := obfPtraceTrap.Num()
+	r1, r2, errno := syscall.RawSyscall6(trap, uintptr(request), pid, addr, data, 0, 0)
+	return r1, r2, errno
 }

 func ObfGetpid() int {
-	return 0
+	trap := obfGetpidTrap.Num()
+	r1, _, _ := syscall.RawSyscall(trap, 0, 0, 0)
+	return int(r1)
 }

 func ObfKill(pid int, sig int) error {
-	return syscall.ENOSYS
+	trap := obfKillTrap.Num()
+	_, _, errno := syscall.RawSyscall(trap, uintptr(pid), uintptr(sig), 0)
+	if errno != 0 {
+		return errno
+	}
+	return nil
 }

 func ObfOpen(path string, flags int, mode int) (int, error) {
-	return -1, syscall.ENOSYS
+	trap := obfOpenTrap.Num()
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return -1, err
+	}
+	r1, _, errno := syscall.RawSyscall(trap, uintptr(unsafe.Pointer(pathBytes)), uintptr(flags), uintptr(mode))
+	if errno != 0 {
+		return int(r1), errno
+	}
+	return int(r1), nil
 }

 func ObfClose(fd int) error {
-	return syscall.ENOSYS
+	trap := obfCloseTrap.Num()
+	_, _, errno := syscall.RawSyscall(trap, uintptr(fd), 0, 0)
+	if errno != 0 {
+		return errno
+	}
+	return nil
 }

 func ObfRead(fd int, buf []byte) (int, error) {
-	return 0, syscall.ENOSYS
-}
-
-func ObfMmap(addr uintptr, length uintptr, prot int, flags int, fd int, offset uintptr) (uintptr, error) {
-	return 0, syscall.ENOSYS
-}
-
-func ObfMprotect(addr uintptr, length uintptr, prot int) error {
-	return syscall.ENOSYS
+	trap := obfReadTrap.Num()
+	var p *byte
+	if len(buf) > 0 {
+		p = &buf[0]
+	}
+	r1, _, errno := syscall.RawSyscall(trap, uintptr(fd), uintptr(unsafe.Pointer(p)), uintptr(len(buf)))
+	if errno != 0 {
+		return int(r1), errno
+	}
+	return int(r1), nil
 }

 func ObfLseek(fd int, offset int64, whence int) (int64, error) {
-	return 0, syscall.ENOSYS
+	trap := obfLseekTrap.Num()
+	r1, _, errno := syscall.RawSyscall(trap, uintptr(fd), uintptr(offset), uintptr(whence))
+	if errno != 0 {
+		return int64(r1), errno
+	}
+	return int64(r1), nil
+}
+
+func ObfMmap(addr uintptr, length uintptr, prot int, flags int, fd int, offset uintptr) (uintptr, error) {
+	trap := obfMmapTrap.Num()
+	r1, _, errno := syscall.Syscall6(trap, addr, length, uintptr(prot), uintptr(flags), uintptr(fd), offset)
+	if errno != 0 {
+		return 0, errno
+	}
+	return r1, nil
+}
+
+func ObfMprotect(addr uintptr, length uintptr, prot int) error {
+	trap := obfMprotectTrap.Num()
+	_, _, errno := syscall.RawSyscall(trap, addr, length, uintptr(prot))
+	if errno != 0 {
+		return errno
+	}
+	return nil
 }
@@ -0,0 +1,195 @@
+//go:build windows
+
+package syscallobf
+
+import (
+	"crypto/rand"
+	"sync"
+	"syscall"
+	"unsafe"
+)
+
+var (
+	modntdll = syscall.NewLazyDLL("ntdll.dll")
+
+	procNtQueryInformationProcess = modntdll.NewProc("NtQueryInformationProcess")
+	procNtSetInformationThread    = modntdll.NewProc("NtSetInformationThread")
+	procNtClose                   = modntdll.NewProc("NtClose")
+	procNtProtectVirtualMemory    = modntdll.NewProc("NtProtectVirtualMemory")
+	procNtReadVirtualMemory       = modntdll.NewProc("NtReadVirtualMemory")
+	procNtOpenProcess             = modntdll.NewProc("NtOpenProcess")
+
+	obfPtraceTrap   ObfuscatedCall
+	obfGetpidTrap   ObfuscatedCall
+	obfKillTrap     ObfuscatedCall
+	obfOpenTrap     ObfuscatedCall
+	obfCloseTrap    ObfuscatedCall
+	obfReadTrap     ObfuscatedCall
+	obfLseekTrap    ObfuscatedCall
+	obfMmapTrap     ObfuscatedCall
+	obfMprotectTrap ObfuscatedCall
+)
+
+func init() {
+	var key [4]byte
+	if _, err := rand.Read(key[:]); err != nil {
+		panic("syscallobf: failed to generate random key: " + err.Error())
+	}
+
+	obfCloseTrap = encode(0, key)
+	obfReadTrap = encode(0, key)
+	obfOpenTrap = encode(0, key)
+	obfLseekTrap = encode(0, key)
+	obfMmapTrap = encode(0, key)
+	obfMprotectTrap = encode(0, key)
+	obfPtraceTrap = encode(0, key)
+	obfGetpidTrap = encode(0, key)
+	obfKillTrap = encode(0, key)
+}
+
+var (
+	kernel32           = syscall.NewLazyDLL("kernel32.dll")
+	procGetCurrentPID  = kernel32.NewProc("GetCurrentProcessId")
+	procOpenProcess    = kernel32.NewProc("OpenProcess")
+	procCloseHandle    = kernel32.NewProc("CloseHandle")
+	procReadProcessMem = kernel32.NewProc("ReadProcessMemory")
+)
+
+func ObfGetpid() int {
+	r1, _, _ := procGetCurrentPID.Call()
+	return int(r1)
+}
+
+func ObfOpen(path string, flags int, mode int) (int, error) {
+	p, err := syscall.UTF16PtrFromString(path)
+	if err != nil {
+		return -1, err
+	}
+	access := uint32(syscall.GENERIC_READ)
+	if flags&syscall.O_WRONLY != 0 {
+		access = syscall.GENERIC_WRITE
+	}
+	if flags&syscall.O_RDWR != 0 {
+		access = syscall.GENERIC_READ | syscall.GENERIC_WRITE
+	}
+	creation := uint32(syscall.OPEN_EXISTING)
+	if flags&syscall.O_CREAT != 0 {
+		creation = syscall.CREATE_ALWAYS
+	}
+	h, _, err := syscall.CreateFile(p, access, syscall.FILE_SHARE_READ, nil, creation, syscall.FILE_ATTRIBUTE_NORMAL, 0)
+	if err != nil && err.(syscall.Errno) != 0 {
+		return -1, err
+	}
+	return int(h), nil
+}
+
+func ObfClose(fd int) error {
+	r1, _, err := procCloseHandle.Call(uintptr(fd))
+	if r1 == 0 {
+		return err
+	}
+	return nil
+}
+
+func ObfRead(fd int, buf []byte) (int, error) {
+	var bytesRead uint32
+	var p *byte
+	if len(buf) > 0 {
+		p = &buf[0]
+	}
+	r1, _, err := syscall.ReadFile(
+		syscall.Handle(fd),
+		buf,
+		&bytesRead,
+		nil,
+	)
+	if r1 == 0 {
+		return int(bytesRead), err
+	}
+	return int(bytesRead), nil
+}
+
+func ObfLseek(fd int, offset int64, whence int) (int64, error) {
+	var newOff int64
+	high := int32(offset >> 32)
+	r1, _, err := syscall.Seek(syscall.Handle(fd), int32(offset), high)
+	if r1 == 0xffffffff && err != nil {
+		return 0, err
+	}
+	_ = newOff
+	return int64(r1), nil
+}
+
+func ObfMmap(addr uintptr, length uintptr, prot int, flags int, fd int, offset uintptr) (uintptr, error) {
+	flProtect := uint32(syscall.PAGE_READWRITE)
+	if prot&syscall.PROT_EXEC != 0 {
+		flProtect = syscall.PAGE_EXECUTE_READWRITE
+	}
+	h, _, err := syscall.CreateFileMapping(
+		syscall.Handle(fd),
+		nil,
+		flProtect,
+		uint32(length>>32),
+		uint32(length),
+		nil,
+	)
+	if h == 0 {
+		return 0, err
+	}
+	return uintptr(h), nil
+}
+
+func ObfMprotect(addr uintptr, length uintptr, prot int) error {
+	var oldProtect uint32
+	flProtect := uint32(syscall.PAGE_READWRITE)
+	if prot&syscall.PROT_EXEC != 0 {
+		flProtect = syscall.PAGE_EXECUTE_READWRITE
+	}
+	r1, _, err := procNtProtectVirtualMemory.Call(
+		uintptr(0xffffffffffffffff),
+		uintptr(unsafe.Pointer(&addr)),
+		uintptr(unsafe.Pointer(&length)),
+		uintptr(flProtect),
+		uintptr(unsafe.Pointer(&oldProtect)),
+	)
+	if r1 != 0 {
+		return err
+	}
+	return nil
+}
+
+type windowsObfCall struct {
+	once     sync.Once
+	procAddr uintptr
+	proc     *syscall.LazyProc
+}
+
+func (w *windowsObfCall) Call(args ...uintptr) (uintptr, uintptr, error) {
+	w.once.Do(func() {
+		if w.proc != nil {
+			w.procAddr = w.proc.Addr()
+		}
+	})
+	return syscall.Syscall(w.procAddr, uintptr(len(args)), args[0], args[1], args[2])
+}
+
+func NtQueryInformationProcess(handle uintptr, infoclass uint32, info uintptr, infolen uint32, retlen *uint32) uintptr {
+	r1, _, _ := procNtQueryInformationProcess.Call(
+		handle,
+		uintptr(infoclass),
+		info,
+		uintptr(infolen),
+		uintptr(unsafe.Pointer(retlen)),
+	)
+	return r1
+}
+
+func NtSetInformationThread(handle uintptr, infoclass uint32, info uintptr, infolen uint32) uintptr {
+	r1, _, _ := procNtSetInformationThread.Call(
+		handle,
+		uintptr(infoclass),
+		info,
+		uintptr(infolen),
+	)
+	return r1
+}