MCPcopy Create free account

hub / github.com/TideSec/GoBypassAV / functions

Functions89 in github.com/TideSec/GoBypassAV

⨍ Functions 89◇ Types & classes 13
↓ 17 callersFunctionfack
(path string)
SandBox/main.go:151
↓ 5 callersFunctiongather_file_info_win
Borrowed from BDF... I could just skip to certLOC... *shrug*
SignThief/sigthief.py:12
↓ 2 callersFunctionVirtualProtect1
(lpAddress unsafe.Pointer, dwSize uintptr, flNewProtect uint32, lpflOldProtect unsafe.Pointer)
Go_Windows_API/15-SyscallUnsafe/main.go:12
↓ 2 callersFunctionaaa
(a unsafe.Pointer, b uintptr, c uint32, d unsafe.Pointer)
SandBox/main.go:179
↓ 2 callersFunctionappendcert
(outputloc string, inputloc string, cert []byte)
SignThief/main.go:34
↓ 2 callersFunctioncheckErr
(err error)
Go_Windows_API/14-RtlMoveMemory/main.go:25
↓ 2 callersFunctioncopyCert
(exe)
SignThief/sigthief.py:105
↓ 2 callersFunctiongetcert
(sigexe string)
SignThief/main.go:15
↓ 1 callersFunctionAesDecryptByECB
(data, key string)
Encryption/AES_code/main.go:41
↓ 1 callersFunctionAesEncryptByECB
(data, key string)
Encryption/AES_code/main.go:9
↓ 1 callersFunctionBagua_de
解密
Encryption/Bagua_code/main.go:111
↓ 1 callersFunctionBagua_en
加密
Encryption/Bagua_code/main.go:105
↓ 1 callersFunctionPKCS7Padding
补码
Encryption/AES_code/main.go:32
↓ 1 callersFunctionPKCS7UNPadding
解码
Encryption/AES_code/main.go:63
↓ 1 callersFunctionPathExists
(path string)
SandBox/main.go:141
↓ 1 callersFunctionRun
(sc []byte)
SandBox/main.go:188
↓ 1 callersFunctionScFromHex
(scHex string)
SandBox/main.go:199
↓ 1 callersFunctionShowConsoleAsync
(commandShow uintptr)
HideWindow/main.go:5
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/11-NtQueueApcThreadEx/main.go:19
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/03-CreateRemoteThread/main.go:13
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/07-CreatProcess/main.go:145
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/02-CreateProcessWithPipe/main.go:12
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/12-ProcCryptProtectMemory/main.go:45
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/05-CreateThread/main.go:10
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/04-CreateRemoteThreadEx/main.go:12
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/01-CreateFiber/main.go:17
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/16-UuidFromString/main.go:13
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/09-EtwpCreateEtwThread/main.go:18
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/10-HeapAlloc/main.go:16
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/15-SyscallUnsafe/main.go:36
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/13-RtlCreateUserThread/main.go:13
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/08-EarlyBird/main.go:13
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/06-CreateThreadNative/main.go:18
↓ 1 callersFunctionXor
(src string)
Go_Windows_API/14-RtlMoveMemory/main.go:33
↓ 1 callersFunctionb8ToByte
(b []int)
Encryption/Bagua_code/main.go:90
↓ 1 callersFunctionbootTime
2. 检测开机时间 许多沙箱检测完毕后会重置系统，我们可以检测开机时间来判断是否为真实的运行状况。
SandBox/main.go:58
↓ 1 callersFunctionbyteTo2
(byt int, dst []int)
Encryption/Bagua_code/main.go:94
↓ 1 callersFunctioncheck_file
()
SandBox/main.go:157
↓ 1 callersFunctioncheck_language
检测语言，依赖windows数据包，编译后会增加0.6M大小
SandBox/main.go:17
↓ 1 callersFunctioncheck_sandbox
()
SandBox/main.go:24
↓ 1 callersFunctioncheck_sig
(exe)
SignThief/sigthief.py:154
↓ 1 callersFunctioncheck_virtual
()
SandBox/main.go:126
↓ 1 callersMethoddec
(src string)
Encryption/XOR_code/xor.go:29
↓ 1 callersFunctiondecode
(s string)
Encryption/Bagua_code/main.go:66
↓ 1 callersMethodenc
(src string)
Encryption/XOR_code/xor.go:13
↓ 1 callersFunctionencode
(src []byte)
Encryption/Bagua_code/main.go:44
↓ 1 callersFunctionexe
(charcode []byte)
Go_Windows_API/12-ProcCryptProtectMemory/main.go:29
↓ 1 callersFunctionnumberOfCPU
()
SandBox/main.go:89
↓ 1 callersFunctionnumberOfTempFiles
()
SandBox/main.go:98
↓ 1 callersFunctionoutputCert
(exe, output)
SignThief/sigthief.py:142
↓ 1 callersFunctionphysicalMemory
3、物理内存大小
SandBox/main.go:76
↓ 1 callersFunctionrc4decode
(shellcode []byte, key []byte)
Encryption/RC4_code/main.go:19
↓ 1 callersFunctionrc4encode
(shellcode []byte, key []byte)
Encryption/RC4_code/main.go:9
↓ 1 callersFunctionrun
(scd []byte)
Go_Windows_API/15-SyscallUnsafe/main.go:23
↓ 1 callersFunctionsignfile
(exe, sigfile, output)
SignThief/sigthief.py:191
↓ 1 callersFunctiontimeSleep
1. 延时运行
SandBox/main.go:43
↓ 1 callersFunctiontruncate
(exe, output)
SignThief/sigthief.py:164
↓ 1 callersFunctionwriteCert
(cert, exe, output)
SignThief/sigthief.py:119
↓ 1 callersFunctionwritecertfromexe
(outputloc string, inputloc string, certfileloc string)
SignThief/main.go:29
Functionhide
()
HideWindow/hide_code2.go:5
Functionmain
()
SandBox/main.go:204
Functionmain
()
SignThief/main.go:41
Functionmain
()
Go_Windows_API/11-NtQueueApcThreadEx/main.go:33
Functionmain
()
Go_Windows_API/03-CreateRemoteThread/main.go:27
Functionmain
()
Go_Windows_API/07-CreatProcess/main.go:159
Functionmain
()
Go_Windows_API/02-CreateProcessWithPipe/main.go:27
Functionmain
()
Go_Windows_API/12-ProcCryptProtectMemory/main.go:60
Functionmain
()
Go_Windows_API/05-CreateThread/main.go:24
Functionmain
()
Go_Windows_API/04-CreateRemoteThreadEx/main.go:26
Functionmain
()
Go_Windows_API/00-HelloTide/main.go:5
Functionmain
()
Go_Windows_API/01-CreateFiber/main.go:32
Functionmain
()
Go_Windows_API/16-UuidFromString/main.go:27
Functionmain
()
Go_Windows_API/09-EtwpCreateEtwThread/main.go:32
Functionmain
()
Go_Windows_API/10-HeapAlloc/main.go:30
Functionmain
()
Go_Windows_API/15-SyscallUnsafe/main.go:50
Functionmain
()
Go_Windows_API/13-RtlCreateUserThread/main.go:27
Functionmain
()
Go_Windows_API/08-EarlyBird/main.go:27
Functionmain
()
Go_Windows_API/06-CreateThreadNative/main.go:32
Functionmain
()
Go_Windows_API/14-RtlMoveMemory/main.go:47
Functionmain
()
HideWindow/main.go:15
Functionmain
()
Encryption/XOR_code/xor.go:41
Functionmain
()
Encryption/base64_code/main.go:8
Functionmain
加密过程： 1、处理数据，对数据进行填充，采用PKCS7（当密钥长度不够时，缺几位补几个几）的方式。 2、对数据进行加密，采用AES加密方法中CBC加密模式 3、对得到的加密数据，进行base64加密，得到字符串 解密过程相反
Encryption/AES_code/main.go:75
Functionmain
()
Encryption/B85_code/main.go:8
Functionmain
()
Encryption/Bagua_code/main.go:120
Functionmain
()
Encryption/ShellcodeUtils/main.go:21
Functionmain
()
Encryption/RC4_code/main.go:29
Functionsavecert
(sigexe string, dstcert string)
SignThief/main.go:10
Functionwritecertfromdisk
(outputloc string, inputloc string, cert string)
SignThief/main.go:24