* MetaData for 4.1 Key(16) | Charset1(2) | Charset2(2) | ID(4) | PID(4) | Port(2) | Flag(1) | Ver1(1) | Ver2(1) | Build(2) | PTR(4) | PTR_GMH(4) |

MakePacket make reply command, return AES encoded data

CS original impl, use goroutine is much easier, and this impl also can't solve the race condition in other goroutine func CheckDownload() { for i, do

but use this version will need to add two empty function for linux/darwin

dnsQueryTXT send dns TXT query

you should ensure x86 shellcode inject to x86 process

extract payload

implement of run and shell cmd

call windowsAPI CreateProcess, when it's cmd `shell`, %COMSPEC% will be the path and cmd run doesn't give path, as set path to null and args as comman

put some other windows function implement here temporary

it seems that some user custom plugins will use ExecAsm to inject dll, maybe because normal inject dll doesn't accept args? use Go to execute C#, and

IMPORTANT!!! charset is very important in beacon and server's communication because go handle string as utf8, so all use utf8 should be a better choic

charset, refer https://xz.aliyun.com/t/11055

just assume 64bit linux only run 64bit app

just return 0

put unsupported func in linux and darwin here

maybe use GO_ARCH to judge self process is a better choice? only consider some common arch now

TODO it seems this func didn't work

always remember to release handle

TODO calling createProcessWithLogonW will generate a strange error, maybe should try LogonUserA

as linux and darwin default use utf8, there is no need to handle them again

init system info here

init was called at beginning of the package

* Run this function should handler both `shell` and `run` cmd, need to return the result shell would send a payload like `%COMSPEC% /C cmd`,%COMSPEC