func UnhookNtdll() errorfunc DirectSyscall(functionName string, args ...uintptr) (uintptr, error)func DirectSyscallByHash(functionHash uint32, args ...uintptr) (uintptr, error)func GetCurrentProcessHandle() uintptrfunc GetCurrentThreadHandle() uintptrfunc GetCurrentProcessId() uintptrfunc GetSyscallNumber(functionName string) uint16func GetFunctionHash(functionName string) uint32func GetSyscallWithValidation(functionName string) (uint16, bool, error)func GuessSyscallNumber(functionName string) uint16func PrewarmSyscallCache() errorfunc GetSyscallCacheSize() intfunc GetSyscallCacheStats() map[string]interface{}func SelfDel()func StringToUTF16(s string) *uint16func NtAllocateVirtualMemory(...) (uintptr, error)func NtWriteVirtualMemory(...) (uintptr, error)func NtReadVirtualMemory(...) (uintptr, error)func NtProtectVirtualMemory(...) (uintptr, error)func NtCreateThreadEx(...) (uintptr, error)func NtOpenProcess(...) (uintptr, error)func NtClose(handle uintptr) (uintptr, error)func NtQuerySystemInformation(...) (uintptr, error)func NtQueryInformationProcess(...) (uintptr, error)func NtSetInformationProcess(...) (uintptr, error)func NtCreateFile(...) (uintptr, error)func NtWriteFile(...) (uintptr, error)func NtReadFile(...) (uintptr, error)func NtTerminateProcess(...) (uintptr, error)func NtSuspendProcess(processHandle uintptr) (uintptr, error)func NtResumeProcess(processHandle uintptr) (uintptr, error)func NtCreateProcess(...) (uintptr, error)func NtCreateThread(...) (uintptr, error)func NtOpenThread(...) (uintptr, error)func NtSuspendThread(...) (uintptr, error)func NtResumeThread(...) (uintptr, error)func NtTerminateThread(...) (uintptr, error)func NtCreateSection(...) (uintptr, error)func NtMapViewOfSection(...) (uintptr, error)func NtUnmapViewOfSection(...) (uintptr, error)func NtFreeVirtualMemory(...) (uintptr, error)func NtQueryVirtualMemory(...) (uintptr, error)func NtCreateKey(...) (uintptr, error)func NtOpenKey(...) (uintptr, error)func NtDeleteKey(keyHandle uintptr) (uintptr, error)func NtSetValueKey(...) (uintptr, error)func NtQueryValueKey(...) (uintptr, error)func NtDeleteValueKey(...) (uintptr, error)func NtOpenProcessToken(...) (uintptr, error)func NtOpenThreadToken(...) (uintptr, error)func NtQueryInformationToken(...) (uintptr, error)func NtSetInformationToken(...) (uintptr, error)func NtAdjustPrivilegesToken(...) (uintptr, error)func NtDuplicateObject(...) (uintptr, error)func NtQueryObject(...) (uintptr, error)func NtSetSystemInformation(...) (uintptr, error)func NtQuerySystemTime(systemTime *uint64) (uintptr, error)func NtSetSystemTime(...) (uintptr, error)func NtCreateEvent(...) (uintptr, error)func NtOpenEvent(...) (uintptr, error)func NtSetEvent(...) (uintptr, error)func NtResetEvent(...) (uintptr, error)func NtWaitForSingleObject(...) (uintptr, error)func NtWaitForMultipleObjects(...) (uintptr, error)func NtDeleteFile(objectAttributes uintptr) (uintptr, error)func NtQueryDirectoryFile(...) (uintptr, error)func NtQueryInformationFile(...) (uintptr, error)func NtSetInformationFile(...) (uintptr, error)func NtDeviceIoControlFile(...) (uintptr, error)func NtRemoveIoCompletion(...) (uintptr, error)func NtReleaseSemaphore(...) (uintptr, error)func NtReplyWaitReceivePort(...) (uintptr, error)func NtReplyPort(...) (uintptr, error)func NtSetInformationThread(...) (uintptr, error)func NtQueryInformationThread(...) (uintptr, error)func NtFlushInstructionCache(...) (uintptr, error)func NtSetEventBoostPriority(eventHandle uintptr) (uintptr, error)func NtQueryPerformanceCounter(...) (uintptr, error)func NtOpenThreadTokenEx(...) (uintptr, error)func NtOpenProcessTokenEx(...) (uintptr, error)func DumpAllSyscalls() ([]SyscallInfo, error)func DumpAllNtdllFunctions() ([]FunctionInfo, error)func PrewarmNtdllCache() errorfunc GetNtdllCacheSize() intfunc GetNtdllCacheStats() map[string]interface{}func ClearNtdllCache()func DumpAllSyscallsWithFiles() ([]SyscallInfo, error)func NtInjectSelfShellcode(shellcode []byte) errorfunc NtInjectRemote(processHandle uintptr, payload []byte) error
func IndirectSyscall(functionName string, args ...uintptr) (uintptr, error)func IndirectSyscallByHash(functionHash uint32, args ...uintptr) (uintptr, error)func SelfDelIndirect()func NtInjectSelfShellcodeIndirect(shellcode []byte) errorfunc OriginalNtInjectSelfShellcodeIndirect(payload []byte) errorfunc NtInjectRemoteIndirect(processHandle uintptr, payload []byte) error- (Provides indirect-call versions of all Nt functions, e.g.,
NtAllocateVirtualMemoryIndirect)*
func ScanPrivilegeEscalationVectors() (*PrivEscMap, error)func ScanWeakPermissions() ([]WeakPermission, error)func FindPrivilegedProcesses() ([]ProcessInfo, error)func ImpersonateAndExecute(targetProcess ProcessInfo, shellcode []byte) error
func ExploitBinaryPlanting(vectors []EscalationVector, options ExploitOptions) []ExploitResultfunc ExploitServiceReplacement(vectors []EscalationVector, options ExploitOptions) []ExploitResultfunc ExploitTaskScheduler(vectors []EscalationVector, options ExploitOptions) []ExploitResultfunc ExploitVectors(vectors []EscalationVector, options ExploitOptions) *ExploitSessionfunc AutoExploit(escMap *PrivEscMap, payload []byte, testMode bool) *ExploitSessionfunc GetExploitableVectors(escMap *PrivEscMap) []EscalationVector
func PatchAMSI() errorfunc PatchETW() errorfunc PatchDbgUiRemoteBreakin() errorfunc PatchNtTraceEvent() errorfunc PatchNtSystemDebugControl() errorfunc ApplyAllPatches() (successful []string, failed map[string]error)func ApplyCriticalPatches() (successful []string, failed map[string]error)func CreateRunKey() error
func GetHash(input string) uint32func GetHashW(input *uint16) uint32func GetWString(s string) *uint16
func HashSyscall(functionHash uint32, args ...uintptr) (r1, r2 uintptr, err error)func HashIndirectSyscall(functionHash uint32, args ...uintptr) (r1, r2 uintptr, err error)
func GetSyscallNumber(functionHash uint32) uint16func GetSyscallWithValidation(functionHash uint32) (uint16, bool, error)func GuessSyscallNumber(functionHash uint32) uint16func GetFunctionAddress(moduleBase uintptr, functionHash uint32) uintptrfunc GetModuleBase(moduleHash uint32) uintptrfunc PrewarmSyscallCache() errorfunc GetSyscallCacheSize() int
func UnhookNtdll() error
- provides various windows constants for memory, process/thread access, files, tokens, and other objects. also includes core data structures like
unicode_string,object_attributes, andprocess_basic_information.
this project provides a comprehensive toolkit for low-level windows interaction in go, focusing on direct and indirect syscall execution. it dynamically resolves syscall numbers by parsing ntdll.dll from memory, using djb2 hashing for function name obfuscation. this method avoids reliance on the standard library and makes it resilient to api hooking by user-mode edr solutions. the library includes functionality for memory operations, process and thread manipulation, token impersonation, and registry modification. it also features defensive capabilities such as amsi and etw patching, along with offensive modules for discovering and exploiting privilege escalation vectors like binary planting, service replacement, and task hijacking. the design emphasizes performance and operational security, with features like syscall caching, function pre-warming, and robust error handling.