This repository is an antivirus evasion toolkit designed to help bypass security detection through various techniques. It provides tools to encrypt shellcode using XOR and Base64 encoding, along with loaders that decrypt and execute the payload in memory while implementing anti-analysis checks. The toolkit has evolved over time with versions in C, Nim, and C++, showing progressively more sophisticated evasion techniques including API hooking, memory patching, string obfuscation, and cryptographic payload protection. The code demonstrates understanding of Windows internals and offensive security techniques.
GoPhantom is a Go-based Windows loader generator designed for security research. It creates executables that embed and decrypt payloads and decoy files while employing various evasion techniques to avoid detection. The application takes input files (decoy and payload), encrypts them, generates Go source code using templates that incorporate the encrypted data and selected security features, then compiles this code for Windows/amd64. The resulting executable can showcase the decoy file to the user while executing the payload through techniques like process injection, API hashing, direct syscalls, memory protection evasion, and module stomping to make malicious code appear as legitimate DLL code. The project is explicitly archived and no longer actively developed, as stated in the README.