$ show paokuwansui/Antivirus_killer
This repository is an antivirus evasion toolkit designed to help bypass security detection through various techniques. It provides tools to encrypt shellcode using XOR and Base64 encoding, along with loaders that decrypt and execute the payload in memory while implementing anti-analysis checks. The toolkit has evolved over time with versions in C, Nim, and C++, showing progressively more sophisticated evasion techniques including API hooking, memory patching, string obfuscation, and cryptographic payload protection. The code demonstrates understanding of Windows internals and offensive security techniques.
The LLM identified 4 files worth highlighting for reuse:
This module implements Windows defense evasion techniques by patching ETW (Event Tracing for Windows) and AMSI (Antimalware Scan Interface) in memory, and unhooking ntdll.dll to remove EDR hooks. These are isolated functions that could be reused in other projects needing to bypass Windows security monitoring. The implementation demonstrates skill in Windows internals, memory manipulation, and API hooking.
This module implements a multi-layer decryption scheme combining Base85 decoding, RC4 decryption (with 1024-byte drop), and zlib decompression. It also includes innovative segment reversal based on DJB2 hash of the key for additional obfuscation. The decryption pipeline is self-contained and could be extracted for use in other projects needing stealthy payload decryption. The combination of techniques shows cryptographic engineering skill.
This file implements sophisticated API hooking of VirtualAlloc and Sleep functions, combined with vectored exception handling to dynamically change memory page protections. It creates a beacon that tracks memory allocations and uses a separate thread to immediately change allocated memory to PAGE_NOACCESS when certain events occur. This demonstrates advanced Windows internals knowledge and stealth techniques that could be adapted for other security evasion or protection projects.
The code uses a technique where strings are obfuscated by XORing each character with 0x0A, then reconstructed at runtime using helper functions like extract_every_fourth(). This makes static analysis more difficult as strings don't appear in plaintext in the binary. The obfuscation/deobfuscation logic is isolated in inline functions and could be reused for protecting strings in other applications.