{"id":13573481,"url":"https://github.com/f1zm0/acheron","last_synced_at":"2025-04-06T07:15:31.584Z","repository":{"id":155149172,"uuid":"624821707","full_name":"f1zm0/acheron","owner":"f1zm0","description":"indirect syscalls for AV/EDR evasion in Go assembly","archived":false,"fork":false,"pushed_at":"2023-06-13T19:20:33.000Z","size":340,"stargazers_count":325,"open_issues_count":3,"forks_count":38,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-03-30T06:08:47.059Z","etag":null,"topics":["adversary-emulation","assembly","av-evasion","edr-bypass","edr-evasion","evasion","go","golang","malware-research","offensive-security","red-team","red-teaming"],"latest_commit_sha":null,"homepage":"","language":"Assembly","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/f1zm0.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-04-07T10:40:33.000Z","updated_at":"2025-03-29T18:59:48.000Z","dependencies_parsed_at":null,"dependency_job_id":"0dcf8788-aa7f-4e96-a187-a2d7e8394fbc","html_url":"https://github.com/f1zm0/acheron","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/f1zm0%2Facheron","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/f1zm0%2Facheron/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/f1zm0%2Facheron/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/f1zm0%2Facheron/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/f1zm0","download_url":"https://codeload.github.com/f1zm0/acheron/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247445682,"owners_count":20939961,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["adversary-emulation","assembly","av-evasion","edr-bypass","edr-evasion","evasion","go","golang","malware-research","offensive-security","red-team","red-teaming"],"created_at":"2024-08-01T15:00:36.764Z","updated_at":"2025-04-06T07:15:31.548Z","avatar_url":"https://github.com/f1zm0.png","language":"Assembly","funding_links":[],"categories":["Assembly"],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n    \u003cimg src=\".github/readme_banner.png\" title=\"acheron banner\" width=\"55%\"/\u003e\n\u003c/p\u003e\n\u003cp align=\"center\"\u003e\n    \u003ca href=\"https://github.com/f1zm0/acheron/releases\"\u003e\u003cimg alt=\"latest release version\" src=\"https://img.shields.io/github/v/release/f1zm0/acheron?color=5c5c5c\u0026logo=github\u0026logoColor=white\u0026labelColor=2b2c34\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://pkg.go.dev/github.com/f1zm0/acheron\"\u003e\u003cimg src=\"https://pkg.go.dev/badge/github.com/f1zm0/acheron.svg\" alt=\"Go Reference\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://goreportcard.com/report/github.com/f1zm0/acheron\"\u003e\u003cimg src=\"https://goreportcard.com/badge/github.com/f1zm0/acheron#a\" alt=\"Go Report Card\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://github.com/f1zm0/acheron\"\u003e\u003cimg src=\"https://img.shields.io/github/license/f1zm0/acheron?color=5c5c5c\u0026logo=bookstack\u0026logoColor=white\u0026labelColor=2b2c34\" alt=\"project license\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://github.com/f1zm0/acheron/issues\"\u003e\u003cimg alt=\"Issues\" src=\"https://img.shields.io/github/issues/f1zm0/acheron?logo=dependabot\u0026color=5c5c5c\u0026logoColor=d9e0ee\u0026labelColor=2b2c34\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://twitter.com/f1zm0\" target=\"_blank\"\u003e\u003cimg alt=\"Twitter Follow\" src=\"https://img.shields.io/badge/Twitter-00acee?logo=twitter\u0026logoColor=white\"\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n## About\n\nAcheron is a library inspired by [SysWhisper3](https://github.com/klezVirus/SysWhispers3)/[FreshyCalls](https://github.com/crummie5/FreshyCalls)/[RecycledGate](https://github.com/thefLink/RecycledGate), with most of the functionality implemented in Go assembly. \u003c/br\u003e\n\n`acheron` package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and [instrumentation callbacks](https://winternl.com/detecting-manual-syscalls-from-user-mode/) to detect anomalous syscalls that don't return to ntdll.dll, when the call transition back from kernel-\u003euserland.\n\n## Main Features\n\n- No dependencies\n- Pure Go and Go assembly implementation\n- Custom string encryption/hashing function support to counter static analysis\n\n## How it works\n\nThe following steps are performed when creating a new syscall proxy instance:\n\n1. Walk the PEB to retrieve the base address of in-memory ntdll.dll\n2. Parse the exports directory to retrieve the address of each exported function\n3. Calculate the system service number for each `Zw*` function\n4. Enumerate unhooked/clean `syscall;ret` gadgets in ntdll.dll, to be used as trampolines\n5. Creates the proxy instance, which can be used to make indirect (or direct) syscalls\n\n## Quickstart\n\nIntegrating `acheron` into your offsec tools is pretty easy. You can install the package with:\n\n```sh\ngo get -u github.com/f1zm0/acheron\n```\n\nThen just need to call `acheron.New()` to create a syscall proxy instance and use `acheron.Syscall()` to make an indirect syscall for `Nt*` APIs.\n\nMinimal example:\n\n```go\npackage main\n\nimport (\n    \"fmt\"\n    \"unsafe\"\n\n    \"github.com/f1zm0/acheron\"\n)\n\nfunc main() {\n    var (\n        baseAddr uintptr\n        hSelf = uintptr(0xffffffffffffffff)\n    )\n\n    // creates Acheron instance, resolves SSNs, collects clean trampolines in ntdll.dlll, etc.\n    ach, err := acheron.New()\n    if err != nil {\n        panic(err)\n    }\n\n    // indirect syscall for NtAllocateVirtualMemory\n    s1 := ach.HashString(\"NtAllocateVirtualMemory\")\n    if retcode, err := ach.Syscall(\n        s1,                                     // function name hash\n        hSelf,                                  // arg1: _In_     HANDLE ProcessHandle,\n        uintptr(unsafe.Pointer(\u0026baseAddr)),     // arg2: _Inout_  PVOID *BaseAddress,\n        uintptr(unsafe.Pointer(nil)),           // arg3: _In_     ULONG_PTR ZeroBits,\n        0x1000,                                 // arg4: _Inout_  PSIZE_T RegionSize,\n        windows.MEM_COMMIT|windows.MEM_RESERVE, // arg5: _In_     ULONG AllocationType,\n        windows.PAGE_EXECUTE_READWRITE,         // arg6: _In_     ULONG Protect\n    ); err != nil {\n        panic(err)\n    }\n    fmt.Printf(\n        \"allocated memory with NtAllocateVirtualMemory (status: 0x%x)\\n\",\n        retcode,\n    )\n\n    // ...\n}\n```\n\n## Examples\n\nThe following examples are included in the repository:\n\n| Example                                       | Description                                                                                |\n| --------------------------------------------- | ------------------------------------------------------------------------------------------ |\n| [sc_inject](examples/sc_inject)               | Extremely simple process injection PoC, with support for both direct and indirect syscalls |\n| [process_snapshot](examples/process_snapshot) | Using indirect syscalls to take process snapshots with syscalls                            |\n| [custom_hashfunc](examples/custom_hashfunc)   | Example of custom encoding/hashing function that can be used with acheron                  |\n\nOther projects that use `acheron`:\n\n- [hades](https://github.com/f1zm0/hades)\n\n## Contributing\n\nContributions are welcome! Below are some of the things that it would be nice to have in the future:\n\n- [ ] 32-bit support\n- [ ] Other resolver types (e.g. HalosGate/TartarusGate)\n- [ ] More examples\n\nIf you have any suggestions or ideas, feel free to open an issue or a PR.\n\n## References\n\n- [Golang UK Conference 2016 - Michael Munday - Dropping Down Go Functions in Assembly](https://www.youtube.com/watch?v=9jpnFmJr2PE\u0026t=1s)\n- https://github.com/am0nsec/HellsGate\n- https://sektor7.net/#!res/2021/halosgate.md\n- https://github.com/trickster0/TartarusGate\n- https://github.com/klezVirus/SysWhispers3\n- https://github.com/crummie5/FreshyCalls\n- https://github.com/boku7/AsmHalosGate\n- https://github.com/thefLink/RecycledGate\n- https://github.com/C-Sto/BananaPhone\n- https://winternl.com/detecting-manual-syscalls-from-user-mode/\n- https://www.usenix.org/legacy/events/vee06/full_papers/p154-bhansali.pdf\n- https://redops.at/en/blog/direct-syscalls-a-journey-from-high-to-low\n\n## Additional Notes\n\nThe name is a reference to the [Acheron](https://en.wikipedia.org/wiki/Acheron) river in Greek mythology, which is the river where souls of the dead are carried to the underworld.\n\n\u003e **Note** \u003c/br\u003e\n\u003e This project uses [semantic versioning](https://semver.org/). Minor and patch releases should not break compatibility with previous versions. Major releases will only be used for major changes that break compatibility with previous versions.\n\n\u003e **Warning** \u003c/br\u003e\n\u003e This project has been created for educational purposes only. Don't use it to on systems you don't own. The developer of this project is not responsible for any damage caused by the improper usage of the library.\n\n## License\n\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ff1zm0%2Facheron","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ff1zm0%2Facheron","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ff1zm0%2Facheron/lists"}