-
ðŸ¸Frog For Automatic Scan
-
ðŸ¶Doge For Defense Evasion & Offensive Security
Doge-Gabh 是一个集æˆäº† Windows ntdll 动æ€è°ƒç”¨ã€ç›´æŽ¥ç³»ç»Ÿè°ƒç”¨ã€API hash 调用和 DLL 脱钩的 Golang 组件包。该项目æ供了多ç§åœ°ç‹±ä¹‹é—¨æ–¹æ³•ã€è„±é’©æ–¹æ³•ã€ç›´æŽ¥ç³»ç»Ÿè°ƒç”¨æ–¹æ³•å’ŒåŠ¨æ€ API hash 调用方法，使用户能够çµæ´»åœ°ä»Žç£ç›˜æˆ–内å˜ä¸è°ƒç”¨ç³»ç»Ÿ API。
Doge-Gabh is a Golang component package that integrates Windows ntdll dynamic calls, direct system calls, API hash calls, and DLL unhooking. This project provides various Hell's Gate methods, unhooking methods, direct system call methods, and dynamic API hash call methods, allowing users to flexibly call system APIs from disk or memory.
主è¦ç”¨é€”包括但ä¸é™äºŽï¼š Main uses include but are not limited to:
- PE è§£æž (PE parsing)
- åŠ¨æ€ API 调用 (Dynamic API calls)
- Shellcode åŠ è½½å™¨ (Shellcode loader)
- 进程注入 (Process injection)
- 绕过 API 挂钩 (Bypassing API hooks)
项目å称 Gabh 原æ„为 GetAddressByHash，åŽæ¥æ‰©å±•ä¸ºç±»ä¼¼ DInvoke 的动æ€è°ƒç”¨å·¥å…·åŒ…。
The project name Gabh originally stood for GetAddressByHash, later expanded to become a dynamic calling toolkit similar to DInvoke.
注æ„ï¼ 8000 šæœ¬å·¥å…·ä»…用于实现 API 调用。具体调用者实现的功能以åŠå¯èƒ½é€ æˆçš„å½±å“ä¸Žé¡¹ç›®æœ¬ä½“æ— å…³ã€‚
Note: This tool is only for implementing API calls. The specific functions implemented by the caller and any potential impacts are not related to the project itself.
-
集æˆå¤šç§åœ°ç‹±ä¹‹é—¨åŠå…¶è¡ç”Ÿé¡¹ç›®çš„ Golang 实现： Golang implementation of various Hell's Gate and its derivative projects:
- Hell's Gate
- Halo's Gate
- Tartaru's Gate
- Spoofing Gate
- Doge-EGGCall
- RecycledGate
-
é›†æˆ syswhisper 实现 Integrated syswhisper implementation
-
æ供多ç§èŽ·å–函数地å€å’Œç³»ç»Ÿè°ƒç”¨çš„方法： Provides various methods for obtaining function addresses and system calls:
- 通过 hash 从内å˜èŽ·å–å‡½æ•°åœ°å€ (Get function address from memory by hash)
- 通过 hash 从ç£ç›˜èŽ·å–å‡½æ•°åœ°å€ (Get function address from disk by hash)
- é‡æ˜ å°„ ntdll (Remap ntdll)
- 获å–é‡æ˜ å°„åŽçš„å‡½æ•°åœ°å€ (Get function address after remapping)
- Tartaru's Gate/Halo's Gate 调用 (Tartaru's Gate/Halo's Gate call)
- Spoofing-Gate
- 通用 ntdll èŽ·å– (Universal ntdll acquisition)
- 全 DLL 脱钩 (Full DLL unhooking)
- Perun's Fart 脱钩 ntdll (Perun's Fart ntdll unhooking)
- CMD 类型的全 DLL 脱钩 (CMD-type full DLL unhooking)
- Recycled Gate 调用 (Recycled Gate call)
- RefleXXion
- 代ç†è°ƒç”¨ (Proxy call)
go get github.com/timwhitez/Doge-Gabh
// 从内å˜ä¸é€šè¿‡ hash 获å–函数地å€
// Get function address from memory by hash
gabh.MemFuncPtr()
// 从ç£ç›˜ä¸é€šè¿‡ hash 获å–函数地å€
// Get function address from disk by hash
gabh.DiskFuncPtr()
// 获å–é‡æ˜ å°„çš„ ntdll
// Get remapped ntdll
gabh.ReMapNtdll()
// 获å–é‡æ˜ å°„åŽçš„函数地å€
// Get function address after remapping
GetFuncUnhook()
// ntdll Tartaru's Gate/Halo's Gate
gabh.MemHgate()
gabh.DiskHgate()
// Tartaru's Gate/Halo's Gate 调用系统 ID
// Tartaru's Gate/Halo's Gate call system ID
gabh.HgSyscall()
// EGG 替æ¢
// EGG replacement
eggreplace.FindAndReplace()
// Tartaru's Gate/Halo's Gate 调用系统 ID（更多 EGG）
// Tartaru's Gate/Halo's Gate call system ID (more EGG)
gabh.EggCall()
// Spoofing-Gate
gabh.SpfGate()
// 获å–通用 ntdll
// Get universal ntdll
gabh.Universal()
// 获å–通用函数地å€
// Get universal function address
UniversalFindProc()
// 全 DLL 脱钩
// Full DLL unhooking
gabh.FullUnhook()
// Perun's Fart 脱钩 ntdll
// Perun's Fart ntdll unhooking
gabh.PerunsFart()
// CMD 类型的全 DLL 脱钩
// CMD-type full DLL unhooking
gabh.CMDUnhook()
// èŽ·å– syscall;ret
// Get syscall;ret
gabh.GetRecyCall()
// Recycled Gate 调用
// Recycled Gate call
gabh.ReCycall()
// åˆå§‹åŒ– DW_SYSCALL_LIST
// Initialize DW_SYSCALL_LIST
var newWhisper = gabh.DWhisper()
// 从 DW_SYSCALL_LIST 获å–系统 ID
// Get system ID from DW_SYSCALL_LIST
sysid := newWhisper.GetSysid("4942059d")
// RefleXXion
gabh.KDllunhook()
// 通过åç§°èŽ·å– SSN（排除æŸäº›æƒ…况）
// Get SSN by name (excluding certain cases)
gabh.GetSSNByNameExcept()
// 代ç†è°ƒç”¨
// Proxy call
proxycall.ProxyCall()项目的 example 文件夹ä¸åŒ…å«äº†å¤šä¸ªä½¿ç”¨ç¤ºä¾‹ï¼Œæ¶µç›–了å„ç§åŠŸèƒ½çš„调用方法。以下是一个基本的使用示例：
The example folder in the project contains multiple usage examples covering various function call methods. Here's a basic usage example:
package main
import (
"fmt"
"syscall"
"unsafe"
gabh "github.com/timwhitez/Doge-Gabh/pkg/Gabh"
)
func main() {
// 使用 Universal 方法获å–函数指针
// Use Universal method to get function pointer
ntdll, _ := gabh.Universal(str2sha1)
sleep, _ := ntdll.UniversalFindProc("84804f99e2c7ab8aee611d256a085cf4879c4be8")
fmt.Printf("Universal Addr:0x%x\n", sleep)
fmt.Println("Sleep for 3s")
times := -(3000 * 10000)
syscall.Syscall(sleep, 2, 0, uintptr(unsafe.Pointer(×)), 0)
// 使用 MemFuncPtr 通过 hash 获å–函数指针
// Use MemFuncPtr to get function pointer by hash
sleep_ptr, moduleN, err := gabh.MemFuncPtr("kernel32.dll", "c3ca5f787365eae0dea86250e27d476406956478", str2sha1)
if err != nil {
fmt.Println(err)
return
}
fmt.Printf("%s: %x\n", moduleN, sleep_ptr)
syscall.Syscall(uintptr(sleep_ptr), 1, 1000, 0, 0)
// 使用 HellsGate 获å–系统调用 ID
// Use HellsGate to get system call ID
sleep1, e := gabh.DiskHgate("84804f99e2c7ab8aee611d256a085cf4879c4be8", str2sha1)
if e != nil {
panic(e)
}
fmt.Printf("%s: %x\n", "NtDelayExecution Sysid", sleep1)
// 使用 HellsGate 进行系统调用
// Use HellsGate for system call
gabh.HgSyscall(sleep1, 0, uintptr(unsafe.Pointer(×)))
}
// 辅助函数：将å—符串转æ¢ä¸º SHA1 哈希
// Helper function: Convert string to SHA1 hash
func str2sha1(s string) string {
// 实现略 (Implementation omitted)
}更多详细示例请å‚考项目的 example 文件夹。
For more detailed examples, please refer to the example folder in the project.
pkg/: æ ¸å¿ƒåŠŸèƒ½åŒ… (Core function package)example/: 使用示例 (Usage examples)- CMDUnhook
- EggCall
- FullUnhook
- GetSSNExcept
- KnownDllunhook
- PerunsFart
- ProxyCall
- RecycledGate
- SpfGate
- Unhook_remap
- UniversalLoad
- Whisper
- shellcodecalc
- sleep
- testhook
- Doge-ReMap
- Load NTDLL Too
- Binject/debug
- BananaPhone
- Binject/universal
- TartarusGate
- Perun's Fart
- UserModeUnhooking
- Spoofing-Gate
- NoSysWhisper
- SysWhispers3
- RecycledGate
- Doge-RecycledGate
- Doge-Whisper
- Freshycalls
- SysWhispers2
- Bypassing User Mode Hooks and Direct Invocation of System Calls for Red Teams
æ„Ÿè°¢ JetBrains 为 Doge-Gabh 项目æä¾› Goland IDE å¼€æºè®¸å¯è¯ã€‚ Thanks to JetBrains for providing the Goland IDE open source license for the Doge-Gabh project.
本项目仅供å¦ä¹ å’Œç ”ç©¶ä½¿ç”¨ã€‚ä½¿ç”¨è€…åº”å½“éµå®ˆæ‰€æœ‰é€‚用的法律法规，ä¸å¾—将本项目用于任何éžæ³•ç›®çš„。作者对使用者的任何行为ä¸æ‰¿æ‹…任何责任。
This project is for learning and research purposes only. Users should comply with all applicable laws and regulations and must not use this project for any illegal purposes. The author bears no responsibility for any actions taken by users.