BananaPhone

KO | EN

gitlite — search

#typescript #ai-agents #ai #dsh-plugin #deepseek-harness #open-source #cli #claude-code #codex #developer-tools #react #windows

★ 532 Open GitHub ↗

It's a go variant of Hells gate! (directly calling windows kernel functions, but from Go!)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# BananaPhone

[![Go Reference](https://pkg.go.dev/badge/github.com/C-Sto/BananaPhone.svg)](https://pkg.go.dev/github.com/C-Sto/BananaPhone/pkg/BananaPhone)

Like hells gate, but more go, more banana.

Useful references:
- https://github.com/am0nsec/HellsGate
- https://www.cyberbit.com/blog/endpoint-security/malware-mitigation-when-direct-system-calls-are-used/

This is a pure-go implementation of using direct syscalls to do Windowsy stuff. Don't be silly and try this on not-Windows, it won't work and I honestly don't know why you'd even think it would?

**API not yet stable, vendor your shit properly. Sorry in advance if I push changes that break your malware :)**

Several useful functions in dealing with process things are provided by this lib. Namely:
- `Syscall` with a provided `sysid` and `uintptr`s to parameters, you're able to do a Windows syscall for pretty much any defined kernel call. I only tried with a handful, but it should work with any/most.
- `GetPEB` return the memory location of the PEB without performing any API calls. At it's core, just does this: `MOVQ 0x60(GS), AX ; MOVQ AX, ret+0(FP)`(this is the Go ASM syntax, incase you're confused.)
- `GetNtdllStart` return the start address of ntdll loaded in process memory. Does not make any API calls (see asm_x64.s for details)
- `WriteMemory` take a byte slice, and write it to a certain memory address (may panic if not writable etc lol)
- ~A handful of predefined kernel calls like `NtAllocateVirtualMemory` etc. See source for more details and whatnot.~
- A direct version of `mkwinsyscall` (`mkdirectwinsyscall`in the cmd dir) which should make it easy for you to resolve and use syscalls, and now I don't have to support them :).
- Halo's gate implementation by @nodauf
- When using auto mode, BananaPhone will first try to get the syscall ID from memory using the exported function name, then fail over to Halo's Gate, then Fail over to reading ntdll from disk. The Disk read is *not* done with any MapViewOfSection functions, so detection must be conducted using handles to the ntdll file.

All of the PE parsing and extraction of interesting information is provided by https://github.com/Binject/debug, which adds on to the stdlib `pe` library in some very cool ways.

# Usage

See examples in `example/`.

See mkdirectwinsyscall readme in `cmd/mkdirectwinsyscall`, and example of use in `example`.

# Why

Here is an example I posted into a slack chan recently:

```
...
var (
	modntdll = windows.NewLazySystemDLL("ntdll.dll")
	ntapi    = modntdll.NewProc("NtCreateThreadEx")
)
...
	ntapi.Call(0, 1, 1, 1, 1)
	var x *uintptr
	bananaphone.NtCreateThreadEx(createthread, x, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2)
	ntapi.Call(0, 3, 3, 3, 3)
 ```
![image showing api monitor output](https://raw.githubusercontent.com/C-Sto/BananaPhone/master/img/apiMonitor.png)
  
  What you're looking at is the output of API Monitor, which can be used to track a program's API calls. Each function was called with some easy to identify values (all 1's as a parameter, all 2's etc). What this shows is that the call made by `bananaphone.NtCreateThreadEx` is not captured by API Monitor, and any AV/EDR that uses similar methods probably won't catch it either. Neat.

BananaPhone

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README