BananaPhone - GitLite

KO | EN

gitlite — search

#javascript #python #react #ai #go #rust #windows #cli #awesome-list #vue #security #openai #ios #open-source

BananaPhone

(★ 532)

It's a go variant of Hells gate! (directly calling windows kernel functions, but from Go!)

파일 탐색기

최종 버전 다운로드 (.zip)

- - bug_report.md
  - feature_request.md
- - function.go
  - mkdirectsyscall.go
  - ntstatus.go
  - oldsrcTemplate.go
  - params.go
  - readme.md
  - rets.go
  - source.go
  - srcTemplate.go
- - main.go
- - main.go
- - main.go
  - syscall.go
- - main.go
- - main.go
- - main.go
- - main.go
- apiMonitor.png
- - asm_x64.s
  - bananaphone.go
  - functions.go
  - internal.go
  - ldr.go
go.mod
go.sum
LICENSE
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/C-Sto/BananaPhone

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd BananaPhone

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Go

보통 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Go Go 언어 컴파일러 및 도구 모음입니다.

go build ./...

Go 프로그램을 컴파일해 실행 파일을 만듭니다.

go run .

따로 빌드하지 않고 바로 Go 프로그램을 실행합니다.

✅ 빌드가 에러 없이 끝나면 성공입니다. go run . 을 썼다면 터미널 출력을 확인하세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# BananaPhone

[![Go Reference](https://pkg.go.dev/badge/github.com/C-Sto/BananaPhone.svg)](https://pkg.go.dev/github.com/C-Sto/BananaPhone/pkg/BananaPhone)

Like hells gate, but more go, more banana.

Useful references:
- https://github.com/am0nsec/HellsGate
- https://www.cyberbit.com/blog/endpoint-security/malware-mitigation-when-direct-system-calls-are-used/

This is a pure-go implementation of using direct syscalls to do Windowsy stuff. Don't be silly and try this on not-Windows, it won't work and I honestly don't know why you'd even think it would?

**API not yet stable, vendor your shit properly. Sorry in advance if I push changes that break your malware :)**

Several useful functions in dealing with process things are provided by this lib. Namely:
- `Syscall` with a provided `sysid` and `uintptr`s to parameters, you're able to do a Windows syscall for pretty much any defined kernel call. I only tried with a handful, but it should work with any/most.
- `GetPEB` return the memory location of the PEB without performing any API calls. At it's core, just does this: `MOVQ 0x60(GS), AX ; MOVQ AX, ret+0(FP)`(this is the Go ASM syntax, incase you're confused.)
- `GetNtdllStart` return the start address of ntdll loaded in process memory. Does not make any API calls (see asm_x64.s for details)
- `WriteMemory` take a byte slice, and write it to a certain memory address (may panic if not writable etc lol)
- ~A handful of predefined kernel calls like `NtAllocateVirtualMemory` etc. See source for more details and whatnot.~
- A direct version of `mkwinsyscall` (`mkdirectwinsyscall`in the cmd dir) which should make it easy for you to resolve and use syscalls, and now I don't have to support them :).
- Halo's gate implementation by @nodauf
- When using auto mode, BananaPhone will first try to get the syscall ID from memory using the exported function name, then fail over to Halo's Gate, then Fail over to reading ntdll from disk. The Disk read is *not* done with any MapViewOfSection functions, so detection must be conducted using handles to the ntdll file.

All of the PE parsing and extraction of interesting information is provided by https://github.com/Binject/debug, which adds on to the stdlib `pe` library in some very cool ways.

# Usage

See examples in `example/`.

See mkdirectwinsyscall readme in `cmd/mkdirectwinsyscall`, and example of use in `example`.

# Why

Here is an example I posted into a slack chan recently:

```
...
var (
	modntdll = windows.NewLazySystemDLL("ntdll.dll")
	ntapi    = modntdll.NewProc("NtCreateThreadEx")
)
...
	ntapi.Call(0, 1, 1, 1, 1)
	var x *uintptr
	bananaphone.NtCreateThreadEx(createthread, x, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2)
	ntapi.Call(0, 3, 3, 3, 3)
 ```
![image showing api monitor output](https://raw.githubusercontent.com/C-Sto/BananaPhone/master/img/apiMonitor.png)
  
  What you're looking at is the output of API Monitor, which can be used to track a program's API calls. Each function was called with some easy to identify values (all 1's as a parameter, all 2's etc). What this shows is that the call made by `bananaphone.NtCreateThreadEx` is not captured by API Monitor, and any AV/EDR that uses similar methods probably won't catch it either. Neat.