Go implementation of the Heaven's Gate technique

Overview

Gopher Heaven

All gophers go to heaven

gopherheaven is a Go implementation of the classic Heaven's Gate technique originally published by roy g biv on VX Heaven in 2009. gopherheaven can be used as an evasion technique to directly call 64-bit code from a 32-bit process.

@C-Sto already went to Go hell 😈 , but @aus went to heaven. 😇

Usage

If you are familiar with GetModuleHandle, GetProcAddress, and Syscall on Windows, the process is largely the same. See examples/ directory for more. The following example shows invoking 64-bit NtReadVirtualMemory

ntdll, err := heaven.GetModuleHandle("ntdll.dll")
if err != nil {
  log.Fatal(err)
}

fn, err := heaven.GetProcAddress(ntdll, "NtReadVirtualMemory")
if err != nil {
  log.Fatal(err)
}

h := (uint64)(heaven.GetSelfHandle())
i := 6
b := 3
var read uint64

errcode, err := heaven.Syscall(
  fn,
  h, 
  uint64(uintptr(unsafe.Pointer(&i))),
  uint64(uintptr(unsafe.Pointer(&b))),
  4,
  uint64(uintptr(unsafe.Pointer(&read)))
)

Build

Make sure your architecture is set to GOARCH=386 and that you are executing on x64 Windows system. gopherheaven does not currently support what I call reverse Heaven's Gate (executing 32-bit code from a 64-bit process).

Background

There's already alot of great publications on Heaven's Gate, so I will just you defer to these resources:

Why

I asked myself several times.

Other References

You might also like...
Sliding window counters Redis rate limiting implementation for Golang

Sliding window counters Redis rate limiting implementation for Golang (Based on the Figma API rate limit algorithm)

Implementation for validating the NZ COVID Pass.

NZCP validator Validates NZCP passes according to https://nzcp.covid19.health.nz. Example See example_test.go and tests for more examples. func Exampl

Generic Free List implementation to reuse memory and avoid allocations

gofl GOFL provides a Generic Free List implementation for Go. Installation This

A pure Golang implementation of Rockchip rknand vendor storage interface.

go-rkvendorstorage A pure Golang implementation of Rockchip rknand vendor storage interface. Usage package main import ( "fmt" "github.com/jamesits

yaml-patch is a version of Evan Phoenix's json-patch, which is an implementation of JSON Patch, directly transposed to YAML

yaml-patch yaml-patch is a version of Evan Phoenix's json-patch, which is an implementation of JavaScript Object Notation (JSON) Patch, directly trans

Golang 1.18+ Generics implementation of Set methods

Golang Generics: Set A golang 1.18+ implementation of Set using Go generics Installation $ go get -u github.com/chrispappas/golang-generics-set Quick

gatews - Gate.io WebSocket SDK

gatews - Gate.io WebSocket SDK gatews provides new Gate.io WebSocket V4 implementations. It is intended to work along with gateapi-* series to provide

Decoder/Encoder for GhostControls Gate Remotes

ghostcontrols Decoder/Encoder for GhostControls Gate Remotes GhostControls makes a variety of automatic gate operators, transmitters and keypads & rec

A faster RWLock primitive in Go, 2-3 times faster than RWMutex. A Go implementation of concurrency control algorithm in paper Left-Right - A Concurrency Control Technique with Wait-Free Population Oblivious Reads

Go Left Right Concurrency A Go implementation of the left-right concurrency control algorithm in paper Left-Right - A Concurrency Control Technique w

Focus is a fully featured productivity timer for the command line, based on the Pomodoro Technique. Supports Linux, Windows, and macOS.
Focus is a fully featured productivity timer for the command line, based on the Pomodoro Technique. Supports Linux, Windows, and macOS.

Focus is a cross-platform productivity timer for the command line. It is based on the Pomodoro Technique, a time management method developed by Francesco Cirillo in the late 1980s.

Book-API was made using Golang and PostgreSQL with technique CRUD with mux and pq

Book-API CRUD with PostgreSQL Table of contents 👀 General info Technologies Blog Setup General info BAPI or Book-API is a Golang REST API made to sho

ms - 'my story' creates a secure password string which can be memorized with a technique shared by Max.

On 23.12.21 20:22, Stefan Claas wrote: [...] Yes, I am aware of that, but how can one memorize a key when traveling and not taking any devices

A demo of using Go channels as a function composition technique.

Channels Example This is a Go program containing functions that consume and produce channels. I think this is potentially a nicer API shape than e.g.

FunctionStomping (using golang) : A new shellcode injection technique.
FunctionStomping (using golang) : A new shellcode injection technique.

goFunctionStomping FunctionStomping using golang Description This is a brand-new technique for shellcode injection to evade AVs and EDRs. This techniq

Go language implementation of a blockchain based on the BDLS BFT protocol. The implementation was adapted from Ethereum and Sperax implementation

BDLS protocol based PoS Blockchain Most functionalities of this client is similar to the Ethereum golang implementation. If you do not find your quest

CVE-2021-4034 - A Golang implementation of clubby789's implementation of CVE-2021-4034

CVE-2021-4034 January 25, 2022 | An00bRektn This is a golang implementation of C

An implementation of JOSE standards (JWE, JWS, JWT) in Go

Go JOSE Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. This includes support for JSO

goRBAC provides a lightweight role-based access control (RBAC) implementation in Golang.

goRBAC goRBAC provides a lightweight role-based access control implementation in Golang. For the purposes of this package: * an identity has one or mo

This is an implementation of JWT in golang!

jwt This is a minimal implementation of JWT designed with simplicity in mind. What is JWT? Jwt is a signed JSON object used for claims based authentic

Owner
aus
aus
ms - 'my story' creates a secure password string which can be memorized with a technique shared by Max.

On 23.12.21 20:22, Stefan Claas wrote: [...] > > Yes, I am aware of that, but how can one memorize a key when traveling > and not taking any devices

Stefan Claas 0 Dec 24, 2021
go implementation of timsort

timsort timsort is a Go implementation of Tim Peters's mergesort sorting algorithm. For many input types it is 2-3 times faster than Go's built-in sor

Philip Silva 77 Nov 7, 2022
Implementation of do255e and do255s in Go

Go Implementation of do255e and do255s This is a plain Go implementation of do255e and do255s. It is considered secure; all relevant functions should

null 23 Aug 15, 2022
Lightweight, Simple, Quick, Thread-Safe Golang Stack Implementation

stack Lightweight, Simple, Quick, Thread-Safe Golang Stack Implementation Purpose Provide a fast, thread safe, and generic Golang Stack API with minim

Brendan Wilson 5 May 3, 2022
Optimal implementation of ordered maps for Golang - ie maps that remember the order in which keys were inserted.

Goland Ordered Maps Same as regular maps, but also remembers the order in which keys were inserted, akin to Python's collections.OrderedDicts. It offe

Jean Rougé 240 Nov 20, 2022
An idiomatic Go implementation of Leaky bucket.

lbucket lbucket is an idiomatic Go leaky bucket implementation. The library make use of plain old Go stdlib; in other words, there are no third-party

Alex Rios 11 Apr 17, 2022
Go implementation of the geodesic routines from GeographicLib

geodesic This package is a Go implementation of the geodesic routines from GeographicLib. Features Pure Go implementation Distance calculations with n

Josh Baker 54 Nov 25, 2022
go-logr implementation with pterm

plogr go-logr implementation with pterm Usage See examples Add more colors and levels By default, only level 0 (info) and level 1 (debug) are supporte

Chris 4 Dec 22, 2021
Reference go implementation of globaldce protocol

globaldce-go This is the reference implementation of the command line interface of globaldce coded in the go programming language. This project is sti

globaldce 10 Nov 8, 2021
Go implementation Welford’s method for one-pass variance computation

Welford - Online method of calculating variance and standard deviation Go implementation Welford’s method for one-pass variance computation with D. H.

Axiom, Inc. 7 Jun 5, 2022