Benign Download

etw.go

Imports Go's unsafe packageSource names ntdll virtual-memory syscall stubs

SHA-25657808cc1c8fa45479b577c257ee70a9cda22d10c9cc7e014d394484633496d51

Evidence

Imports Go's unsafe package lines 1–20

⋯5 lines
6	"fmt"
7	"syscall"
8	"unsafe"
9
10	"github.com/VoidSecSoftwares/voidsyscall/syscallwin"
11)
12
13func PatchETW() error {
14	handle, err := syscall.LoadLibrary("ntdll.dll")
15	if err != nil {
16		return fmt.Errorf("load ntdll: %w", err)
⋯4 lines

Converts a Go pointer through unsafe.Pointer lines 26–36

5…  oldProtect uint32
regionSize := uintptr(64)
err = syscallwin.NtProtectVirtualMemory(
uintptr(0xffffffffffffffff),
(*uintptr)(unsafe.Pointer(&baseAddr)),
&regionSize,
syscallwin.PAGE_EXECUTE_READWRITE,
⋯4 lines