Benign Download

resolve.go

Imports Go's unsafe packageConverts a Go pointer through unsafe.Pointer

SHA-25657fdd0b87daa6bfb856f4692c980912fe51f63090ba22d5ff6d70d5fac50b27e

Evidence

Imports Go's unsafe package lines 1–21

⋯5 lines
6	"fmt"
7	"os"
8	"unsafe"
9)
10
⋯6 lines
17
18func GetModuleBase(moduleName string) (uintptr, error) {
19	peb := (*[64]byte)(unsafe.Pointer(ReadGSBase()))
20	ldrOffset := uint64(0x18)
21	ldr := *(**byte)(unsafe.Pointer(uintptr(unsafe.Pointer(peb)) + uintptr(ldrOffset)))

English function-word token "for" lines 27–31

48… unsafe.Pointer(ldr)) + uintptr(flinkOffset)))
28
for i := 0; i < 500; i++ {
entry := uintptr(unsafe.Pointer(ldr)) + uintptr(flinkOffset)
_ = ent …

English function-word token "with" lines 106–115

106:16… ddr, nil
107		}
108	}
109	return 0, fmt.Errorf("function with hash 0x%x not found", fnHash)
110}
111
⋯4 lines

English function-word token "the" lines 121–125

121:5… urn string(buf)
122}
123
124// findSyscallGadget locates the SysWhispers-style syscall;ret gadget (0F 05 C3) inside ntdll.
125func findSyscallGadget(base uintp …

Source names the ntdll.dll module lines 187–197

187:5… urn nil
188}
189
190func InitNtdll() error {
191	mod, err := GetModuleBase("ntdll.dll")
192	if err != nil {
193		return fmt.Errorf("get ntdll base: %w", err)
⋯4 lines