Malware Development in Go: Build a Shellcode Loader that Bypasses Windows Defender
Keywords
Summary
143 words
Critical Evaluation
Value of the Information & Strength of the Argument
The video provides valuable hands-on knowledge for malware development in Go, a less commonly covered language in this domain. The step-by-step approach allows viewers to follow along and replicate the techniques. The argumentation is based on practical demonstrations, such as showing Windows Defender detecting and deleting known malware, then building a loader that evades detection. However, the explanations are often superficial, lacking deep technical details on why certain API calls work or how to adapt the techniques to different scenarios. The author’s reasoning is clear but not rigorously supported by references to official documentation or academic sources.
106 words
Title / Content Match
The title accurately reflects the content: the video is a comprehensive tutorial on building a shellcode loader in Go that bypasses Windows Defender.
Quality & Reliability
7/10
The tutorial is practical and hands-on, with clear demonstrations. However, it lacks in-depth theoretical explanations and references to official documentation or academic sources. The content is based on the author's experience and may not cover all nuances or potential pitfalls.
Chapters
- Introduction & Mindset of a Whitehat
- Presenting the Course Lab
- Installing Go in Kali Linux
- Windows Defender Demonstration
- Creating Your First helloworld.exe
- Introduction to the Windows API
- Calling Windows API in Go (Method 1)
- Calling Windows API in Go (Method 2)
- Calling Windows API in Go (Method 3)
- Introduction to Shellcode
- Introduction to Loaders
- Steps to Bypass Windows Defender
- XORing the Shellcode
- Decrypting the Shellcode
- Allocating Memory with VirtualAlloc
- Other Methods of Memory Allocation
- Copying Shellcode into Process Memory
- Making Memory Executable
- Creating a Thread with CreateThread
- Other Thread Launching Techniques
- Building a Loader that Bypasses Defender
- Notes on Threat Intelligence
- End of Course
Cited Sources
- AllGoodTutorials Newsletter — Mentioned as a way to stay updated with the channel.
- AllGoodTutorials Supporters Page — Mentioned as a way to support the channel.
- AllGoodTutorials Subscribers Page — Mentioned as a way to subscribe to the channel.
- AllGoodTutorials Pricing Page — Mentioned for premium access to courses.
- AllGoodTutorials Videos Page — Mentioned as a collection of course videos.
- AllGoodTutorials Telegram — Mentioned as a social link.
- AllGoodTutorials Main Website — Mentioned as the main website for learning to code.
- AllGoodTutorials LinkedIn — Mentioned as a social link.
Concurring Sources
- Windows API documentation — Official documentation for Windows API functions used in the tutorial.
- Go documentation — Official Go documentation for language features and best practices.
- MITRE ATT&CK technique T1055 — Process injection technique, relevant to shellcode loading.
Contribution & Novelties
This video provides a practical, step-by-step tutorial on developing a shellcode loader in Go, which is a relatively niche topic. It demonstrates how to bypass Windows Defender using techniques like XOR encryption and direct Windows API calls. The main novelty is the use of Go for malware development, which is less common than C or C++. The tutorial is hands-on and includes live demonstrations, making it accessible to intermediate programmers.
Pour aller plus loin :
- Windows API documentation — Official documentation for Windows API functions like VirtualAlloc and CreateThread.
- Go documentation — Official Go documentation for language features and best practices.
- MITRE ATT&CK technique T1055 — Process injection technique, relevant to shellcode loading.
- msfvenom documentation — Official documentation for generating shellcode payloads.
122 words
Radar Profile
The radar profile shows high scores in quantity of information and technical level, indicating a detailed and technical tutorial. However, the quality of information and global reliability are slightly lower, reflecting the lack of external references and theoretical depth. The overall balance suggests a practical, hands-on resource that is valuable for learning but not fully rigorous.