EDR went "FAGGOT DETECTED" on me once (#17) #54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [master] | |
| pull_request: | |
| branches: [master] | |
| jobs: | |
| test: | |
| strategy: | |
| matrix: | |
| dotnet: ['9.0', '10.0'] | |
| arch: [x86_64, aarch64] | |
| include: | |
| - arch: x86_64 | |
| runner: ubuntu-latest | |
| zig-target: x86_64-linux-gnu | |
| - arch: aarch64 | |
| runner: ubuntu-24.04-arm | |
| zig-target: aarch64-linux-gnu | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: ${{ matrix.dotnet }}.x | |
| - name: Setup Zig | |
| uses: mlugg/setup-zig@v2 | |
| with: | |
| version: 0.16.0 | |
| - name: Build | |
| run: >- | |
| zig build | |
| -Dtarget=${{ matrix.zig-target }} | |
| -Doptimize=ReleaseFast | |
| -Dinjector-optimize=ReleaseSmall | |
| --prefix bin | |
| - name: Build payload | |
| run: dotnet build Hauyne.Payload -c Release -p:TargetFramework=net${{ matrix.dotnet }} --nologo | |
| - name: Build victim | |
| run: dotnet build Hauyne.Victim -c Release -p:TargetFramework=net${{ matrix.dotnet }} --nologo | |
| - name: Configure ptrace | |
| run: | | |
| echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope | |
| ulimit -c unlimited | |
| echo '/tmp/core.%p' | sudo tee /proc/sys/kernel/core_pattern | |
| - name: Start victim | |
| run: | | |
| rm -f /tmp/Hauyne.txt /tmp/hauyne-victim.pid | |
| dotnet exec Hauyne.Victim/bin/Release/net${{ matrix.dotnet }}/Hauyne.Victim.dll & | |
| sleep 3 | |
| echo "VICTIM_PID=$(cat /tmp/hauyne-victim.pid)" >> $GITHUB_ENV | |
| echo "Victim PID: $(cat /tmp/hauyne-victim.pid) (net${{ matrix.dotnet }})" | |
| - name: Inject payload | |
| run: | | |
| HAUYNE_DEBUG=1 ./bin/Hauyne.Injector "$VICTIM_PID" "$PWD/bin/net${{ matrix.dotnet }}/Hauyne.Payload.dll" | |
| sleep 2 | |
| - name: Verify payload loaded | |
| run: | | |
| if [ ! -f /tmp/Hauyne.txt ]; then | |
| echo "Hauyne.txt missing. Bootstrap:" | |
| find bin -name 'hauyne.log' -exec cat {} \; 2>/dev/null || true | |
| exit 1 | |
| fi | |
| echo "PASS: $(cat /tmp/Hauyne.txt)" | |
| - name: Verify failure report | |
| run: | | |
| if ./bin/Hauyne.Injector "$VICTIM_PID" --type Moonyware.NativeEntry 2>&1; then | |
| echo "Injector should've failed" | |
| exit 1 | |
| fi | |
| echo "PASS: bad type correctly reported failure" | |
| - name: Verify victim survived | |
| run: | | |
| sleep 10 | |
| if kill -0 $VICTIM_PID 2>/dev/null; then | |
| echo "Victim still alive" | |
| else | |
| echo "Victim died" | |
| exit 1 | |
| fi | |
| - name: Cleanup | |
| if: always() | |
| run: kill $VICTIM_PID 2>/dev/null || true | |
| - name: Backtrace | |
| if: failure() | |
| run: | | |
| sudo apt-get install -y gdb > /dev/null 2>&1 | |
| for core in /tmp/core.*; do | |
| [ -f "$core" ] || continue | |
| echo ">~< backtrace >~~~<" | |
| gdb -batch -ex 'thread apply all bt' dotnet "$core" 2>/dev/null || true | |
| done |