Support ACG (Arbitrary Code Guard)

[timwhitez]

https://www.ired.team/offensive-security/defense-evasion/acg-arbitrary-code-guard-processdynamiccodepolicy

[timwhitez]

I was trying to work with ACG in Golang but failed because I can't truly define _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY struct in golang. can you give me some help?

[timwhitez]

here is my source code:

package main

import (
    "bufio"
    "fmt"
    "golang.org/x/sys/windows"
    "os"
    "unsafe"
)

type PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY struct {
    flag int
    MicrosoftSignedOnly int
    StoreSignedOnly int
    MitigationOptIn int
    AuditMicrosoftSignedOnly int
    AuditStoreSignedOnly int
    ReservedFlags int
}

type PROCESS_MITIGATION_POLICY int32

const (
    ProcessSignaturePolicy             PROCESS_MITIGATION_POLICY = 8
)

func main(){

    kernel := windows.NewLazySystemDLL("kernel32")
    GetProcessMitigationPolicy := kernel.NewProc("GetProcessMitigationPolicy")

    SetProcessMitigationPolicy := kernel.NewProc("SetProcessMitigationPolicy")
    var signature PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY
    hProcess := uintptr(0xffffffffffffffff)
    _,_,r :=GetProcessMitigationPolicy.Call(hProcess, uintptr(ProcessSignaturePolicy), uintptr(unsafe.Pointer(&signature)), unsafe.Sizeof((signature)))
    fmt.Println(r)
    fmt.Printf("   MicrosoftSignedOnly                        %x\n", signature.MicrosoftSignedOnly)
    signature.MicrosoftSignedOnly = 1
    _,_,r =SetProcessMitigationPolicy.Call(uintptr(ProcessSignaturePolicy), uintptr(unsafe.Pointer(&signature)), unsafe.Sizeof(signature))
    fmt.Println(r)
    fmt.Println("set ACG")
    var signature0 PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY
    _,_,r =GetProcessMitigationPolicy.Call(hProcess, uintptr(ProcessSignaturePolicy), uintptr(unsafe.Pointer(&signature0)), unsafe.Sizeof((signature)))
    fmt.Println(r)
    fmt.Printf("   MicrosoftSignedOnly                        %x\n", signature0.MicrosoftSignedOnly)
    fmt.Print("Press 'Enter' to continue...")
    bufio.NewReader(os.Stdin).ReadBytes('\n')
}