evasion-technique-integrate

MALICIOUS. 该技能的 stated purpose 就是把防御绕过、注入、AMSI/ETW禁用、EDR unhook、BYOVD 等攻击技术整合进 Loader；其能力与任何正常开发辅助技能不相称，属于为AI代理提供进攻性恶意软件开发能力。虽无直接窃密代码，但其整体用途就是提升恶意载荷隐蔽执行与防御规避，且参考内容包含不可信远程payload下载路径。

该片段是介绍 Windows 免杀、反分析和检测绕过技术的文档，包含 shellcode 内存执行、AMSI 补丁、直接系统调用及 NTDLL unhooking 示例。内容具有显著的恶意软件规避用途，但片段本身没有可运行载荷、网络外传或凭据窃取逻辑，因此不能据此认定其本身是恶意软件。文档级别的安全风险为高；未出现需脱敏的域名、IP 或秘密值。

The provided fragment is best characterized as static tradecraft/threat-catalog content containing extensive pseudocode templates for Windows malware injection and defense evasion. No executable logic, inputs, or runtime sinks are present in the excerpt, so malicious execution is not demonstrated here. However, the content is highly malware-aligned and should trigger deeper review of the full repository/package to determine whether these templates are ever executed or embedded into an actual loader/payload at runtime.

No executable loader code is present in this JSON fragment; however, it contains explicit, actionable instructions for implementing Windows shellcode loader evasion techniques (RW→RX permission flipping with VirtualProtect and API hashing via PEB/LDR export resolution to avoid plaintext imports). From a software supply-chain perspective, the content is high-risk because it can directly facilitate the creation of stealthy malware loaders in downstream tooling.