Update implant gvisor

Fix make token test

.github/workflows/autorelease.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   servers-build:
-    name: Build Server Binaries
+    name: Release Build Server
     if: startsWith( github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     timeout-minutes: 45
@@ -37,7 +37,7 @@ jobs:
           path: ./sliver-server_*
 
   clients-build:
-    name: Build Client Binaries
+    name: Release Build Client
     if: startsWith( github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     timeout-minutes: 45

.github/workflows/unit-tests.yml

@@ -10,8 +10,8 @@ on:
       - ready_for_review
 
 jobs:
-  linux-windows-build:
-    name: Linux & Windows Build
+  linux-windows-build-test:
+    name: Linux & Windows Test
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
@@ -44,8 +44,8 @@ jobs:
       - name: Make Linux (arm64)
         run: make linux-arm64
 
-  macos-build:
-    name: MacOS Build
+  macos-build-test:
+    name: MacOS Test
     runs-on: macos-latest
     timeout-minutes: 90
     steps:

client/command/exec/execute.go

@@ -44,6 +44,7 @@ func ExecuteCmd(cmd *cobra.Command, con *console.SliverConsoleClient, args []str
 	args = args[1:]
 
 	token, _ := cmd.Flags().GetBool("token")
+	hidden, _ := cmd.Flags().GetBool("hidden")
 	output, _ := cmd.Flags().GetBool("output")
 	stdout, _ := cmd.Flags().GetString("stdout")
 	stderr, _ := cmd.Flags().GetString("stderr")
@@ -64,16 +65,21 @@ func ExecuteCmd(cmd *cobra.Command, con *console.SliverConsoleClient, args []str
 
 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("Executing %s %s ...", cmdPath, strings.Join(args, " ")), ctrl)
-	if token || ppid != 0 {
+	if token || hidden || ppid != 0 {
+		if session.OS != "windows" {
+			con.PrintErrorf("The token, hide window, and ppid options are not valid on %s\n", session.OS)
+			return
+		}
 		exec, err = con.Rpc.ExecuteWindows(context.Background(), &sliverpb.ExecuteWindowsReq{
-			Request:  con.ActiveTarget.Request(cmd),
-			Path:     cmdPath,
-			Args:     args,
-			Output:   captureOutput,
-			Stderr:   stderr,
-			Stdout:   stdout,
-			UseToken: token,
-			PPid:     ppid,
+			Request:    con.ActiveTarget.Request(cmd),
+			Path:       cmdPath,
+			Args:       args,
+			Output:     captureOutput,
+			Stderr:     stderr,
+			Stdout:     stdout,
+			UseToken:   token,
+			HideWindow: hidden,
+			PPid:       ppid,
 		})
 	} else {
 		exec, err = con.Rpc.Execute(context.Background(), &sliverpb.ExecuteReq{

client/command/generate/generate-beacon.go

@@ -33,8 +33,7 @@ func GenerateBeaconCmd(cmd *cobra.Command, con *console.SliverConsoleClient, arg
 		save, _ = os.Getwd()
 	}
 	if external, _ := cmd.Flags().GetBool("external-builder"); !external {
-		disableSGN, _ := cmd.Flags().GetBool("disable-sgn")
-		compile(config, disableSGN, save, con)
+		compile(config, save, con)
 	} else {
 		externalBuild(config, save, con)
 	}

client/command/generate/generate.go

@@ -99,8 +99,7 @@ func GenerateCmd(cmd *cobra.Command, con *console.SliverConsoleClient, args []st
 		save, _ = os.Getwd()
 	}
 	if external, _ := cmd.Flags().GetBool("external-builder"); !external {
-		disableSGN, _ := cmd.Flags().GetBool("disable-sgn")
-		compile(config, disableSGN, save, con)
+		compile(config, save, con)
 	} else {
 		_, err := externalBuild(config, save, con)
 		if err != nil {
@@ -290,6 +289,7 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverConsoleClient) *cl
 	isSharedLib := false
 	isService := false
 	isShellcode := false
+	sgnEnabled := false
 
 	format, _ := cmd.Flags().GetString("format")
 	runAtLoad := false
@@ -304,6 +304,8 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverConsoleClient) *cl
 	case "shellcode":
 		configFormat = clientpb.OutputFormat_SHELLCODE
 		isShellcode = true
+		sgnEnabled, _ = cmd.Flags().GetBool("disable-sgn")
+		sgnEnabled = !sgnEnabled
 	case "service":
 		configFormat = clientpb.OutputFormat_SERVICE
 		isService = true
@@ -364,6 +366,7 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverConsoleClient) *cl
 		Name:             name,
 		Debug:            debug,
 		Evasion:          evasion,
+		SGNEnabled:       sgnEnabled,
 		ObfuscateSymbols: symbolObfuscation,
 		C2:               c2s,
 		CanaryDomains:    canaryDomains,
@@ -531,7 +534,7 @@ func ParseWGc2(args string) ([]*clientpb.ImplantC2, error) {
 func hasValidC2AdvancedOptions(options url.Values) (bool, error) {
 	for key, value := range options {
 		if len(value) > 1 {
-			return false, fmt.Errorf("too many values specified for advanced option %s. Only one value for %s can be specified.", key, key)
+			return false, fmt.Errorf("too many values specified for advanced option %s. Only one value for %s can be specified", key, key)
 		}
 		testValue := value[0]
 
@@ -588,13 +591,35 @@ func hasValidC2AdvancedOptions(options url.Values) (bool, error) {
 	return true, nil
 }
 
+func checkOptionValue(c2Options url.Values, option string, value string) bool {
+	if !c2Options.Has(option) {
+		return false
+	} else {
+		optionValue := c2Options.Get(option)
+		return strings.ToLower(optionValue) == value
+	}
+}
+
+func uriWithoutProxyOptions(uri *url.URL) {
+	options := uri.Query()
+	// If any of the options do not exist, there is no error
+	options.Del("proxy")
+	options.Del("proxy-username")
+	options.Del("proxy-password")
+	options.Del("ask-proxy-creds")
+	options.Del("fallback")
+
+	uri.RawQuery = options.Encode()
+}
+
 // ParseHTTPc2 - Parse HTTP connection string arg
 func ParseHTTPc2(args string) ([]*clientpb.ImplantC2, error) {
 	c2s := []*clientpb.ImplantC2{}
 	if args == "" {
 		return c2s, nil
 	}
-	for index, arg := range strings.Split(args, ",") {
+	allArguments := strings.Split(args, ",")
+	for index, arg := range allArguments {
 		var uri *url.URL
 		var err error
 		if cmp := strings.ToLower(arg); strings.HasPrefix(cmp, "http://") || strings.HasPrefix(cmp, "https://") {
@@ -619,6 +644,16 @@ func ParseHTTPc2(args string) ([]*clientpb.ImplantC2, error) {
 			Priority: uint32(index),
 			URL:      uri.String(),
 		})
+		/* If a proxy is defined and the operator wants to fallback to connecting directly, add
+		   a C2 that connects directly without the proxy settings.
+		*/
+		if checkOptionValue(uri.Query(), "fallback", "true") && uri.Query().Has("proxy") && !checkOptionValue(uri.Query(), "driver", "wininet") {
+			uriWithoutProxyOptions(uri)
+			c2s = append(c2s, &clientpb.ImplantC2{
+				Priority: uint32(index + len(allArguments)),
+				URL:      uri.String(),
+			})
+		}
 	}
 	return c2s, nil
 }
@@ -866,7 +901,7 @@ func externalBuild(config *clientpb.ImplantConfig, save string, con *console.Sli
 	return nil, nil
 }
 
-func compile(config *clientpb.ImplantConfig, disableSGN bool, save string, con *console.SliverConsoleClient) (*commonpb.File, error) {
+func compile(config *clientpb.ImplantConfig, save string, con *console.SliverConsoleClient) (*commonpb.File, error) {
 	if config.IsBeacon {
 		interval := time.Duration(config.BeaconInterval)
 		con.PrintInfof("Generating new %s/%s beacon implant binary (%v)\n", config.GOOS, config.GOARCH, interval)
@@ -902,7 +937,7 @@ func compile(config *clientpb.ImplantConfig, disableSGN bool, save string, con *
 
 	fileData := generated.File.Data
 	if config.IsShellcode {
-		if disableSGN {
+		if !config.SGNEnabled {
 			con.PrintErrorf("Shikata ga nai encoder is %sdisabled%s\n", console.Bold, console.Normal)
 		} else {
 			con.PrintInfof("Encoding shellcode with shikata ga nai ... ")

client/command/generate/profiles-generate.go

@@ -46,8 +46,11 @@ func ProfilesGenerateCmd(cmd *cobra.Command, con *console.SliverConsoleClient, a
 	}
 	profile := GetImplantProfileByName(name, con)
 	if profile != nil {
-		disableSGN, _ := cmd.Flags().GetBool("disable-sgn")
-		implantFile, err := compile(profile.Config, disableSGN, save, con)
+		// If SGN is explicitly disabled, make sure this compilation reflects that despite whatever is set in the profile
+		if SGNDisabled, _ := cmd.Flags().GetBool("disable-sgn"); SGNDisabled {
+			profile.Config.SGNEnabled = !SGNDisabled
+		}
+		implantFile, err := compile(profile.Config, save, con)
 		if err != nil {
 			return
 		}

client/command/generate/profiles.go

@@ -21,6 +21,7 @@ package generate
 import (
 	"context"
 	"fmt"
+	"math"
 	"strings"
 
 	"github.com/jedib0t/go-pretty/v6/table"
@@ -120,6 +121,305 @@ func GetImplantProfileByName(name string, con *console.SliverConsoleClient) *cli
 	return nil
 }
 
+func populateProfileProperties(config *clientpb.ImplantConfig) map[string]string {
+	properties := make(map[string]string)
+
+	var plural string
+
+	properties["osarch"] = fmt.Sprintf("%s %s", strings.Title(config.GOOS), strings.ToUpper(config.GOARCH))
+	if config.IsBeacon {
+		properties["implanttype"] = "Beacon"
+		jitter := int(config.BeaconJitter / int64(math.Pow10(9)))
+		plural = "s"
+		if jitter == 1 {
+			plural = ""
+		}
+		properties["beaconjitter"] = fmt.Sprintf("%d second%s", jitter, plural)
+		interval := int(config.BeaconInterval / int64(math.Pow10(9)))
+		plural = "s"
+		if interval == 1 {
+			plural = ""
+		}
+		properties["beaconinterval"] = fmt.Sprintf("%d second%s", interval, plural)
+	} else {
+		properties["implanttype"] = "Session"
+	}
+	if config.Debug {
+		properties["debugging"] = "enabled"
+	} else {
+		properties["debugging"] = "disabled"
+	}
+
+	if config.Evasion {
+		properties["evasion"] = "enabled"
+	} else {
+		properties["evasion"] = "disabled"
+	}
+
+	if config.ObfuscateSymbols {
+		properties["obsymbols"] = "enabled"
+	} else {
+		properties["obsymbols"] = "disabled"
+	}
+
+	if config.SGNEnabled {
+		properties["sgn"] = "enabled"
+	} else {
+		properties["sgn"] = "disabled"
+	}
+
+	reconnect := int(config.ReconnectInterval / int64(math.Pow10(9)))
+	if reconnect == 1 {
+		plural = ""
+	} else {
+		plural = "s"
+	}
+	properties["reconnect"] = fmt.Sprintf("%d second%s", reconnect, plural)
+
+	properties["maxerrors"] = fmt.Sprintf("%d", config.MaxConnectionErrors)
+
+	poll := int(config.PollTimeout / int64(math.Pow10(9)))
+	if poll == 1 {
+		plural = ""
+	} else {
+		plural = "s"
+	}
+	properties["polltimeout"] = fmt.Sprintf("%d second%s", poll, plural)
+
+	c2URLs := []string{}
+	for index, c2 := range config.C2 {
+		c2URLs = append(c2URLs, fmt.Sprintf("[%d] %s", index+1, c2.URL))
+	}
+	properties["implantC2"] = strings.Join(c2URLs, "\n")
+	properties["canary"] = strings.Join(config.CanaryDomains, "\n")
+	if config.ConnectionStrategy == "" {
+		properties["connectstrat"] = "Sequential"
+	} else if config.ConnectionStrategy == "r" {
+		properties["connectstrat"] = "Random"
+	} else if config.ConnectionStrategy == "rd" {
+		properties["connectstrat"] = "Random Domain"
+	} else {
+		properties["connectstrat"] = config.ConnectionStrategy
+	}
+	properties["outputlimits"] = "n"
+	if config.LimitDomainJoined {
+		properties["limit-domjoin"] = "Yes"
+		properties["outputlimits"] = "y"
+	} else {
+		properties["limit-domjoin"] = "No"
+	}
+
+	if config.LimitDatetime != "" {
+		properties["limit-dt"] = config.LimitDatetime
+		properties["outputlimits"] = "y"
+	} else {
+		properties["limit-dt"] = "No restriction"
+	}
+
+	if config.LimitFileExists != "" {
+		properties["limit-file"] = config.LimitFileExists
+		properties["outputlimits"] = "y"
+	} else {
+		properties["limit-file"] = "No restriction"
+	}
+
+	if config.LimitHostname != "" {
+		properties["limit-host"] = config.LimitHostname
+		properties["outputlimits"] = "y"
+	} else {
+		properties["limit-host"] = "No restriction"
+	}
+
+	if config.LimitLocale != "" {
+		properties["limit-locale"] = config.LimitLocale
+		properties["outputlimits"] = "y"
+	} else {
+		properties["limit-locale"] = "No restriction"
+	}
+
+	if config.LimitUsername != "" {
+		properties["limit-user"] = config.LimitUsername
+		properties["outputlimits"] = "y"
+	} else {
+		properties["limit-user"] = "No restriction"
+	}
+
+	switch config.Format {
+	case clientpb.OutputFormat_EXECUTABLE:
+		properties["format"] = "Executable"
+	case clientpb.OutputFormat_SHARED_LIB:
+		properties["format"] = "Shared Library"
+	case clientpb.OutputFormat_SERVICE:
+		properties["format"] = "Service"
+	case clientpb.OutputFormat_SHELLCODE:
+		properties["format"] = "Shellcode"
+	case clientpb.OutputFormat_THIRD_PARTY:
+		properties["format"] = "Third Party"
+	}
+	if config.TrafficEncodersEnabled {
+		properties["trafficencoders"] = strings.Join(config.TrafficEncoders, "\n")
+	}
+
+	return properties
+}
+
+// PrintProfileInfo - Print detailed information about a given profile
+func PrintProfileInfo(name string, con *console.SliverConsoleClient) {
+	profile := GetImplantProfileByName(name, con)
+	if profile == nil {
+		con.PrintErrorf("Could not find a profile with the name \"%s\"", name)
+		return
+	}
+
+	config := profile.Config
+	properties := populateProfileProperties(config)
+	//con.Printf("--- Details for profile %s ---\n", profile.Name)
+	tw := table.NewWriter()
+
+	// Implant Basics
+	tw.AppendRow(table.Row{
+		"OS / Architecture",
+		properties["osarch"],
+	})
+	tw.AppendRow(table.Row{
+		"Implant Type",
+		properties["implanttype"],
+	})
+	tw.AppendRow(table.Row{
+		"Implant Format",
+		properties["format"],
+	})
+
+	con.PrintInfof("Implant Basics\n")
+	con.Printf("%s\n\n", tw.Render())
+
+	tw.ResetRows()
+	// Obfuscation Options
+	tw.AppendRow(table.Row{
+		"Evasion is",
+		properties["evasion"],
+	})
+	tw.AppendRow(table.Row{
+		"Debugging is",
+		properties["debugging"],
+	})
+	tw.AppendRow(table.Row{
+		"Obfuscation of symbols is",
+		properties["obsymbols"],
+	})
+	tw.AppendRow(table.Row{
+		"Shikata Ga Nai (SGN) is",
+		properties["sgn"],
+	})
+
+	con.PrintInfof("Obfuscation\n")
+	con.Printf("%s\n\n", tw.Render())
+
+	// Timeouts and Intervals
+	tw.ResetRows()
+	if config.IsBeacon {
+		tw.AppendRow(table.Row{
+			"Beacon Interval",
+			properties["beaconinterval"],
+		})
+		tw.AppendRow(table.Row{
+			"Beacon Jitter",
+			properties["beaconjitter"],
+		})
+	}
+	tw.AppendRow(table.Row{
+		"Reconnect Interval",
+		properties["reconnect"],
+	})
+	tw.AppendRow(table.Row{
+		"Maximum Connection Errors",
+		properties["maxerrors"],
+	})
+	tw.AppendRow(table.Row{
+		"Poll Timeout",
+		properties["polltimeout"],
+	})
+
+	con.PrintInfof("Timeouts and Intervals\n")
+	con.Printf("%s\n\n", tw.Render())
+
+	// C2
+	tw.ResetRows()
+	tw.AppendRow(table.Row{
+		"Endpoints",
+		properties["implantC2"],
+	})
+	if len(config.CanaryDomains) > 0 {
+		plural := "s"
+		if len(config.CanaryDomains) == 1 {
+			plural = ""
+		}
+		tw.AppendRow(table.Row{
+			fmt.Sprintf("Canary Domain%s", plural),
+			properties["canary"],
+		})
+	}
+	tw.AppendRow(table.Row{
+		"Connection Strategy",
+		properties["connectstrat"],
+	})
+
+	con.PrintInfof("Command and Control\n")
+	con.Printf("%s\n\n", tw.Render())
+
+	// Connection Restrictions
+	if properties["outputlimits"] == "y" {
+		tw.ResetRows()
+		tw.AppendRow(table.Row{
+			"Device must be domain joined",
+			properties["limit-domjoin"],
+		})
+		tw.AppendRow(table.Row{
+			"Execution will only occur before the following date/time",
+			properties["limit-dt"],
+		})
+		tw.AppendRow(table.Row{
+			"Files that must be present",
+			properties["limit-file"],
+		})
+		tw.AppendRow(table.Row{
+			"Device has the hostname",
+			properties["limit-host"],
+		})
+		tw.AppendRow(table.Row{
+			"Device uses the locale",
+			properties["limit-locale"],
+		})
+		tw.AppendRow(table.Row{
+			"The implant must be running under the context of specified user",
+			properties["limit-user"],
+		})
+
+		con.PrintInfof("Execution is subject to the following restrictions\n")
+		con.Printf("%s\n\n", tw.Render())
+	}
+
+	// Traffic encoders
+	if config.TrafficEncodersEnabled {
+		tw.ResetRows()
+		tw.AppendRow(table.Row{
+			"Traffic encoders",
+			properties["trafficencoders"],
+		})
+		con.PrintInfof("Traffic Encoders\n")
+		con.Printf("%s\n\n", tw.Render())
+	}
+
+	// Output messages that would otherwise get lost in between the tables
+	if properties["outputlimits"] == "n" {
+		con.PrintInfof("Execution is not subject to any restrictions\n")
+	}
+
+	if !config.TrafficEncodersEnabled {
+		con.PrintInfof("Traffic encoders are not enabled\n")
+	}
+}
+
 // ProfileNameCompleter - Completer for implant build names
 func ProfileNameCompleter(con *console.SliverConsoleClient) carapace.Action {
 	comps := func(ctx carapace.Context) carapace.Action {

client/command/server.go

@@ -47,6 +47,7 @@ import (
 	"github.com/bishopfox/sliver/client/command/sessions"
 	"github.com/bishopfox/sliver/client/command/settings"
 	sgn "github.com/bishopfox/sliver/client/command/shikata-ga-nai"
+	"github.com/bishopfox/sliver/client/command/taskmany"
 	"github.com/bishopfox/sliver/client/command/update"
 	"github.com/bishopfox/sliver/client/command/use"
 	"github.com/bishopfox/sliver/client/command/websites"
@@ -1014,6 +1015,18 @@ func ServerCommands(con *client.SliverConsoleClient, serverCmds func() []*cobra.
 		carapace.Gen(profilesRmCmd).PositionalCompletion(generate.ProfileNameCompleter(con))
 		profilesCmd.AddCommand(profilesRmCmd)
 
+		profilesInfoCmd := &cobra.Command{
+			Use:   consts.InfoStr,
+			Short: "Details about a profile",
+			Long:  help.GetHelpFor([]string{consts.ProfilesStr, consts.RmStr}),
+			Args:  cobra.ExactArgs(1),
+			Run: func(cmd *cobra.Command, args []string) {
+				generate.PrintProfileInfo(args[0], con)
+			},
+		}
+		carapace.Gen(profilesInfoCmd).PositionalCompletion(generate.ProfileNameCompleter(con))
+		profilesCmd.AddCommand(profilesInfoCmd)
+
 		implantBuildsCmd := &cobra.Command{
 			Use:   consts.ImplantBuildsStr,
 			Short: "List implant builds",
@@ -1734,6 +1747,47 @@ func ServerCommands(con *client.SliverConsoleClient, serverCmds func() []*cobra.
 		carapace.Gen(hcstat2RmCmd).PositionalCompletion(crack.CrackHcstat2Completer(con).Usage("hcstat2 to remove"))
 		hcstat2Cmd.AddCommand(hcstat2RmCmd)
 
+		// [ Task many ]-----------------------------------------
+
+		taskmanyCmd := &cobra.Command{
+			Use:     consts.TaskmanyStr,
+			Short:   "Task many beacons or sessions",
+			Long:    help.GetHelpFor([]string{consts.TaskmanyStr}),
+			GroupID: consts.GenericHelpGroup,
+			Run: func(cmd *cobra.Command, args []string) {
+				taskmany.TaskmanyCmd(cmd, con, args)
+			},
+		}
+		server.AddCommand(taskmanyCmd)
+
+		// Add the relevant beacon commands as a subcommand to taskmany
+		taskmanyCmds := map[string]bool{
+			consts.ExecuteStr:     true,
+			consts.LsStr:          true,
+			consts.CdStr:          true,
+			consts.MkdirStr:       true,
+			consts.RmStr:          true,
+			consts.UploadStr:      true,
+			consts.DownloadStr:    true,
+			consts.InteractiveStr: true,
+			consts.ChmodStr:       true,
+			consts.ChownStr:       true,
+			consts.ChtimesStr:     true,
+			consts.PwdStr:         true,
+			consts.CatStr:         true,
+			consts.MvStr:          true,
+			consts.PingStr:        true,
+			consts.NetstatStr:     true,
+			consts.PsStr:          true,
+			consts.IfconfigStr:    true,
+		}
+
+		for _, c := range SliverCommands(con)().Commands() {
+			_, ok := taskmanyCmds[c.Use]
+			if ok {
+				taskmanyCmd.AddCommand(taskmany.WrapCommand(c, con))
+			}
+		}
 		// [ Post-command declaration setup]-----------------------------------------
 
 		// Everything below this line should preferably not be any command binding

client/command/sliver.go

@@ -456,7 +456,7 @@ func SliverCommands(con *client.SliverConsoleClient) console.Commands {
 		}
 		sliver.AddCommand(executeCmd)
 		Flags("", false, executeCmd, func(f *pflag.FlagSet) {
-			f.BoolP("token", "T", false, "execute command with current token (windows only)")
+			f.BoolP("token", "T", false, "execute command with current token (Windows only)")
 			f.BoolP("output", "o", false, "capture command output")
 			f.BoolP("save", "s", false, "save output to a file")
 			f.BoolP("loot", "X", false, "save output as loot")
@@ -465,6 +465,7 @@ func SliverCommands(con *client.SliverConsoleClient) console.Commands {
 			f.StringP("stderr", "E", "", "remote path to redirect STDERR to")
 			f.StringP("name", "n", "", "name to assign loot (optional)")
 			f.Uint32P("ppid", "P", 0, "parent process id (optional, Windows only)")
+			f.BoolP("hidden", "H", false, "hide the window of the spawned process (Windows only)")
 
 			f.Int64P("timeout", "t", defaultTimeout, "grpc timeout in seconds")
 		})

client/command/taskmany/README.md

@@ -0,0 +1,3 @@
+Taskmany
+========
+This package implements the `taskmany` command, which is used to task multiple beacons or sessions at once

client/command/taskmany/taskmany.go

@@ -0,0 +1,199 @@
+package taskmany
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021 Bishop Fox
+	Copyright (C) 2023 ActualTrash
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/spf13/cobra"
+)
+
+// TaskmanyCmd - Task many beacons / sessions
+func TaskmanyCmd(cmd *cobra.Command, con *console.SliverConsoleClient, args []string) {
+	con.PrintErrorf("Must specify subcommand. See taskmany --help for supported subcommands.\n")
+}
+
+// Helper function to wrap grumble commands with taskmany logic
+func WrapCommand(c *cobra.Command, con *console.SliverConsoleClient) *cobra.Command {
+	wc := &cobra.Command{
+		Use:   c.Use,
+		Short: c.Short,
+		Long:  c.Long,
+		Args:  c.Args,
+		Run:   wrapFunctionWithTaskmany(con, c.Run),
+	}
+	wc.Flags().AddFlagSet(c.Flags())
+	wc.PersistentFlags().AddFlagSet(c.PersistentFlags())
+	return wc
+}
+
+// Wrap a function to run it for each beacon / session
+func wrapFunctionWithTaskmany(con *console.SliverConsoleClient, f func(cmd *cobra.Command, args []string)) func(cmd *cobra.Command, args []string) {
+	return func(cmd *cobra.Command, args []string) {
+		defer con.Println()
+
+		sessions, beacons, err := SelectMultipleBeaconsAndSessions(con)
+		if err != nil {
+			con.Println()
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+
+		con.Println()
+
+		// Save current active beacon or session
+		origSession, origBeacon := con.ActiveTarget.Get()
+
+		nB := 0
+		nBSkipped := 0
+		for _, b := range beacons {
+			if !b.IsDead {
+				con.ActiveTarget.Set(nil, b)
+				f(cmd, args)
+				nB += 1
+			} else {
+				nBSkipped += 1
+			}
+		}
+
+		nS := 0
+		nSSkipped := 0
+		for _, s := range sessions {
+			if !s.IsDead {
+				con.ActiveTarget.Set(s, nil)
+				f(cmd, args)
+				nS += 1
+			} else {
+				nSSkipped += 1
+			}
+		}
+
+		// Restore active session / beacon
+		con.ActiveTarget.Set(origSession, origBeacon)
+
+		con.PrintInfof("Tasked %d sessions and %d beacons >:D\n", nS, nB)
+		if nBSkipped > 0 || nSSkipped > 0 {
+			con.PrintWarnf("Skipped %d dead sessions and %d dead beacons\n", nSSkipped, nBSkipped)
+		}
+	}
+}
+
+func SelectMultipleBeaconsAndSessions(con *console.SliverConsoleClient) ([]*clientpb.Session, []*clientpb.Beacon, error) {
+	// Get and sort sessions
+	sessionsObj, err := con.Rpc.GetSessions(context.Background(), &commonpb.Empty{})
+	if err != nil {
+		return nil, nil, err
+	}
+	sessions := sessionsObj.Sessions
+	sort.Slice(sessions, func(i, j int) bool {
+		return sessions[i].ID < sessions[j].ID
+	})
+
+	// Get and sort beacons
+	beaconsObj, err := con.Rpc.GetBeacons(context.Background(), &commonpb.Empty{})
+	if err != nil {
+		return nil, nil, err
+	}
+	beacons := beaconsObj.Beacons
+	sort.Slice(beacons, func(i, j int) bool {
+		return beacons[i].ID < beacons[j].ID
+	})
+
+	if len(beacons) == 0 && len(sessions) == 0 {
+		return nil, nil, fmt.Errorf("no sessions or beacons 🙁")
+	}
+
+	// Render selection table
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+
+	sessionOptionMap := map[string]*clientpb.Session{}
+	for _, session := range sessions {
+		option := fmt.Sprintf("%s\t%s\t%s\t%s\t%s\t%s\t%s",
+			"SESSION",
+			strings.Split(session.ID, "-")[0],
+			session.Name,
+			session.RemoteAddress,
+			session.Hostname,
+			session.Username,
+			fmt.Sprintf("%s/%s", session.OS, session.Arch),
+		)
+		fmt.Fprintf(table, option+"\n")
+		o := strings.ReplaceAll(option, "\t", "")
+		sessionOptionMap[o] = session
+	}
+
+	beaconOptionMap := map[string]*clientpb.Beacon{}
+	for _, beacon := range beacons {
+		option := fmt.Sprintf("%s\t%s\t%s\t%s\t%s\t%s\t%s",
+			"BEACON",
+			strings.Split(beacon.ID, "-")[0],
+			beacon.Name,
+			beacon.RemoteAddress,
+			beacon.Hostname,
+			beacon.Username,
+			fmt.Sprintf("%s/%s", beacon.OS, beacon.Arch),
+		)
+		fmt.Fprintf(table, option+"\n")
+		o := strings.ReplaceAll(option, "\t", "")
+		beaconOptionMap[o] = beacon
+	}
+	table.Flush()
+
+	options := strings.Split(outputBuf.String(), "\n")
+	options = options[:len(options)-1] // Remove the last empty option
+	prompt := &survey.MultiSelect{
+		Message: "Select sessions and beacons:",
+		Options: options,
+	}
+	selected := []string{}
+	survey.AskOne(prompt, &selected)
+
+	if len(selected) == 0 {
+		return nil, nil, fmt.Errorf("no sessions or beacons selected 🤔")
+	}
+
+	selectedSessions := []*clientpb.Session{}
+	selectedBeacons := []*clientpb.Beacon{}
+	for _, s := range selected {
+		s = strings.ReplaceAll(s, " ", "")
+		s = strings.ReplaceAll(s, "\t", "")
+		session, ok := sessionOptionMap[s]
+		if ok {
+			selectedSessions = append(selectedSessions, session)
+		}
+
+		beacon, ok := beaconOptionMap[s]
+		if ok {
+			selectedBeacons = append(selectedBeacons, beacon)
+		}
+	}
+
+	return selectedSessions, selectedBeacons, nil
+}

client/constants/constants.go

@@ -127,6 +127,7 @@ const (
 	BackgroundStr      = "background"
 	InfoStr            = "info"
 	UseStr             = "use"
+	TaskmanyStr        = "taskmany"
 	ReconfigStr        = "reconfig"
 	PruneStr           = "prune"
 	TasksStr           = "tasks"

go.mod

@@ -5,7 +5,8 @@ go 1.20
 replace github.com/rsteube/carapace v0.36.3 => github.com/reeflective/carapace v0.25.2-0.20230602202234-e8d757e458ca
 
 require (
-	github.com/AlecAivazis/survey/v2 v2.3.6
+	filippo.io/age v1.1.1
+	github.com/AlecAivazis/survey/v2 v2.3.7
 	github.com/Binject/binjection v0.0.0-20200705191933-da1a50d7013d
 	github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf
 	github.com/Binject/go-donut v0.0.0-20210701074227-67a31e2d883e
@@ -22,101 +23,150 @@ require (
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
 	github.com/jedib0t/go-pretty/v6 v6.4.6
 	github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
-	github.com/klauspost/compress v1.16.5
+	github.com/klauspost/compress v1.16.6
 	github.com/lesnuages/go-winio v0.4.19
 	github.com/lesnuages/snitch v0.6.0
 	github.com/mattn/go-sqlite3 v1.14.17
-	github.com/miekg/dns v1.1.54
+	github.com/miekg/dns v1.1.55
 	github.com/moloch--/asciicast v0.1.0
 	github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945
-	github.com/ncruces/go-sqlite3 v0.7.0
-	github.com/pquerna/otp v1.4.0
+	github.com/ncruces/go-sqlite3 v0.7.2
 	github.com/reeflective/console v0.1.6
 	github.com/reeflective/readline v1.0.8
 	github.com/rsteube/carapace v0.36.3
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.7.0
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.8.1
-	github.com/tetratelabs/wazero v1.2.0
+	github.com/stretchr/testify v1.8.2
+	github.com/tetratelabs/wazero v1.2.1
 	github.com/things-go/go-socks5 v0.0.3
 	github.com/xlab/treeprint v1.2.0
 	github.com/yiya1989/sshkrb5 v0.0.0-20201110125252-a1455b75a35e
-	golang.org/x/crypto v0.9.0
+	golang.org/x/crypto v0.10.0
 	golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1
-	golang.org/x/net v0.10.0
-	golang.org/x/sys v0.8.0
-	golang.org/x/term v0.8.0
-	golang.org/x/text v0.9.0
+	golang.org/x/net v0.11.0
+	golang.org/x/sys v0.9.0
+	golang.org/x/term v0.9.0
+	golang.org/x/text v0.10.0
 	golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20220208144051-fde48d68ee68
-	google.golang.org/grpc v1.55.0
+	google.golang.org/grpc v1.56.1
 	google.golang.org/protobuf v1.30.0
 	gopkg.in/AlecAivazis/survey.v1 v1.8.8
 	gorm.io/driver/mysql v1.5.1
 	gorm.io/driver/postgres v1.5.2
-	gorm.io/driver/sqlite v1.5.1
-	gorm.io/gorm v1.25.1
-	gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5
-	modernc.org/sqlite v1.22.1
+	gorm.io/driver/sqlite v1.5.2
+	gorm.io/gorm v1.25.2-0.20230530020048-26663ab9bf55
+	gvisor.dev/gvisor v0.0.0-20230504175454-7b0a1988a28f
+	modernc.org/sqlite v1.23.1
+	tailscale.com v1.44.0
 )
 
 require (
+	filippo.io/edwards25519 v1.0.0 // indirect
 	github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563 // indirect
 	github.com/BurntSushi/xgb v0.0.0-20201008132610-5f9e7b3c49cd // indirect
-	github.com/Microsoft/go-winio v0.5.1 // indirect
+	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/VirusTotal/vt-go v0.0.0-20210528074736-45bbe34cc8ab // indirect
 	github.com/VividCortex/ewma v1.2.0 // indirect
+	github.com/akutz/memconn v0.1.0 // indirect
+	github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 // indirect
 	github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
 	github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
-	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
+	github.com/aws/aws-sdk-go-v2 v1.18.0 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.18.22 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.21 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssm v1.36.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.12.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.18.10 // indirect
+	github.com/aws/smithy-go v1.13.5 // indirect
 	github.com/chromedp/sysutil v1.0.0 // indirect
+	github.com/coreos/go-iptables v0.6.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/demisto/goxforce v0.0.0-20160322194047-db8357535b1d // indirect
 	github.com/dlclark/regexp2 v1.4.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/fatih/color v1.15.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.4.0 // indirect
 	github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
 	github.com/glebarez/go-sqlite v1.21.1 // indirect
+	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-sql-driver/mysql v1.7.0 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
 	github.com/gobwas/ws v1.1.0 // indirect
+	github.com/godbus/dbus/v5 v5.1.0 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/btree v1.0.1 // indirect
+	github.com/google/btree v1.1.2 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/hashicorp/go-uuid v1.0.2 // indirect
+	github.com/hdevalence/ed25519consensus v0.1.0 // indirect
+	github.com/illarion/gonotify v1.0.1 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/insomniacslk/dhcp v0.0.0-20230407062729-974c6f05fe16 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
 	github.com/jackc/pgx/v5 v5.3.1 // indirect
 	github.com/jcmturner/gofork v1.0.0 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
+	github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86 // indirect
+	github.com/jsimonetti/rtnetlink v1.3.2 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
+	github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a // indirect
 	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.17 // indirect
-	github.com/mattn/go-runewidth v0.0.13 // indirect
+	github.com/mattn/go-isatty v0.0.18 // indirect
+	github.com/mattn/go-runewidth v0.0.14 // indirect
+	github.com/mdlayher/genetlink v1.3.2 // indirect
+	github.com/mdlayher/netlink v1.7.2 // indirect
+	github.com/mdlayher/sdnotify v1.0.0 // indirect
+	github.com/mdlayher/socket v0.4.1 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
+	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/ncruces/julianday v0.1.5 // indirect
+	github.com/pierrec/lz4/v4 v4.1.17 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
-	github.com/rogpeppe/go-internal v1.10.0 // indirect
+	github.com/tailscale/certstore v0.1.1-0.20220316223106-78d6e1c49d8d // indirect
+	github.com/tailscale/golang-x-crypto v0.0.0-20221115211329-17a3db2c30d2 // indirect
+	github.com/tailscale/goupnp v1.0.1-0.20210804011211-c64d0f06ea05 // indirect
+	github.com/tailscale/netlink v1.1.1-0.20211101221916-cabfb018fe85 // indirect
+	github.com/tailscale/wireguard-go v0.0.0-20230410165232-af172621b4dd // indirect
+	github.com/tcnksm/go-httpstat v0.2.0 // indirect
 	github.com/thedevsaddam/gojsonq/v2 v2.5.2 // indirect
-	golang.org/x/mod v0.8.0 // indirect
-	golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba // indirect
-	golang.org/x/tools v0.6.0 // indirect
-	golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 // indirect
-	google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 // indirect
+	github.com/u-root/uio v0.0.0-20230305220412-3e8cd9d6bf63 // indirect
+	github.com/vishvananda/netlink v1.2.1-beta.2 // indirect
+	github.com/vishvananda/netns v0.0.4 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go4.org/mem v0.0.0-20220726221520-4f986261bf13 // indirect
+	go4.org/netipx v0.0.0-20230303233057-f1b76eb4bb35 // indirect
+	golang.org/x/mod v0.10.0 // indirect
+	golang.org/x/sync v0.2.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/tools v0.9.1 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
+	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
+	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
 	gopkg.in/jcmturner/aescts.v1 v1.0.1 // indirect
 	gopkg.in/jcmturner/dnsutils.v1 v1.0.1 // indirect
 	gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect
 	gopkg.in/jcmturner/gokrb5.v7 v7.5.0 // indirect
 	gopkg.in/jcmturner/rpc.v1 v1.1.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	inet.af/peercred v0.0.0-20210906144145-0893ea02156a // indirect
 	lukechampine.com/uint128 v1.2.0 // indirect
 	modernc.org/cc/v3 v3.40.0 // indirect
 	modernc.org/ccgo/v3 v3.16.13 // indirect
@@ -126,4 +176,5 @@ require (
 	modernc.org/opt v0.1.3 // indirect
 	modernc.org/strutil v1.1.3 // indirect
 	modernc.org/token v1.0.1 // indirect
+	nhooyr.io/websocket v1.8.7 // indirect
 )

go.sum

@@ -1,10 +1,15 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.110.0 h1:Zc8gqp3+a9/Eyph2KDmcGaPtbKRIoqq4YTlL4NMD0Ys=
-cloud.google.com/go/compute v1.18.0 h1:FEigFqoDbys2cvFkZ9Fjq4gnHBP55anJ0yQyau2f9oY=
+cloud.google.com/go/compute v1.19.1 h1:am86mquDUgjGNWxiGn+5PGLbmgiWXlE/yNWpIpNvuXY=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
+filippo.io/age v1.1.1 h1:pIpO7l151hCnQ4BdyBujnGP2YlUo0uj6sAVNHGBvXHg=
+filippo.io/age v1.1.1/go.mod h1:l03SrzDUrBkdBx8+IILdnn2KZysqQdbEBUQ4p3sqEQE=
+filippo.io/edwards25519 v1.0.0 h1:0wAIcmJUqRdI8IJ/3eGi5/HwXZWPujYXXlkrQogz0Ek=
+filippo.io/edwards25519 v1.0.0/go.mod h1:N1IkdkCkiLB6tki+MYJoSx2JTY9NUlxZE7eHn5EwJns=
+filippo.io/mkcert v1.4.4 h1:8eVbbwfVlaqUM7OwuftKc2nuYOoTDQWqsoXmzoXZdbc=
 github.com/AlecAivazis/survey/v2 v2.0.5/go.mod h1:WYBhg6f0y/fNYUuesWQc0PKbJcEliGcYHB9sNT3Bg74=
-github.com/AlecAivazis/survey/v2 v2.3.6 h1:NvTuVHISgTHEHeBFqt6BHOe4Ny/NwGZr7w+F8S9ziyw=
-github.com/AlecAivazis/survey/v2 v2.3.6/go.mod h1:4AuI9b7RjAR+G7v9+C4YSlX/YL3K3cWNXgWXOhllqvI=
+github.com/AlecAivazis/survey/v2 v2.3.7 h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkkhIiSjQ=
+github.com/AlecAivazis/survey/v2 v2.3.7/go.mod h1:xUTIdE4KCOIjsBAE1JYsUPoCqYdZ1reCfTwbto0Fduo=
 github.com/Binject/binjection v0.0.0-20200705191933-da1a50d7013d h1:uq6FM7b88vkNEqwjyP2mK6oL8cymY5b75Luu6ADTStY=
 github.com/Binject/binjection v0.0.0-20200705191933-da1a50d7013d/go.mod h1:rJLtHgGUqTxJbfg+b+LjWBBPuYUzFFza1LXFhrzfxHA=
 github.com/Binject/debug v0.0.0-20200621050044-63af8e405111/go.mod h1:6WgJ7mEG7ngJkNwwDkEVreDk2dPGg3oqdI6OEWaeDNg=
@@ -18,10 +23,11 @@ github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563/go.mod h1:HMbzsK
 github.com/Binject/universal v0.0.0-20210304094126-daefaa886313 h1:hX9boCRvCxIpsiV4q9ts+WOYNnjHiji2FOR5BsDzxiY=
 github.com/Binject/universal v0.0.0-20210304094126-daefaa886313/go.mod h1:J3XDRlam5pPYca3i6EqgQ35GCCEoyxafpCbLkta0ozc=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
 github.com/BurntSushi/xgb v0.0.0-20201008132610-5f9e7b3c49cd h1:u7K2oMFMd8APDV3fM1j2rO3U/XJf1g1qC3DDTKou8iM=
 github.com/BurntSushi/xgb v0.0.0-20201008132610-5f9e7b3c49cd/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/Microsoft/go-winio v0.5.1 h1:aPJp2QD7OOrhO5tQXqQoGSJc+DjDtWTGLOmNyAm6FgY=
-github.com/Microsoft/go-winio v0.5.1/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
 github.com/Ne0nd0g/go-clr v1.0.3 h1:xt92wwuqY23ZSC7RuHD3mKu3K22Bk5NNbxI803vojK4=
 github.com/Ne0nd0g/go-clr v1.0.3/go.mod h1:TKYSQ/5xT25EvBUttAlUrzpR8yHuI0qTRK495I5xG/I=
 github.com/Netflix/go-expect v0.0.0-20180615182759-c93bf25de8e8/go.mod h1:oX5x61PbNXchhh0oikYAH+4Pcfw5LKv21+Jnpr6r6Pc=
@@ -33,15 +39,44 @@ github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1o
 github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
 github.com/akamensky/argparse v1.2.1/go.mod h1:S5kwC7IuDcEr5VeXtGPRVZ5o/FdhcMlQz4IZQuw64xA=
 github.com/akamensky/argparse v1.3.0/go.mod h1:S5kwC7IuDcEr5VeXtGPRVZ5o/FdhcMlQz4IZQuw64xA=
+github.com/akutz/memconn v0.1.0 h1:NawI0TORU4hcOMsMr11g7vwlCdkYeLKXBcxWu2W/P8A=
+github.com/akutz/memconn v0.1.0/go.mod h1:Jo8rI7m0NieZyLI5e2CDlRdRqRRB4S7Xp77ukDjH+Fw=
 github.com/alecthomas/chroma v0.10.0 h1:7XDcGkCQopCNKjZHfYrNLraA+M7e0fMiJ/Mfikbfjek=
 github.com/alecthomas/chroma v0.10.0/go.mod h1:jtJATyUxlIORhUOFNA9NZDWGAQ8wpxQQqNSB4rjA/1s=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 h1:JjwxKkxzcBk4k8147g0eBQRCIy0UN1Be8AAv6RaIj4Q=
 github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0/go.mod h1:IbERvuyb387Hppp8hX0SQTFt/mkej8+OhuS8L0nC2CI=
 github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 h1:cIAK2NNf2yafdgpFRNJrgZMwvy61BEVpGoHc2n4/yWs=
 github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4/go.mod h1:SalMPBCab3yuID8nIhLfzwoBV+lBRyaC7NhuN8qL8xE=
+github.com/aws/aws-sdk-go-v2 v1.18.0 h1:882kkTpSFhdgYRKVZ/VCgf7sd0ru57p2JCxz4/oN5RY=
+github.com/aws/aws-sdk-go-v2 v1.18.0/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
+github.com/aws/aws-sdk-go-v2/config v1.18.22 h1:7vkUEmjjv+giht4wIROqLs+49VWmiQMMHSduxmoNKLU=
+github.com/aws/aws-sdk-go-v2/config v1.18.22/go.mod h1:mN7Li1wxaPxSSy4Xkr6stFuinJGf3VZW3ZSNvO0q6sI=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.21 h1:VRiXnPEaaPeGeoFcXvMZOB5K/yfIXOYE3q97Kgb0zbU=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.21/go.mod h1:90Dk1lJoMyspa/EDUrldTxsPns0wn6+KpRKpdAWc0uA=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3 h1:jJPgroehGvjrde3XufFIJUZVK5A2L9a3KwSFgKy9n8w=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3/go.mod h1:4Q0UFP0YJf0NrsEuEYHpM9fTSEVnD16Z3uyEF7J9JGM=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33 h1:kG5eQilShqmJbv11XL1VpyDbaEJzWxd4zRiCG30GSn4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33/go.mod h1:7i0PF1ME/2eUPFcjkVIwq+DOygHEoK92t5cDqNgYbIw=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27 h1:vFQlirhuM8lLlpI7imKOMsjdQLuN9CPi+k44F/OFVsk=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27/go.mod h1:UrHnn3QV/d0pBZ6QBAEQcqFLf8FAzLmoUfPVIueOvoM=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34 h1:gGLG7yKaXG02/jBlg210R7VgQIotiQntNhsCFejawx8=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34/go.mod h1:Etz2dj6UHYuw+Xw830KfzCfWGMzqvUTCjUj5b76GVDc=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27 h1:0iKliEXAcCa2qVtRs7Ot5hItA2MsufrphbRFlz1Owxo=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27/go.mod h1:EOwBD4J4S5qYszS5/3DpkejfuK+Z5/1uzICfPaZLtqw=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.36.3 h1:TQZH0Djie8VVgTBDOQ02M4zVHJFrNzLMsYMbNfRitVM=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.36.3/go.mod h1:p6MaesK9061w6NTiFmZpUzEkKUY5blKlwD2zYyErxKA=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.9 h1:GAiaQWuQhQQui76KjuXeShmyXqECwQ0mGRMc/rwsL+c=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.9/go.mod h1:ouy2P4z6sJN70fR3ka3wD3Ro3KezSxU6eKGQI2+2fjI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.9 h1:TraLwncRJkWqtIBVKI/UqBymq4+hL+3MzUOtUATuzkA=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.9/go.mod h1:AFvkxc8xfBe8XA+5St5XIHHrQQtkxqrRincx4hmMHOk=
+github.com/aws/aws-sdk-go-v2/service/sts v1.18.10 h1:6UbNM/KJhMBfOI5+lpVcJ/8OA7cBSz0O6OX37SRKlSw=
+github.com/aws/aws-sdk-go-v2/service/sts v1.18.10/go.mod h1:BgQOMsg8av8jset59jelyPW7NoZcZXLVpDsXunGDrk8=
+github.com/aws/smithy-go v1.13.5 h1:hgz0X/DX0dGqTYpGALqXJoRKRj5oQ7150i5FdTePzO8=
+github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
-github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
-github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cheggaaa/pb/v3 v3.1.2 h1:FIxT3ZjOj9XJl0U4o2XbEhjFfZl7jCVCDOGq1ZAB7wQ=
 github.com/cheggaaa/pb/v3 v3.1.2/go.mod h1:SNjnd0yKcW+kw0brSusraeDd5Bf1zBfxAzTL2ss3yQ4=
@@ -51,14 +86,18 @@ github.com/chromedp/chromedp v0.9.1 h1:CC7cC5p1BeLiiS2gfNNPwp3OaUxtRMBjfiw3E3k6d
 github.com/chromedp/chromedp v0.9.1/go.mod h1:DUgZWRvYoEfgi66CgZ/9Yv+psgi+Sksy5DTScENWjaQ=
 github.com/chromedp/sysutil v1.0.0 h1:+ZxhTpfpZlmchB58ih/LBHX52ky7w2VhQVKQMucy3Ic=
 github.com/chromedp/sysutil v1.0.0/go.mod h1:kgWmDdq8fTzXYcKIBqIYvRRTnYb9aNS9moAV0xufSww=
+github.com/cilium/ebpf v0.10.0 h1:nk5HPMeoBXtOzbkZBWym+ZWq1GIiHUsBFXxwewXAHLQ=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/coreos/go-iptables v0.6.0 h1:is9qnZMPYjLd8LYqmm/qlE+wwEgJIkTYdhV3rfZo4jk=
+github.com/coreos/go-iptables v0.6.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/creack/pty v1.1.17 h1:QeVUsEDNrLBW4tMgZHvxy18sKtr6VI492kBhUfhDJNI=
 github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dblohm7/wingoes v0.0.0-20230426155039-111c8c3b57c8 h1:vtIE3GO4hKplR58aTRx3yLPqAbfWyoyYrE8PXUv0Prw=
 github.com/demisto/goxforce v0.0.0-20160322194047-db8357535b1d h1:hmOGJg3cq5XK2aMs7R4kXXVSHqHMaC5hI5fwkX7V2zE=
 github.com/demisto/goxforce v0.0.0-20160322194047-db8357535b1d/go.mod h1:q72QzdO6OUjwTqnLCFJczIQ7GsBa4ffzkQiQcq6rVTY=
 github.com/dlclark/regexp2 v1.4.0 h1:F1rxgk7p4uKjwIQxBs9oAXe5CqrXlCduYEJvrF4u93E=
@@ -72,57 +111,95 @@ github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
 github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
+github.com/frankban/quicktest v1.14.5 h1:dfYrrRyLtiqT9GyKXgdh+k4inNeTvmGbuSgZ3lx3GhA=
+github.com/fxamacker/cbor/v2 v2.4.0 h1:ri0ArlOR+5XunOP8CRUowT0pSJOwhW098ZCUyskZD88=
+github.com/fxamacker/cbor/v2 v2.4.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
 github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 h1:Y5Q2mEwfzjMt5+3u70Gtw93ZOu2UuPeeeTBDntF7FoY=
 github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5/go.mod h1:uF6rMu/1nvu+5DpiRLwusA6xB8zlkNoGzKn8lmYONUo=
+github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
+github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
+github.com/gin-gonic/gin v1.6.3 h1:ahKqKTFpO5KTPHxWZjEdPScmYaGtLo8Y4DMHoEsnp14=
+github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwvtwp4M=
+github.com/github/fakeca v0.1.0 h1:Km/MVOFvclqxPM9dZBC4+QE564nU4gz4iZ0D9pMw28I=
+github.com/github/fakeca v0.1.0/go.mod h1:+bormgoGMMuamOscx7N91aOuUST7wdaJ2rNjeohylyo=
 github.com/glebarez/go-sqlite v1.21.1 h1:7MZyUPh2XTrHS7xNEHQbrhfMZuPSzhkm2A1qgg0y5NY=
 github.com/glebarez/go-sqlite v1.21.1/go.mod h1:ISs8MF6yk5cL4n/43rSOmVMGJJjHYr7L2MbZZ5Q4E2E=
 github.com/glebarez/sqlite v1.8.0 h1:02X12E2I/4C1n+v90yTqrjRa8yuo7c3KeHI3FRznCvc=
 github.com/glebarez/sqlite v1.8.0/go.mod h1:bpET16h1za2KOOMb8+jCp6UBP/iahDpfPQqSaYLTLx8=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
+github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
+github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
+github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.13.0 h1:HyWk6mgj5qFqCT5fjGBuRArbVDfE4hi8+e8ceBS/t7Q=
+github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
+github.com/go-playground/universal-translator v0.17.0 h1:icxd5fm+REJzpZx7ZfpaD876Lmtgy7VtROAbHHXk8no=
+github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
+github.com/go-playground/validator/v10 v10.2.0 h1:KgJ0snyC2R9VXYN2rneOtQcw5aHQB1Vv0sFl1UcHBOY=
+github.com/go-playground/validator/v10 v10.2.0/go.mod h1:uOYAAleCW8F/7oMFd6aG0GOhaH6EGOAJShg8Id5JGkI=
 github.com/go-sql-driver/mysql v1.7.0 h1:ueSltNNllEqE3qcWBTD0iQd3IpL/6U+mJxLkazJ7YPc=
 github.com/go-sql-driver/mysql v1.7.0/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
 github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
+github.com/gobwas/pool v0.2.0/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
+github.com/gobwas/ws v1.0.2/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
 github.com/gobwas/ws v1.1.0 h1:7RFti/xnNkMJnrK7D1yQ/iCIB5OrrY/54/H930kIbHA=
 github.com/gobwas/ws v1.1.0/go.mod h1:nzvNcVha5eUziGrbxFCo6qFIojQHjJV5cLYIbezhfL0=
+github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
+github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=
 github.com/gofrs/uuid v4.4.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/btree v1.0.1 h1:gK4Kx5IaGY9CD5sPJ36FHiBJ6ZXl0kilRiiCj+jdYp4=
-github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
+github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
+github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbuBVKCudVG457BR2GZFIz3uw3hQ=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
+github.com/gorilla/websocket v1.4.1 h1:q7AeDBpnBk8AogcD4DSag/Ukw/KV+YhzLj2bP5HvKCM=
+github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
 github.com/hashicorp/go-uuid v1.0.2 h1:cfejS+Tpcp13yd5nYHWDI6qVCny6wyX2Mt5SGur2IGE=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hdevalence/ed25519consensus v0.1.0 h1:jtBwzzcHuTmFrQN6xQZn6CQEO/V9f7HsjsjeEZ6auqU=
+github.com/hdevalence/ed25519consensus v0.1.0/go.mod h1:w3BHWjwJbFU29IRHL1Iqkw3sus+7FctEyM4RqDxYNzo=
 github.com/hinshun/vt10x v0.0.0-20180616224451-1954e6464174/go.mod h1:DqJ97dSdRW1W22yXSB90986pcOyQ7r45iio1KN2ez1A=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
+github.com/illarion/gonotify v1.0.1 h1:F1d+0Fgbq/sDWjj/r66ekjDG+IDeecQKUFH4wNwsoio=
+github.com/illarion/gonotify v1.0.1/go.mod h1:zt5pmDofZpU1f8aqlK0+95eQhoEAn/d4G4B/FjVW4jE=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/insomniacslk/dhcp v0.0.0-20230407062729-974c6f05fe16 h1:+aAGyK41KRn8jbF2Q7PLL0Sxwg6dShGcQSeCC7nZQ8E=
+github.com/insomniacslk/dhcp v0.0.0-20230407062729-974c6f05fe16/go.mod h1:IKrnDWs3/Mqq5n0lI+RxA2sB7MvN/vbMBP3ehXg65UI=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
@@ -137,26 +214,43 @@ github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
 github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/josharian/native v1.0.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
+github.com/josharian/native v1.0.1-0.20221213033349-c1e37c09b531/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
+github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86 h1:elKwZS1OcdQ0WwEDBeqxKwb7WB62QX8bvZ/FJnVXIfk=
+github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86/go.mod h1:aFAMtuldEgx/4q7iSGazk22+IcgvtiC+HIimFO9XlS8=
+github.com/jsimonetti/rtnetlink v1.3.2 h1:dcn0uWkfxycEEyNy0IGfx3GrhQ38LH7odjxAghimsVI=
+github.com/jsimonetti/rtnetlink v1.3.2/go.mod h1:BBu4jZCpTjP6Gk0/wfrO8qcqymnN3g0hoFqObRmUo6U=
+github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f h1:5hWo+DzJQSOBl6X+TDac0SPWffRonuRJ2///OYtYRT8=
 github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f/go.mod h1:f8GY5V3lRzakvEyr49P7hHRYoHtPr8zvj/7JodCoRzw=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
-github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
+github.com/klauspost/compress v1.16.6 h1:91SKEy4K37vkp255cJ8QesJhjyRO0hn9i9G0GoUwLsk=
+github.com/klauspost/compress v1.16.6/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a h1:+RR6SqnTkDLWyICxS1xpjCi/3dhyV+TgZwA6Ww3KncQ=
+github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a/go.mod h1:YTtCCM3ryyfiu4F7t8HQ1mxvp1UBdWM2r6Xa+nGWvDk=
+github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/pty v1.1.4/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80 h1:6Yzfa6GP0rIo/kULo2bwGEkFvCePZ3qHDDTC3/J9Swo=
 github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs=
+github.com/leodido/go-urn v1.2.0 h1:hpXL4XnriNwQ/ABnpepYM/1vCLWNDfUNts8dX3xTG6Y=
+github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
 github.com/lesnuages/go-winio v0.4.19 h1:lFDu1mnhg5em+8zTHO4ChSD11J56xkyE8m3N8IrVmbA=
 github.com/lesnuages/go-winio v0.4.19/go.mod h1:rm7jf4kBcldxMeljR7c7XY1qVCBc+8z3PtSgkrT9Clk=
 github.com/lesnuages/snitch v0.6.0 h1:vOao32MdYDHYDcTAq2CKszDh6Dn8Bv1Gmgc8uVh193U=
@@ -171,40 +265,59 @@ github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxec
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
-github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4OSgU=
+github.com/mattn/go-isatty v0.0.18 h1:DOKFKCQ7FNG2L1rbrmstDN4QVRdS89Nkh85u68Uwp98=
+github.com/mattn/go-isatty v0.0.18/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU=
+github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-sqlite3 v1.14.17 h1:mCRHCLDUBXgpKAqIKsaAaAsrAlbkeomtRFKXh2L6YIM=
 github.com/mattn/go-sqlite3 v1.14.17/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
 github.com/mdlayher/genetlink v1.2.0/go.mod h1:ra5LDov2KrUCZJiAtEvXXZBxGMInICMXIwshlJ+qRxQ=
+github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
+github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
 github.com/mdlayher/netlink v1.6.0/go.mod h1:0o3PlBmGst1xve7wQ7j/hwpNaFaH4qCRyWCdcZk8/vA=
+github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
+github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
+github.com/mdlayher/sdnotify v1.0.0 h1:Ma9XeLVN/l0qpyx1tNeMSeTjCPH6NtuD6/N9XdTlQ3c=
+github.com/mdlayher/sdnotify v1.0.0/go.mod h1:HQUmpM4XgYkhDLtd+Uad8ZFK1T9D5+pNxnXQjCeJlGE=
 github.com/mdlayher/socket v0.1.1/go.mod h1:mYV5YIZAfHh4dzDVzI8x8tWLWCliuX8Mon5Awbj+qDs=
+github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
+github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/miekg/dns v1.1.54 h1:5jon9mWcb0sFJGpnI99tOMhCPyJ+RPVz5b63MQG0VWI=
-github.com/miekg/dns v1.1.54/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
+github.com/miekg/dns v1.1.55 h1:GoQ4hpsj0nFLYe+bWiCToyrBEJXkQfOOIvFGFy0lEgo=
+github.com/miekg/dns v1.1.55/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
 github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
+github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
+github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/moloch--/asciicast v0.1.0 h1:eBOJwuFKSk447s/kPs9MWsc4kAl5HmuKIDLDYD6/RrM=
 github.com/moloch--/asciicast v0.1.0/go.mod h1:OckO16UDLgxVLclrCnbocL1ix15Br/8Xv/caBoYq98o=
 github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945 h1:m3yCfV8Vqp4MF1B+gPPjbjINdufl0UXqyYplE0aGhx8=
 github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945/go.mod h1:1grVt4HaTofvhFUZYtofeRbGXfczNwCie9MYoM4lP/o=
-github.com/ncruces/go-sqlite3 v0.7.0 h1:y86N7BwrI9ra4kRBYXskcHcJpyzcDinDRQgAKv0Cb54=
-github.com/ncruces/go-sqlite3 v0.7.0/go.mod h1:t3dP4AP9rJddU+ffFv0h6fWyeOCEhjxrYc1nsYG7aQI=
+github.com/ncruces/go-sqlite3 v0.7.2 h1:K7jU4rnUxFdUsbEL+B0Xc+VexLTEwGSO6Qh91Qh4hYc=
+github.com/ncruces/go-sqlite3 v0.7.2/go.mod h1:t3dP4AP9rJddU+ffFv0h6fWyeOCEhjxrYc1nsYG7aQI=
 github.com/ncruces/julianday v0.1.5 h1:hDJ9ejiMp3DHsoZ5KW4c1lwfMjbARS7u/gbYcd0FBZk=
 github.com/ncruces/julianday v0.1.5/go.mod h1:Dusn2KvZrrovOMJuOt0TNXL6tB7U2E8kvza5fFc9G7g=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde h1:x0TT0RDC7UhAVbbWWBzr41ElhJx5tXPWkIHA2HWPRuw=
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
+github.com/pierrec/lz4/v4 v4.1.14/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pierrec/lz4/v4 v4.1.17 h1:kV4Ip+/hUBC+8T6+2EgburRtkE9ef4nbY3f4dFhGjMc=
+github.com/pierrec/lz4/v4 v4.1.17/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/profile v1.6.0/go.mod h1:qBsxPvzyUincmltOk6iyRVxHYg4adc0OFOv72ZdLa18=
+github.com/pkg/sftp v1.13.5 h1:a3RLUqkyjYRtBTZJZ1VRrKbN3zhuPLlUc3sphVz81go=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
-github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/reeflective/carapace v0.25.2-0.20230602202234-e8d757e458ca h1:tD797h1qmNtS/2z6Y7EtIg7OXEDaoSuULsUoksEepmQ=
 github.com/reeflective/carapace v0.25.2-0.20230602202234-e8d757e458ca/go.mod h1:jkLt41Ne2TD2xPuMdX/2O05Smhy8vMgG7O2TYvC0yOc=
@@ -219,7 +332,6 @@ github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJ
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
 github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
-github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
@@ -242,44 +354,78 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.4/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/tetratelabs/wazero v1.2.0 h1:I/8LMf4YkCZ3r2XaL9whhA0VMyAvF6QE+O7rco0DCeQ=
-github.com/tetratelabs/wazero v1.2.0/go.mod h1:wYx2gNRg8/WihJfSDxA1TIL8H+GkfLYm+bIfbblu9VQ=
+github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
+github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/tailscale/certstore v0.1.1-0.20220316223106-78d6e1c49d8d h1:K3j02b5j2Iw1xoggN9B2DIEkhWGheqFOeDkdJdBrJI8=
+github.com/tailscale/certstore v0.1.1-0.20220316223106-78d6e1c49d8d/go.mod h1:2P+hpOwd53e7JMX/L4f3VXkv1G+33ES6IWZSrkIeWNs=
+github.com/tailscale/golang-x-crypto v0.0.0-20221115211329-17a3db2c30d2 h1:pBpqbsyX9H8c26oPYC2H+232HOdp1gDnCztoKmKWKDA=
+github.com/tailscale/golang-x-crypto v0.0.0-20221115211329-17a3db2c30d2/go.mod h1:V2G8jyemEGZWKQ+3xNn4+bOx+FuoXU9Zc5GUsZMthBg=
+github.com/tailscale/goupnp v1.0.1-0.20210804011211-c64d0f06ea05 h1:4chzWmimtJPxRs2O36yuGRW3f9SYV+bMTTvMBI0EKio=
+github.com/tailscale/goupnp v1.0.1-0.20210804011211-c64d0f06ea05/go.mod h1:PdCqy9JzfWMJf1H5UJW2ip33/d4YkoKN0r67yKH1mG8=
+github.com/tailscale/netlink v1.1.1-0.20211101221916-cabfb018fe85 h1:zrsUcqrG2uQSPhaUPjUQwozcRdDdSxxqhNgNZ3drZFk=
+github.com/tailscale/netlink v1.1.1-0.20211101221916-cabfb018fe85/go.mod h1:NzVQi3Mleb+qzq8VmcWpSkcSYxXIg0DkI6XDzpVkhJ0=
+github.com/tailscale/wireguard-go v0.0.0-20230410165232-af172621b4dd h1:+fBevMGmDRNi0oWD4SJXmPKLWvIBYX1NroMjo9czjcY=
+github.com/tailscale/wireguard-go v0.0.0-20230410165232-af172621b4dd/go.mod h1:QRIcq2+DbdIC5sKh/gcAZhuqu6WT6L6G8/ALPN5wqYw=
+github.com/tcnksm/go-httpstat v0.2.0 h1:rP7T5e5U2HfmOBmZzGgGZjBQ5/GluWUylujl0tJ04I0=
+github.com/tcnksm/go-httpstat v0.2.0/go.mod h1:s3JVJFtQxtBEBC9dwcdTTXS9xFnM3SXAZwPG41aurT8=
+github.com/tetratelabs/wazero v1.2.1 h1:J4X2hrGzJvt+wqltuvcSjHQ7ujQxA9gb6PeMs4qlUWs=
+github.com/tetratelabs/wazero v1.2.1/go.mod h1:wYx2gNRg8/WihJfSDxA1TIL8H+GkfLYm+bIfbblu9VQ=
 github.com/thedevsaddam/gojsonq/v2 v2.5.2 h1:CoMVaYyKFsVj6TjU6APqAhAvC07hTI6IQen8PHzHYY0=
 github.com/thedevsaddam/gojsonq/v2 v2.5.2/go.mod h1:bv6Xa7kWy82uT0LnXPE2SzGqTj33TAEeR560MdJkiXs=
 github.com/things-go/go-socks5 v0.0.3 h1:QtlIhkwDuLNCwW3wnt2uTjn1mQzpyjnwct2xdPuqroI=
 github.com/things-go/go-socks5 v0.0.3/go.mod h1:f8Zx+n8kfzyT90hXM767cP6sysAud93+t9rV90IgMcg=
+github.com/u-root/u-root v0.11.0 h1:6gCZLOeRyevw7gbTwMj3fKxnr9+yHFlgF3N7udUVNO8=
+github.com/u-root/uio v0.0.0-20230305220412-3e8cd9d6bf63 h1:YcojQL98T/OO+rybuzn2+5KrD5dBwXIvYBvQ2cD3Avg=
+github.com/u-root/uio v0.0.0-20230305220412-3e8cd9d6bf63/go.mod h1:eLL9Nub3yfAho7qB0MzZizFhTU2QkLeoVsWdHtDW264=
+github.com/ugorji/go v1.1.7 h1:/68gy2h+1mWMrwZFeD1kQialdSzAb432dtpeJ42ovdo=
+github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=
+github.com/ugorji/go/codec v1.1.7 h1:2SvQaVZ1ouYrrKKwoSk2pzd4A9evlKJb9oTL+OaLUSs=
+github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
+github.com/vishvananda/netlink v1.2.1-beta.2 h1:Llsql0lnQEbHj0I1OuKyp8otXp0r3q0mPkuhwHfStVs=
+github.com/vishvananda/netlink v1.2.1-beta.2/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
+github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
+github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
+github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
 github.com/yiya1989/sshkrb5 v0.0.0-20201110125252-a1455b75a35e h1:6SWomM8ezwUwnN3lqKxE4r7bYVwpY9514DQkwBV9IPI=
 github.com/yiya1989/sshkrb5 v0.0.0-20201110125252-a1455b75a35e/go.mod h1:r1bHcNa22x8rrg/Kj/cDF5bX6UtZrHiQgRFvj3Mnpl8=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
+go4.org/mem v0.0.0-20220726221520-4f986261bf13 h1:CbZeCBZ0aZj8EfVgnqQcYZgf0lpZ3H9rmp5nkDTAst8=
+go4.org/mem v0.0.0-20220726221520-4f986261bf13/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
+go4.org/netipx v0.0.0-20230303233057-f1b76eb4bb35 h1:nJAwRlGWZZDOD+6wni9KVUNHMpHko/OnRwsrCYeAzPo=
+go4.org/netipx v0.0.0-20230303233057-f1b76eb4bb35/go.mod h1:TQvodOM+hJTioNQJilmLXu08JNb8i+ccq418+KWu1/Y=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190530122614-20be4c3c3ed5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220208050332-20e1d8d225ab/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g=
-golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
+golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
+golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1 h1:k/i9J1pBpvlfR+9QsetwPyERsqu1GIbi967PQMq3Ivc=
 golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
+golang.org/x/exp/typeparams v0.0.0-20230425010034-47ecfdc1ba53 h1:w/MOPdQ1IoYoDou3L55ZbTx2Nhn7JAhX1BBZor8qChU=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
+golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -293,30 +439,38 @@ golang.org/x/net v0.0.0-20210928044308-7d9f5e0b762b/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20211111083644-e5c967477495/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.11.0 h1:Gi2tvZIJyBtO9SDr1q9h5hEQCp/4L2RQ+ar0qjx2oNU=
+golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.6.0 h1:Lh8GPgSKBfWSwFvtuWOfeI3aAAnbXTSutYxJiOJFgIw=
+golang.org/x/oauth2 v0.7.0 h1:qe6s0zUXlPX80/dITx3440hWZ7GwMwgDDyrSGTPJG/g=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
+golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190530182044-ad28b68e88f1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201018230417-eeed37f84f13/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201207223542-d4d67f95c62d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210217105451-b926d437f341/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210301091718-77cc2087c03b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -327,26 +481,31 @@ golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220207234003-57398862261d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220330033206-e17cdc41300f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220622161953-175b2fd9d664/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.4.1-0.20230131160137-e7d7f63158de/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
+golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210503060354-a79de5458b56/go.mod h1:tfny5GFUkzUvx4ps4ajbZsCe5lw1metzhBm9T3x7oIY=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28=
+golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba h1:O8mE0/t419eoIwhTFpKVkHiTs/Igowgfkj25AcZrtiE=
-golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58=
+golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
+golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -356,35 +515,39 @@ golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.9.1 h1:8WMNJAz3zrtPmnYC7ISf5dEn3MT0gY7jBJfw27yrrLo=
+golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/go118/netip v0.0.0-20211111135330-a4a02eeacf9d/go.mod h1:5yyfuiqVIJ7t+3MqrpTQ+QqRkMWiESiyDvPNvKYCecg=
-golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 h1:Ug9qvr1myri/zFN6xL17LSCBGFDnphBBhzmILHsM5TY=
 golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
 golang.zx2c4.com/wireguard v0.0.0-20220202223031-3b95c81cc178/go.mod h1:TjUWrnD5ATh7bFvmm/ALEJZQ4ivKbETb6pmyj1vUoNI=
 golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24 h1:KwsvzlnmErwMd3BXoBSEuL8qU72QxFM/uOUAgZmavRc=
 golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24/go.mod h1:bVQfyl2sCM/QIIGHpWbFGfHPuDvqnCNkT6MQLTCjO/U=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20220208144051-fde48d68ee68 h1:9c4/JVIQUc2qCJEEIiGIs3HmmnFjhPj4qHW4+Uj+u3U=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20220208144051-fde48d68ee68/go.mod h1:8P32Ilp1kCpwB4ItaHyvSk4xAtnpQ+8gQVfg5WaO1TU=
+golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
+golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 h1:DdoeryqhaXp1LtT/emMP1BRJPHHKFi5akj/nbx/zNTA=
-google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4/go.mod h1:NWraEVixdDnqcqQ30jipen1STv2r/n24Wb7twVTGR4s=
+google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 h1:KpwkzHKEF7B9Zxg18WzOa7djJ+Ha5DzthMyZYQfEn2A=
+google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
-google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
+google.golang.org/grpc v1.56.1 h1:z0dNfjIl0VpaZ9iSVjA6daGatAYwPGstTjt5vkRMFkQ=
+google.golang.org/grpc v1.56.1/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
@@ -406,6 +569,7 @@ gopkg.in/jcmturner/rpc.v1 v1.1.0 h1:QHIUxTX1ISuAv9dD2wJ9HWQVuWDX/Zc0PfeC2tjc4rU=
 gopkg.in/jcmturner/rpc.v1 v1.1.0/go.mod h1:YIdkC4XfD6GXbzje11McwsDuOlZQSb9W4vfLvuNnlv8=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
@@ -414,14 +578,20 @@ gorm.io/driver/mysql v1.5.1 h1:WUEH5VF9obL/lTtzjmML/5e6VfFR/788coz2uaVCAZw=
 gorm.io/driver/mysql v1.5.1/go.mod h1:Jo3Xu7mMhCyj8dlrb3WoCaRd1FhsVh+yMXb1jUInf5o=
 gorm.io/driver/postgres v1.5.2 h1:ytTDxxEv+MplXOfFe3Lzm7SjG09fcdb3Z/c056DTBx0=
 gorm.io/driver/postgres v1.5.2/go.mod h1:fmpX0m2I1PKuR7mKZiEluwrP3hbs+ps7JIGMUBpCgl8=
-gorm.io/driver/sqlite v1.5.1 h1:hYyrLkAWE71bcarJDPdZNTLWtr8XrSjOWyjUYI6xdL4=
-gorm.io/driver/sqlite v1.5.1/go.mod h1:7MZZ2Z8bqyfSQA1gYEV6MagQWj3cpUkJj9Z+d1HEMEQ=
-gorm.io/gorm v1.25.1 h1:nsSALe5Pr+cM3V1qwwQ7rOkw+6UeLrX5O4v3llhHa64=
+gorm.io/driver/sqlite v1.5.2 h1:TpQ+/dqCY4uCigCFyrfnrJnrW9zjpelWVoEVNy5qJkc=
+gorm.io/driver/sqlite v1.5.2/go.mod h1:qxAuCol+2r6PannQDpOP1FP6ag3mKi4esLnB/jHed+4=
 gorm.io/gorm v1.25.1/go.mod h1:L4uxeKpfBml98NYqVqwAdmV1a2nBtAec/cf3fpucW/k=
-gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5 h1:cv/zaNV0nr1mJzaeo4S5mHIm5va1W0/9J3/5prlsuRM=
-gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5/go.mod h1:TIvkJD0sxe8pIob3p6T8IzxXunlp6yfgktvTNp+DGNM=
+gorm.io/gorm v1.25.2-0.20230530020048-26663ab9bf55 h1:sC1Xj4TYrLqg1n3AN10w871An7wJM0gzgcm8jkIkECQ=
+gorm.io/gorm v1.25.2-0.20230530020048-26663ab9bf55/go.mod h1:L4uxeKpfBml98NYqVqwAdmV1a2nBtAec/cf3fpucW/k=
+gvisor.dev/gvisor v0.0.0-20230504175454-7b0a1988a28f h1:8GE2MRjGiFmfpon8dekPI08jEuNMQzSffVHgdupcO4E=
+gvisor.dev/gvisor v0.0.0-20230504175454-7b0a1988a28f/go.mod h1:pzr6sy8gDLfVmDAg8OYrlKvGEHw5C3PGTiBXBTCx76Q=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.4.3 h1:o/n5/K5gXqk8Gozvs2cnL0F2S1/g1vcGCAx2vETjITw=
+howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM=
+inet.af/peercred v0.0.0-20210906144145-0893ea02156a h1:qdkS8Q5/i10xU2ArJMKYhVa1DORzBfYS/qA2UK2jheg=
+inet.af/peercred v0.0.0-20210906144145-0893ea02156a/go.mod h1:FjawnflS/udxX+SvpsMgZfdqx2aykOlkISeAsADi5IU=
+inet.af/wf v0.0.0-20221017222439-36129f591884 h1:zg9snq3Cpy50lWuVqDYM7AIRVTtU50y5WXETMFohW/Q=
 lukechampine.com/uint128 v1.2.0 h1:mBi/5l91vocEN8otkC5bDLhi2KdCticRiwbdB0O+rjI=
 lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 modernc.org/cc/v3 v3.40.0 h1:P3g79IUS/93SYhtoeaHW+kRCIrYaxJ27MFPv+7kaTOw=
@@ -438,11 +608,16 @@ modernc.org/memory v1.5.0 h1:N+/8c5rE6EqugZwHii4IFsaJ7MUhoWX07J5tC/iI5Ds=
 modernc.org/memory v1.5.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
 modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
 modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/sqlite v1.22.1 h1:P2+Dhp5FR1RlVRkQ3dDfCiv3Ok8XPxqpe70IjYVA9oE=
-modernc.org/sqlite v1.22.1/go.mod h1:OrDj17Mggn6MhE+iPbBNf7RGKODDE9NFT0f3EwDzJqk=
+modernc.org/sqlite v1.23.1 h1:nrSBg4aRQQwq59JpvGEQ15tNxoO5pX/kUjcRNwSAGQM=
+modernc.org/sqlite v1.23.1/go.mod h1:OrDj17Mggn6MhE+iPbBNf7RGKODDE9NFT0f3EwDzJqk=
 modernc.org/strutil v1.1.3 h1:fNMm+oJklMGYfU9Ylcywl0CO5O6nTfaowNsh2wpPjzY=
 modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=
 modernc.org/tcl v1.15.2 h1:C4ybAYCGJw968e+Me18oW55kD/FexcHbqH2xak1ROSY=
 modernc.org/token v1.0.1 h1:A3qvTqOwexpfZZeyI0FeGPDlSWX5pjZu9hF4lU+EKWg=
 modernc.org/token v1.0.1/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/z v1.7.3 h1:zDJf6iHjrnB+WRD88stbXokugjyc0/pB91ri1gO6LZY=
+nhooyr.io/websocket v1.8.7 h1:usjR2uOr/zjjkVMy0lW+PPohFok7PCow5sDjLgX4P4g=
+nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
+software.sslmate.com/src/go-pkcs12 v0.2.0 h1:nlFkj7bTysH6VkC4fGphtjXRbezREPgrHuJG20hBGPE=
+tailscale.com v1.44.0 h1:MPos9n30kJvdyfL52045gVFyNg93K+bwgDsr8gqKq2o=
+tailscale.com v1.44.0/go.mod h1:+iYwTdeHyVJuNDu42Zafwihq1Uqfh+pW7pRaY1GD328=

implant/go-mod

@@ -1,8 +1,9 @@
 module github.com/bishopfox/sliver
 
-go 1.18
+go 1.20
 
 require (
+	filippo.io/age v1.1.1
 	github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
 	github.com/Ne0nd0g/go-clr v1.0.3
 	github.com/gofrs/uuid v4.0.0+incompatible
@@ -10,39 +11,35 @@ require (
 	github.com/lesnuages/go-winio v0.4.19
 	github.com/miekg/dns v1.1.50
 	github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945
-	github.com/pquerna/otp v1.3.0
 	github.com/stretchr/testify v1.7.0
 	github.com/tetratelabs/wazero v1.2.0
 	github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
 	github.com/yiya1989/sshkrb5 v0.0.0-20201110125252-a1455b75a35e
-	golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd
-	golang.org/x/net v0.0.0-20220722155237-a158d28d115b
-	golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f
+	golang.org/x/crypto v0.4.0
+	golang.org/x/net v0.5.0
+	golang.org/x/sys v0.4.0
 	golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24
-	google.golang.org/protobuf v1.28.0
-	gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5
+	google.golang.org/protobuf v1.28.2-0.20230118093459-a9481185b34d
+	gvisor.dev/gvisor v0.0.0-20230504175454-7b0a1988a28f
 )
 
 require (
 	github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2 // indirect
 	github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc // indirect
-	github.com/Microsoft/go-winio v0.5.1 // indirect
+	github.com/Microsoft/go-winio v0.6.0 // indirect
 	github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
 	github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
-	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
 	github.com/google/btree v1.0.1 // indirect
-	github.com/google/go-cmp v0.5.8 // indirect
 	github.com/hashicorp/go-uuid v1.0.2 // indirect
 	github.com/jcmturner/gofork v1.0.0 // indirect
 	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	golang.org/x/mod v0.5.1 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20191024005414-555d28b269f0 // indirect
-	golang.org/x/tools v0.1.9 // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
+	golang.org/x/mod v0.7.0 // indirect
+	golang.org/x/text v0.6.0 // indirect
+	golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
+	golang.org/x/tools v0.5.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 // indirect
 	gopkg.in/jcmturner/aescts.v1 v1.0.1 // indirect
 	gopkg.in/jcmturner/dnsutils.v1 v1.0.1 // indirect

implant/go-sum

@@ -1,19 +1,19 @@
+filippo.io/age v1.1.1 h1:pIpO7l151hCnQ4BdyBujnGP2YlUo0uj6sAVNHGBvXHg=
+filippo.io/age v1.1.1/go.mod h1:l03SrzDUrBkdBx8+IILdnn2KZysqQdbEBUQ4p3sqEQE=
 github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2 h1:8kQNJC9AxAaNs0JkXnWUfbNeDnIO1QLYYWjYqC6JEE4=
 github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
 github.com/Binject/universal v0.0.0-20210304094126-daefaa886313 h1:hX9boCRvCxIpsiV4q9ts+WOYNnjHiji2FOR5BsDzxiY=
 github.com/Binject/universal v0.0.0-20210304094126-daefaa886313/go.mod h1:J3XDRlam5pPYca3i6EqgQ35GCCEoyxafpCbLkta0ozc=
 github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc h1:7D+Bh06CRPCJO3gr2F7h1sriovOZ8BMhca2Rg85c2nk=
 github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/Microsoft/go-winio v0.5.1 h1:aPJp2QD7OOrhO5tQXqQoGSJc+DjDtWTGLOmNyAm6FgY=
-github.com/Microsoft/go-winio v0.5.1/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
+github.com/Microsoft/go-winio v0.6.0 h1:slsWYD/zyx7lCXoZVlvQrj0hPTM1HI4+v1sIda2yDvg=
+github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
 github.com/Ne0nd0g/go-clr v1.0.3 h1:xt92wwuqY23ZSC7RuHD3mKu3K22Bk5NNbxI803vojK4=
 github.com/Ne0nd0g/go-clr v1.0.3/go.mod h1:TKYSQ/5xT25EvBUttAlUrzpR8yHuI0qTRK495I5xG/I=
 github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 h1:JjwxKkxzcBk4k8147g0eBQRCIy0UN1Be8AAv6RaIj4Q=
 github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0/go.mod h1:IbERvuyb387Hppp8hX0SQTFt/mkej8+OhuS8L0nC2CI=
 github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 h1:cIAK2NNf2yafdgpFRNJrgZMwvy61BEVpGoHc2n4/yWs=
 github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4/go.mod h1:SalMPBCab3yuID8nIhLfzwoBV+lBRyaC7NhuN8qL8xE=
-github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
-github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -25,8 +25,7 @@ github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaS
 github.com/google/btree v1.0.1 h1:gK4Kx5IaGY9CD5sPJ36FHiBJ6ZXl0kilRiiCj+jdYp4=
 github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/hashicorp/go-uuid v1.0.2 h1:cfejS+Tpcp13yd5nYHWDI6qVCny6wyX2Mt5SGur2IGE=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/jcmturner/gofork v1.0.0 h1:J7uCkflzTEhUZ64xqKnkDxq3kzc96ajM1Gli5ktUem8=
@@ -44,12 +43,9 @@ github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945/go.mod h1:1grVt4Ha
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pquerna/otp v1.3.0 h1:oJV/SkzR33anKXwQU3Of42rL4wbrffP4uvUf1SvS5Xs=
-github.com/pquerna/otp v1.3.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -63,21 +59,21 @@ github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd h1:XcWmESyNjXJMLahc3mqVQJcgSTDxFxhETVlfk9uGc38=
-golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.4.0 h1:UVQgzMY87xqpKNgb+kDsll2Igd33HszWHFLmpaRMq/8=
+golang.org/x/crypto v0.4.0/go.mod h1:3quD/ATkf6oY+rnes5c3ExXTbLc8mueNue5/DoinL80=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.5.1 h1:OJxoQ/rynoF0dcCdI7cLPktw/hR2cueqYfjm43oqK38=
-golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
+golang.org/x/mod v0.7.0 h1:LapD9S96VoQRhi/GrNTqeBJFrUjs5UHCAtTlgwA5oZA=
+golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b h1:PxfKdU9lEEDYjdIzOtC4qFWgkU2rGHdKlKowJSMN9h0=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.5.0 h1:GyT4nK/YDHSqa1c4753ouYCDajOYKTja9Xb/OHtgvSw=
+golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -90,34 +86,34 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220330033206-e17cdc41300f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f h1:v4INt8xihDGvnrfjMDVXGxw9wrfxYyCjk0KbXjhR55s=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.4.0 h1:Zr2JFtRQNX3BCZ8YtxRE9hNJYC8J6I1MVbMg6owUp18=
+golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
+golang.org/x/term v0.4.0 h1:O7UWfv5+A2qiuulQk30kVinPoMtoIPeVaKLEgLpVkvg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0 h1:/5xXl8Y5W96D+TtHSlonuFqGHIWVuyCkGJLwGh9JJFs=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.6.0 h1:3XmdazWV+ubf7QgHSTWeykHOci5oeekaGJBLkrkaw4k=
+golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44=
+golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.9 h1:j9KsMiaP1c3B0OTQGth0/k+miLGTgLsAFUCrF2vLcF8=
-golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
+golang.org/x/tools v0.5.0 h1:+bSpV5HIeWkuvgaMfI3UmKRThoTA5ODJTUd8T17NO+4=
+golang.org/x/tools v0.5.0/go.mod h1:N+Kgy78s5I24c24dU8OfWNEotWjutIs8SnJvn5IDq+k=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 h1:Ug9qvr1myri/zFN6xL17LSCBGFDnphBBhzmILHsM5TY=
 golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
 golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24 h1:KwsvzlnmErwMd3BXoBSEuL8qU72QxFM/uOUAgZmavRc=
 golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24/go.mod h1:bVQfyl2sCM/QIIGHpWbFGfHPuDvqnCNkT6MQLTCjO/U=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.28.2-0.20230118093459-a9481185b34d h1:qp0AnQCvRCMlu9jBjtdbTaaEmThIgZOrbVyDEOcmKhQ=
+google.golang.org/protobuf v1.28.2-0.20230118093459-a9481185b34d/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/jcmturner/aescts.v1 v1.0.1 h1:cVVZBK2b1zY26haWB4vbBiZrfFQnfbTVrE3xZq6hrEw=
@@ -133,5 +129,5 @@ gopkg.in/jcmturner/rpc.v1 v1.1.0/go.mod h1:YIdkC4XfD6GXbzje11McwsDuOlZQSb9W4vfLv
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5 h1:cv/zaNV0nr1mJzaeo4S5mHIm5va1W0/9J3/5prlsuRM=
-gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5/go.mod h1:TIvkJD0sxe8pIob3p6T8IzxXunlp6yfgktvTNp+DGNM=
+gvisor.dev/gvisor v0.0.0-20230504175454-7b0a1988a28f h1:8GE2MRjGiFmfpon8dekPI08jEuNMQzSffVHgdupcO4E=
+gvisor.dev/gvisor v0.0.0-20230504175454-7b0a1988a28f/go.mod h1:pzr6sy8gDLfVmDAg8OYrlKvGEHw5C3PGTiBXBTCx76Q=

implant/sliver/cryptography/crypto.go

@@ -28,39 +28,34 @@ import (
 	"errors"
 	"io"
 	"os"
+	"strings"
 	"sync"
-	"time"
 
 	// {{if .Config.Debug}}
 	"log"
 	// {{end}}
 
-	"github.com/pquerna/otp"
-	"github.com/pquerna/otp/totp"
+	"filippo.io/age"
 	"golang.org/x/crypto/chacha20poly1305"
-	"golang.org/x/crypto/nacl/box"
 )
 
 var (
-	totpOptions = totp.ValidateOpts{
-		Digits:    8,
-		Algorithm: otp.AlgorithmSHA256,
-		Period:    uint(30),
-		Skew:      uint(1),
-	}
-
 	// ErrReplayAttack - Replay attack
 	ErrReplayAttack = errors.New("replay attack detected")
 	// ErrDecryptFailed
 	ErrDecryptFailed = errors.New("decryption failed")
 
 	gzipWriterPools = &sync.Pool{}
+
+	ageMsgPrefix        = []byte("age-encryption.org/v1\n-> X25519 ")
+	agePublicKeyPrefix  = "age1"
+	agePrivateKeyPrefix = "AGE-SECRET-KEY-1"
 )
 
-// ECCKeyPair - Holds the public/private key pair
-type ECCKeyPair struct {
-	Public  *[32]byte
-	Private *[32]byte
+// AgeKeyPair - Holds the public/private key pair
+type AgeKeyPair struct {
+	Public  string
+	Private string
 }
 
 func init() {
@@ -72,44 +67,55 @@ func init() {
 	}
 }
 
-const msgSizeLimit = 8 * 1024
-
-// ECCEncrypt - Encrypt using Nacl Box
-func ECCEncrypt(recipientPublicKey *[32]byte, senderPrivateKey *[32]byte, plaintext []byte) ([]byte, error) {
-	// Arbitrary upper limit for plaintext
-	if msgSizeLimit < len(plaintext) {
-		return nil, errors.New("plaintext too long")
+// AgeEncrypt - Encrypt using Nacl Box
+func AgeEncrypt(recipientPublicKey string, plaintext []byte) ([]byte, error) {
+	if !strings.HasPrefix(recipientPublicKey, agePublicKeyPrefix) {
+		recipientPublicKey = agePublicKeyPrefix + recipientPublicKey
 	}
-
-	var nonce [24]byte
-	if _, err := io.ReadFull(rand.Reader, nonce[:]); err != nil {
+	recipient, err := age.ParseX25519Recipient(recipientPublicKey)
+	if err != nil {
 		return nil, err
 	}
-	encrypted := box.Seal(nonce[:], plaintext, &nonce, recipientPublicKey, senderPrivateKey)
-	return encrypted, nil
+	buf := bytes.NewBuffer([]byte{})
+	stream, err := age.Encrypt(buf, recipient)
+	if err != nil {
+		return nil, err
+	}
+	if _, err := stream.Write(plaintext); err != nil {
+		return nil, err
+	}
+	if err := stream.Close(); err != nil {
+		return nil, err
+	}
+	return bytes.TrimPrefix(buf.Bytes(), ageMsgPrefix), nil
 }
 
-// ECCDecrypt - Decrypt using Curve 25519 + ChaCha20Poly1305
-func ECCDecrypt(senderPublicKey *[32]byte, recipientPrivateKey *[32]byte, ciphertext []byte) ([]byte, error) {
+// AgeDecrypt - Decrypt using Curve 25519 + ChaCha20Poly1305
+func AgeDecrypt(recipientPrivateKey string, ciphertext []byte) ([]byte, error) {
 	if len(ciphertext) < 24 {
 		return nil, errors.New("ciphertext too short")
 	}
-	// Arbitrary upper limit for ciphertext
-	if msgSizeLimit < len(ciphertext) {
-		return nil, errors.New("ciphertext too long")
+	if !strings.HasPrefix(recipientPrivateKey, agePrivateKeyPrefix) {
+		recipientPrivateKey = agePrivateKeyPrefix + recipientPrivateKey
 	}
-
-	var decryptNonce [24]byte
-	copy(decryptNonce[:], ciphertext[:24])
-	plaintext, ok := box.Open(nil, ciphertext[24:], &decryptNonce, senderPublicKey, recipientPrivateKey)
-	if !ok {
-		return nil, ErrDecryptFailed
+	identity, err := age.ParseX25519Identity(recipientPrivateKey)
+	if err != nil {
+		return nil, err
+	}
+	buf := bytes.NewBuffer(append(ageMsgPrefix, ciphertext...))
+	stream, err := age.Decrypt(buf, identity)
+	if err != nil {
+		return nil, err
+	}
+	plaintext, err := io.ReadAll(stream)
+	if err != nil {
+		return nil, err
 	}
 	return plaintext, nil
 }
 
-// RandomKey - Generate random ID of randomIDSize bytes
-func RandomKey() [chacha20poly1305.KeySize]byte {
+// RandomSymmetricKey - Generate random ID of randomIDSize bytes
+func RandomSymmetricKey() [chacha20poly1305.KeySize]byte {
 	randBuf := make([]byte, 64)
 	rand.Read(randBuf)
 	return deriveKeyFrom(randBuf)
@@ -184,7 +190,7 @@ func (c *CipherContext) Decrypt(msg []byte) ([]byte, error) {
 		return nil, ErrDecryptFailed
 	}
 	ciphertext := msg[minisignRawSigSize:]
-	serverPublicKey, err := DecodeMinisignPublicKey(minisignServerPublicKey)
+	serverPublicKey, err := DecodeMinisignPublicKey(serverMinisignPublicKey)
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("failed to decode minisign public key: %s", err)
@@ -227,35 +233,6 @@ func (c *CipherContext) Encrypt(plaintext []byte) ([]byte, error) {
 	return ciphertext, nil
 }
 
-// GetExactOTPCode - Get the OTP code for a specific timestamp
-func GetExactOTPCode(timestamp time.Time) string {
-	code, _ := totp.GenerateCodeCustom(totpSecret, timestamp, totpOptions)
-	// {{if .Config.Debug}}
-	log.Printf("TOTP Code (%s): %s", timestamp, code)
-	// {{end}}
-	return code
-}
-
-// GetOTPCode - Get the current OTP code
-func GetOTPCode() string {
-	now := time.Now().UTC()
-	code, _ := totp.GenerateCodeCustom(totpSecret, now, totpOptions)
-	// {{if .Config.Debug}}
-	log.Printf("TOTP Code: %s", code)
-	// {{end}}
-	return code
-}
-
-// ValidateTOTP - Validate a TOTP code
-func ValidateTOTP(code string) (bool, error) {
-	now := time.Now().UTC()
-	valid, err := totp.ValidateCustom(code, totpSecret, now, totpOptions)
-	if err != nil {
-		return false, err
-	}
-	return valid, nil
-}
-
 // rootOnlyVerifyCertificate - Go doesn't provide a method for only skipping hostname validation so
 // we have to disable all of the certificate validation and re-implement everything.
 // https://github.com/golang/go/issues/21971

implant/sliver/cryptography/implant.go

@@ -19,8 +19,8 @@ package cryptography
 */
 
 import (
+	"crypto/hmac"
 	"crypto/sha256"
-	"encoding/base64"
 	"errors"
 
 	// {{if .Config.Debug}}
@@ -29,59 +29,48 @@ import (
 )
 
 var (
-	// ECCPublicKey - The implant's ECC public key
-	ECCPublicKey = "{{.Config.ECCPublicKey}}"
-	// eccPrivateKey - The implant's ECC private key
-	eccPrivateKey = "{{.Config.ECCPrivateKey}}"
-	// eccPublicKeySignature - The implant's public key minisigned'd
-	ECCPublicKeySignature = `{{.Config.ECCPublicKeySignature}}`
-	// eccServerPublicKey - Server's ECC public key
-	eccServerPublicKey = "{{.Config.ECCServerPublicKey}}"
-	// minisignServerPublicKey - The server's minisign public key
-	minisignServerPublicKey = `{{.Config.MinisignServerPublicKey}}`
-
-	// TOTP secret value
-	totpSecret = "{{.OTPSecret}}"
+	// PeerAgePublicKey - The implant's age public key
+	PeerAgePublicKey = "{{.Config.PeerPublicKey}}"
+	// peerPrivateKey - The implant's age private key
+	peerAgePrivateKey = "{{.Config.PeerPrivateKey}}"
+	// PublicKeySignature - The implant's age public key minisigned'd
+	PeerAgePublicKeySignature = `{{.Config.PeerPublicKeySignature}}`
+	// serverPublicKey - Server's ECC public key
+	serverAgePublicKey = "{{.Config.AgeServerPublicKey}}"
+	// serverMinisignPublicKey - The server's minisign public key
+	serverMinisignPublicKey = `{{.Config.MinisignServerPublicKey}}`
 
 	// ErrInvalidPeerKey - Peer to peer key exchange failed
 	ErrInvalidPeerKey = errors.New("invalid peer key")
 )
 
 // {{if .Config.Debug}} - Used for unit tests, remove from normal builds where these values are set at compile-time
-func SetSecrets(newEccPublicKey, newEccPrivateKey, newEccPublicKeySignature, newEccServerPublicKey, newTotpSecret, newMinisignServerPublicKey string) {
-	ECCPublicKey = newEccPublicKey
-	eccPrivateKey = newEccPrivateKey
-	ECCPublicKeySignature = newEccPublicKeySignature
-	eccServerPublicKey = newEccServerPublicKey
-	totpSecret = newTotpSecret
-	minisignServerPublicKey = newMinisignServerPublicKey
+func SetSecrets(peerPublicKey, peerPrivateKey, peerPublicKeySignature, serverPublicKey, minisignServerPublicKey string) {
+	PeerAgePublicKey = peerPublicKey
+	peerAgePrivateKey = peerPrivateKey
+	PeerAgePublicKeySignature = peerPublicKeySignature
+	serverAgePublicKey = serverPublicKey
+	serverMinisignPublicKey = minisignServerPublicKey
 }
 
 // {{end}}
 
-// GetECCKeyPair - Get the implant's key pair
-func GetECCKeyPair() *ECCKeyPair {
-	publicRaw, err := base64.RawStdEncoding.DecodeString(ECCPublicKey)
-	if err != nil {
-		panic("no public key")
-	}
-	var public [32]byte
-	copy(public[:], publicRaw)
-	privateRaw, err := base64.RawStdEncoding.DecodeString(eccPrivateKey)
-	if err != nil {
-		panic("no private key")
-	}
-	var private [32]byte
-	copy(private[:], privateRaw)
-	return &ECCKeyPair{
-		Public:  &public,
-		Private: &private,
+// GetPeerAgeKeyPair - Get the implant's key pair
+func GetPeerAgeKeyPair() *AgeKeyPair {
+	return &AgeKeyPair{
+		Public:  PeerAgePublicKey,
+		Private: peerAgePrivateKey,
 	}
 }
 
+// GetServerAgePublicKey - Get the decoded server public key
+func GetServerAgePublicKey() string {
+	return serverAgePublicKey
+}
+
 // MinisignVerify - Verify a minisign signature
 func MinisignVerify(message []byte, signature string) bool {
-	serverPublicKey, err := DecodeMinisignPublicKey(minisignServerPublicKey)
+	serverPublicKey, err := DecodeMinisignPublicKey(serverMinisignPublicKey)
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("failed to decode minisign public key: %s", err)
@@ -108,61 +97,59 @@ func MinisignVerify(message []byte, signature string) bool {
 	return valid
 }
 
-// GetServerECCPublicKey - Get the decoded server public key
-func GetServerECCPublicKey() *[32]byte {
-	publicRaw, err := base64.RawStdEncoding.DecodeString(eccServerPublicKey)
-	if err != nil {
-		return nil
-	}
-	var public [32]byte
-	copy(public[:], publicRaw)
-	return &public
-}
-
-// ECCEncryptToServer - Encrypt using the server's public key
-func ECCEncryptToServer(plaintext []byte) ([]byte, error) {
-	recipientPublicKey := GetServerECCPublicKey()
-	if recipientPublicKey == nil {
+// AgeKeyExToServer - Encrypt using the server's public key
+func AgeKeyExToServer(plaintext []byte) ([]byte, error) {
+	recipientPublicKey := GetServerAgePublicKey()
+	if recipientPublicKey == "" {
 		panic("no server public key")
 	}
-	keyPair := GetECCKeyPair()
-	ciphertext, err := ECCEncrypt(recipientPublicKey, keyPair.Private, plaintext)
+
+	peerKeyPair := GetPeerAgeKeyPair()
+
+	// First HMAC the plaintext with the hash of the implant's private key
+	// this ensures that the server is talking to a valid implant
+	privateDigest := sha256.New()
+	privateDigest.Write([]byte(peerKeyPair.Private))
+	mac := hmac.New(sha256.New, privateDigest.Sum(nil))
+	mac.Write(plaintext)
+
+	// Next encrypt using server's Age public key
+	ciphertext, err := AgeEncrypt(recipientPublicKey, append(mac.Sum(nil), plaintext...))
 	if err != nil {
 		return nil, err
 	}
-	digest := sha256.Sum256((*keyPair.Public)[:])
+
+	// Sender includes hash of it's implant specific peer public key
+	publicDigest := sha256.Sum256([]byte(peerKeyPair.Public))
 	msg := make([]byte, 32+len(ciphertext))
-	copy(msg, digest[:])
+	copy(msg, publicDigest[:])
 	copy(msg[32:], ciphertext)
 	return msg, nil
 }
 
-// ECCEncryptToPeer - Encrypt using the peer's public key
-func ECCEncryptToPeer(recipientPublicKey []byte, recipientPublicKeySig string, plaintext []byte) ([]byte, error) {
+// AgeEncryptToPeer - Encrypt using the peer's public key
+func AgeEncryptToPeer(recipientPublicKey []byte, recipientPublicKeySig string, plaintext []byte) ([]byte, error) {
 	valid := MinisignVerify(recipientPublicKey, recipientPublicKeySig)
 	if !valid {
 		return nil, ErrInvalidPeerKey
 	}
-	var peerPublicKey [32]byte
-	copy(peerPublicKey[:], recipientPublicKey)
-	keyPair := GetECCKeyPair()
-	ciphertext, err := ECCEncrypt(&peerPublicKey, keyPair.Private, plaintext)
+	ciphertext, err := AgeEncrypt(string(recipientPublicKey), plaintext)
 	if err != nil {
 		return nil, err
 	}
 	return ciphertext, nil
 }
 
-// ECCDecryptFromPeer - Decrypt a message from a peer
-func ECCDecryptFromPeer(senderPublicKey []byte, senderPublicKeySig string, ciphertext []byte) ([]byte, error) {
+// AgeDecryptFromPeer - Decrypt a message from a peer
+func AgeDecryptFromPeer(senderPublicKey []byte, senderPublicKeySig string, ciphertext []byte) ([]byte, error) {
 	valid := MinisignVerify(senderPublicKey, senderPublicKeySig)
 	if !valid {
 		return nil, ErrInvalidPeerKey
 	}
 	var peerPublicKey [32]byte
 	copy(peerPublicKey[:], senderPublicKey)
-	keyPair := GetECCKeyPair()
-	plaintext, err := ECCDecrypt(&peerPublicKey, keyPair.Private, ciphertext)
+	keyPair := GetPeerAgeKeyPair()
+	plaintext, err := AgeDecrypt(keyPair.Private, ciphertext)
 	if err != nil {
 		return nil, err
 	}

implant/sliver/handlers/handlers_windows.go

@@ -365,6 +365,8 @@ func executeWindowsHandler(data []byte, resp RPCResponse) {
 	if execReq.UseToken {
 		cmd.SysProcAttr.Token = syscall.Token(priv.CurrentToken)
 	}
+	// Hide the window if requested
+	cmd.SysProcAttr.HideWindow = execReq.HideWindow
 	if execReq.PPid != 0 {
 		err := spoof.SpoofParent(execReq.PPid, cmd)
 		if err != nil {
@@ -794,11 +796,11 @@ func listExtensionsHandler(data []byte, resp RPCResponse) {
 }
 
 // Stub since Windows doesn't support UID
-func getUid(fileInfo os.FileInfo) (string) {
+func getUid(fileInfo os.FileInfo) string {
 	return ""
 }
 
 // Stub since Windows doesn't support GID
-func getGid(fileInfo os.FileInfo) (string) {
-    return ""
+func getGid(fileInfo os.FileInfo) string {
+	return ""
 }

implant/sliver/netstack/tun.go

@@ -141,7 +141,7 @@ func (tun *netTun) Write(buf []byte, offset int) (int, error) {
 
 func (tun *netTun) WriteNotify() {
 	pkt := tun.ep.Read()
-	if pkt == nil {
+	if pkt.IsNil() {
 		return
 	}
 

implant/sliver/pivots/pivots.go

@@ -21,7 +21,6 @@ package pivots
 import (
 	"bytes"
 	"crypto/rand"
-	"encoding/base64"
 	"encoding/binary"
 	"errors"
 	"io"
@@ -409,19 +408,18 @@ func (p *NetConnPivot) peerKeyExchange() error {
 		return ErrFailedKeyExchange
 	}
 	p.downstreamPeerID = peerHello.PeerID
-	sessionKey := cryptography.RandomKey()
+	sessionKey := cryptography.RandomSymmetricKey()
 	p.cipherCtx = cryptography.NewCipherContext(sessionKey)
-	ciphertext, err := cryptography.ECCEncryptToPeer(peerHello.PublicKey, peerHello.PublicKeySignature, sessionKey[:])
+	ciphertext, err := cryptography.AgeEncryptToPeer(peerHello.PublicKey, peerHello.PublicKeySignature, sessionKey[:])
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[pivot] peer encryption failure: %s", err)
 		// {{end}}
 		return ErrFailedKeyExchange
 	}
-	publicKeyRaw, _ := base64.RawStdEncoding.DecodeString(cryptography.ECCPublicKey)
 	peerResponse, _ := proto.Marshal(&pb.PivotHello{
-		PublicKey:          publicKeyRaw,
-		PublicKeySignature: cryptography.ECCPublicKeySignature,
+		PublicKey:          []byte(cryptography.PeerAgePublicKey),
+		PublicKeySignature: cryptography.PeerAgePublicKeySignature,
 		SessionKey:         ciphertext,
 	})
 	p.conn.SetWriteDeadline(time.Now().Add(tcpPivotWriteDeadline))

implant/sliver/priv/priv_windows.go

@@ -259,7 +259,7 @@ func MakeToken(domain string, username string, password string, logonType uint32
 	if err != nil {
 		return err
 	}
-	if logonType == 0 {
+	if logonType == syscalls.LOGON32_LOGON_NEW_CREDENTIALS {
 		err = syscalls.LogonUser(pu, pd, pp, logonType, syscalls.LOGON32_PROVIDER_WINNT50, &token)
 	} else {
 		err = syscalls.LogonUser(pu, pd, pp, logonType, syscalls.LOGON32_PROVIDER_DEFAULT, &token)

implant/sliver/sliver.go

@@ -27,6 +27,7 @@ import "C"
 import (
 	"crypto/rand"
 	"encoding/binary"
+	"errors"
 
 	insecureRand "math/rand"
 	"os"
@@ -64,6 +65,7 @@ import (
 var (
 	InstanceID       string
 	connectionErrors = 0
+	ErrTerminate     = errors.New("terminate")
 )
 
 func init() {
@@ -545,6 +547,10 @@ func openSessionHandler(data []byte) {
 			connectionAttempts++
 			if connection != nil {
 				err := sessionMainLoop(connection)
+				if err == ErrTerminate {
+					connection.Cleanup()
+					return
+				}
 				if err == nil {
 					break
 				}
@@ -597,11 +603,11 @@ func sessionMainLoop(connection *transports.Connection) error {
 	rportfwdHandlers := handlers.GetRportFwdHandlers()
 
 	for envelope := range connection.Recv {
-		if handler, ok := specialHandlers[envelope.Type]; ok {
+		if _, ok := specialHandlers[envelope.Type]; ok {
 			// {{if .Config.Debug}}
 			log.Printf("[recv] specialHandler %d", envelope.Type)
 			// {{end}}
-			handler(envelope.Data, connection)
+			return ErrTerminate
 		} else if handler, ok := pivotHandlers[envelope.Type]; ok {
 			// {{if .Config.Debug}}
 			log.Printf("[recv] pivotHandler with type %d", envelope.Type)

implant/sliver/transports/dnsclient/dnsclient.go

@@ -312,9 +312,9 @@ func (s *SliverDNSClient) SessionInit() error {
 	}
 
 	// Key agreement with server
-	sKey := cryptography.RandomKey()
+	sKey := cryptography.RandomSymmetricKey()
 	s.cipherCtx = cryptography.NewCipherContext(sKey)
-	initData, err := cryptography.ECCEncryptToServer(sKey[:])
+	initData, err := cryptography.AgeKeyExToServer(sKey[:])
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[dns] failed to encrypt init msg %v", err)
@@ -815,14 +815,9 @@ func (s *SliverDNSClient) pollMsg(meta *ResolverMetadata) (string, error) {
 }
 
 func (s *SliverDNSClient) otpMsg() (string, error) {
-	otpCode := cryptography.GetOTPCode()
-	otp, err := strconv.Atoi(otpCode)
-	if err != nil {
-		return "", err
-	}
 	otpMsg := &dnspb.DNSMessage{
 		Type: dnspb.DNSMessageType_TOTP,
-		ID:   uint32(otp), // Take advantage of the variable length encoding
+		ID:   uint32(0), // Take advantage of the variable length encoding
 	}
 	data, err := proto.Marshal(otpMsg)
 	if err != nil {

implant/sliver/transports/httpclient/drivers_windows.go

@@ -27,6 +27,10 @@ import (
 	"github.com/bishopfox/sliver/implant/sliver/transports/httpclient/drivers/win/wininet"
 )
 
+var (
+	wininetDriver = "wininet"
+)
+
 // GetHTTPDriver - Get an instance of the specified HTTP driver
 func GetHTTPDriver(origin string, secure bool, opts *HTTPOptions) (HTTPDriver, error) {
 	switch opts.Driver {

implant/sliver/transports/httpclient/httpclient.go

@@ -46,8 +46,7 @@ import (
 )
 
 var (
-	wininetDriver = "wininet"
-	goHTTPDriver  = "go"
+	goHTTPDriver = "go"
 
 	userAgent      = "{{GenerateUserAgent}}"
 	nonceQueryArgs = "{{.HTTPC2ImplantConfig.NonceQueryArgs}}" // "abcdefghijklmnopqrstuvwxyz"
@@ -174,12 +173,12 @@ type SliverHTTPClient struct {
 
 // SessionInit - Initialize the session
 func (s *SliverHTTPClient) SessionInit() error {
-	sKey := cryptography.RandomKey()
+	sKey := cryptography.RandomSymmetricKey()
 	s.SessionCtx = cryptography.NewCipherContext(sKey)
 	httpSessionInit := &pb.HTTPSessionInit{Key: sKey[:]}
 	data, _ := proto.Marshal(httpSessionInit)
 
-	encryptedSessionInit, err := cryptography.ECCEncryptToServer(data)
+	encryptedSessionInit, err := cryptography.AgeKeyExToServer(data)
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("Nacl encrypt failed %v", err)
@@ -360,9 +359,7 @@ func (s *SliverHTTPClient) establishSessionID(sessionInit []byte) error {
 
 	uri := s.startSessionURL()
 	s.NonceQueryArgument(uri, nonce)
-	timestamp := time.Now().UTC().Add(TimeDelta)
-	otpCode := cryptography.GetExactOTPCode(timestamp)
-	s.OTPQueryArgument(uri, otpCode)
+
 	req := s.newHTTPRequest(http.MethodPost, uri, reqBody)
 	// {{if .Config.Debug}}
 	log.Printf("[http] POST -> %s (%d bytes)", uri, len(sessionInit))

implant/sliver/transports/mtls/mtls.go

@@ -65,8 +65,18 @@ func WriteEnvelope(connection *tls.Conn, envelope *pb.Envelope) error {
 	}
 	dataLengthBuf := new(bytes.Buffer)
 	binary.Write(dataLengthBuf, binary.LittleEndian, uint32(len(data)))
-	connection.Write(dataLengthBuf.Bytes())
-	connection.Write(data)
+	if _, werr := connection.Write(dataLengthBuf.Bytes()); werr != nil {
+		// {{if .Config.Debug}}
+		log.Print("Error writing data length: ", werr)
+		// {{end}}
+		return werr
+	}
+	if _, werr := connection.Write(data); werr != nil {
+		// {{if .Config.Debug}}
+		log.Print("Error writing data: ", werr)
+		// {{end}}
+		return werr
+	}
 	return nil
 }
 

implant/sliver/transports/pivotclients/pivotclient.go

@@ -20,7 +20,6 @@ package pivotclients
 
 import (
 	"bytes"
-	"encoding/base64"
 	"encoding/binary"
 	"errors"
 	"io"
@@ -73,17 +72,10 @@ func (p *NetConnPivotClient) KeyExchange() error {
 }
 
 func (p *NetConnPivotClient) peerKeyExchange() error {
-	publicKey, err := base64.RawStdEncoding.DecodeString(cryptography.ECCPublicKey)
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Printf("[pivot] Error decoding public key: %v", err)
-		// {{end}}
-		return err
-	}
 	pivotHello, _ := proto.Marshal(&pb.PivotHello{
-		PublicKey:          publicKey,
+		PublicKey:          []byte(cryptography.PeerAgePublicKey),
 		PeerID:             pivots.MyPeerID,
-		PublicKeySignature: cryptography.ECCPublicKeySignature,
+		PublicKeySignature: cryptography.PeerAgePublicKeySignature,
 	})
 
 	// Enforce deadlines on the key exchange
@@ -108,7 +100,7 @@ func (p *NetConnPivotClient) peerKeyExchange() error {
 		// {{end}}
 		return err
 	}
-	peerSessionKey, err := cryptography.ECCDecryptFromPeer(peerHello.PublicKey, peerHello.PublicKeySignature, peerHello.SessionKey)
+	peerSessionKey, err := cryptography.AgeDecryptFromPeer(peerHello.PublicKey, peerHello.PublicKeySignature, peerHello.SessionKey)
 	if err != nil || len(peerSessionKey) != 32 {
 		// {{if .Config.Debug}}
 		log.Printf("[pivot] Error decrypting session key: %v", err)
@@ -122,9 +114,9 @@ func (p *NetConnPivotClient) peerKeyExchange() error {
 }
 
 func (p *NetConnPivotClient) serverKeyExchange() error {
-	serverSessionKey := cryptography.RandomKey()
+	serverSessionKey := cryptography.RandomSymmetricKey()
 	p.serverCipherCtx = cryptography.NewCipherContext(serverSessionKey)
-	ciphertext, err := cryptography.ECCEncryptToServer(serverSessionKey[:])
+	ciphertext, err := cryptography.AgeKeyExToServer(serverSessionKey[:])
 	if err != nil {
 		return err
 	}

implant/sliver/transports/pivotclients/tcp.go

@@ -26,10 +26,6 @@ import (
 	"time"
 )
 
-const (
-	bufSize = 1024
-)
-
 var (
 	ErrFailedWrite = errors.New("write failed")
 

implant/sliver/transports/session.go

@@ -258,7 +258,7 @@ func mtlsConnect(uri *url.URL) (*Connection, error) {
 						return
 					}
 				case <-time.After(mtls.PingInterval):
-					mtls.WritePing(conn)
+					err = mtls.WritePing(conn)
 					if err != nil {
 						return
 					}
@@ -370,7 +370,7 @@ func wgConnect(uri *url.URL) (*Connection, error) {
 						return
 					}
 				case <-time.After(wireguard.PingInterval):
-					wireguard.WritePing(conn)
+					err = wireguard.WritePing(conn)
 					if err != nil {
 						return
 					}

implant/sliver/transports/wireguard/wireguard.go

@@ -89,8 +89,18 @@ func WriteEnvelope(connection net.Conn, envelope *pb.Envelope) error {
 	}
 	dataLengthBuf := new(bytes.Buffer)
 	binary.Write(dataLengthBuf, binary.LittleEndian, uint32(len(data)))
-	connection.Write(dataLengthBuf.Bytes())
-	connection.Write(data)
+	if _, werr := connection.Write(dataLengthBuf.Bytes()); werr != nil {
+		// {{if .Config.Debug}}
+		log.Print("Socket error (write msg-length): ", werr)
+		// {{end}}
+		return werr
+	}
+	if _, werr := connection.Write(data); werr != nil {
+		// {{if .Config.Debug}}
+		log.Print("Socket error (write msg): ", werr)
+		// {{end}}
+		return werr
+	}
 	return nil
 }
 

implant/vendor/filippo.io/age/.gitattributes

@@ -0,0 +1,2 @@
+*.age binary
+testdata/testkit/* binary

implant/vendor/filippo.io/age/AUTHORS

@@ -0,0 +1,6 @@
+# This is the official list of age authors for copyright purposes.
+# To be included, send a change adding the individual or company
+# who owns a contribution's copyright.
+
+Google LLC
+Filippo Valsorda

implant/vendor/filippo.io/age/LICENSE

@@ -0,0 +1,27 @@
+Copyright 2019 The age Authors
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of the age project nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

implant/vendor/filippo.io/age/README.md

@@ -0,0 +1,251 @@
+<p align="center"><img alt="The age logo, an wireframe of St. Peters dome in Rome, with the text: age, file encryption" width="600" src="https://user-images.githubusercontent.com/1225294/132245842-fda4da6a-1cea-4738-a3da-2dc860861c98.png"></p>
+
+[![Go Reference](https://pkg.go.dev/badge/filippo.io/age.svg)](https://pkg.go.dev/filippo.io/age)
+[![man page](<https://img.shields.io/badge/age(1)-man%20page-lightgrey>)](https://filippo.io/age/age.1)
+[![C2SP specification](https://img.shields.io/badge/%C2%A7%23-specification-blueviolet)](https://age-encryption.org/v1)
+
+age is a simple, modern and secure file encryption tool, format, and Go library.
+
+It features small explicit keys, no config options, and UNIX-style composability.
+
+```
+$ age-keygen -o key.txt
+Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
+$ tar cvz ~/data | age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p > data.tar.gz.age
+$ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
+```
+
+📜 The format specification is at [age-encryption.org/v1](https://age-encryption.org/v1). age was designed by [@Benjojo12](https://twitter.com/Benjojo12) and [@FiloSottile](https://twitter.com/FiloSottile).
+
+📬 Follow the maintenance of this project by subscribing to [Maintainer Dispatches](https://filippo.io/newsletter)!
+
+🦀 An alternative interoperable Rust implementation is available at [github.com/str4d/rage](https://github.com/str4d/rage).
+
+🔑 Hardware PIV tokens such as YubiKeys are supported through the [age-plugin-yubikey](https://github.com/str4d/age-plugin-yubikey) plugin.
+
+💬 The author pronounces it `[aɡe̞]`, like the Italian [“aghe”](https://translate.google.com/?sl=it&text=aghe).
+
+## Installation
+
+<table>
+    <tr>
+        <td>Homebrew (macOS or Linux)</td>
+        <td>
+            <code>brew install age</code>
+        </td>
+    </tr>
+    <tr>
+        <td>MacPorts</td>
+        <td>
+            <code>port install age</code>
+        </td>
+    </tr>
+    <tr>
+        <td>Alpine Linux v3.15+</td>
+        <td>
+            <code>apk add age</code>
+        </td>
+    </tr>
+    <tr>
+        <td>Arch Linux</td>
+        <td>
+            <code>pacman -S age</code>
+        </td>
+    </tr>
+    <tr>
+        <td>Debian 11+ (Bullseye)</td>
+        <td>
+            <code>apt install age/bullseye-backports</code>
+            (<a href="https://backports.debian.org/Instructions/#index2h2">enable backports</a> for age v1.0.0+)
+        </td>
+    </tr>
+    <tr>
+        <td>Fedora 33+</td>
+        <td>
+            <code>dnf install age</code>
+        </td>
+    </tr>
+    <tr>
+        <td>Gentoo Linux</td>
+        <td>
+            <code>emerge app-crypt/age</code>
+        </td>
+    </tr>
+    <tr>
+        <td>NixOS / Nix</td>
+        <td>
+            <code>nix-env -i age</code>
+        </td>
+    </tr>
+    <tr>
+        <td>openSUSE Tumbleweed</td>
+        <td>
+            <code>zypper install age</code>
+        </td>
+    </tr>
+    <tr>
+        <td>Ubuntu 22.04+</td>
+        <td>
+            <code>apt install age</code>
+        </td>
+    </tr>
+    <tr>
+        <td>Void Linux</td>
+        <td>
+            <code>xbps-install age</code>
+        </td>
+    </tr>
+    <tr>
+        <td>FreeBSD</td>
+        <td>
+            <code>pkg install age</code> (security/age)
+        </td>
+    </tr>
+    <tr>
+        <td>OpenBSD 6.7+</td>
+        <td>
+            <code>pkg_add age</code> (security/age)
+        </td>
+    </tr>
+    <tr>
+        <td>Chocolatey (Windows)</td>
+        <td>
+            <code>choco install age.portable</code>
+        </td>
+    </tr>
+    <tr>
+        <td>Scoop (Windows)</td>
+        <td>
+            <code>scoop bucket add extras; scoop install age</code>
+        </td>
+    </tr>
+</table>
+
+On Windows, Linux, macOS, and FreeBSD you can use the pre-built binaries.
+
+```
+https://dl.filippo.io/age/latest?for=linux/amd64
+https://dl.filippo.io/age/v1.0.0-rc.1?for=darwin/arm64
+...
+```
+
+If your system has [a supported version of Go](https://go.dev/dl/), you can build from source.
+
+```
+go install filippo.io/age/cmd/...@latest
+```
+
+Help from new packagers is very welcome.
+
+## Usage
+
+For the full documentation, read [the age(1) man page](https://filippo.io/age/age.1).
+
+```
+Usage:
+    age [--encrypt] (-r RECIPIENT | -R PATH)... [--armor] [-o OUTPUT] [INPUT]
+    age [--encrypt] --passphrase [--armor] [-o OUTPUT] [INPUT]
+    age --decrypt [-i PATH]... [-o OUTPUT] [INPUT]
+
+Options:
+    -e, --encrypt               Encrypt the input to the output. Default if omitted.
+    -d, --decrypt               Decrypt the input to the output.
+    -o, --output OUTPUT         Write the result to the file at path OUTPUT.
+    -a, --armor                 Encrypt to a PEM encoded format.
+    -p, --passphrase            Encrypt with a passphrase.
+    -r, --recipient RECIPIENT   Encrypt to the specified RECIPIENT. Can be repeated.
+    -R, --recipients-file PATH  Encrypt to recipients listed at PATH. Can be repeated.
+    -i, --identity PATH         Use the identity file at PATH. Can be repeated.
+
+INPUT defaults to standard input, and OUTPUT defaults to standard output.
+If OUTPUT exists, it will be overwritten.
+
+RECIPIENT can be an age public key generated by age-keygen ("age1...")
+or an SSH public key ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...").
+
+Recipient files contain one or more recipients, one per line. Empty lines
+and lines starting with "#" are ignored as comments. "-" may be used to
+read recipients from standard input.
+
+Identity files contain one or more secret keys ("AGE-SECRET-KEY-1..."),
+one per line, or an SSH key. Empty lines and lines starting with "#" are
+ignored as comments. Passphrase encrypted age files can be used as
+identity files. Multiple key files can be provided, and any unused ones
+will be ignored. "-" may be used to read identities from standard input.
+
+When --encrypt is specified explicitly, -i can also be used to encrypt to an
+identity file symmetrically, instead or in addition to normal recipients.
+```
+
+### Multiple recipients
+
+Files can be encrypted to multiple recipients by repeating `-r/--recipient`. Every recipient will be able to decrypt the file.
+
+```
+$ age -o example.jpg.age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p \
+    -r age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg example.jpg
+```
+
+#### Recipient files
+
+Multiple recipients can also be listed one per line in one or more files passed with the `-R/--recipients-file` flag.
+
+```
+$ cat recipients.txt
+# Alice
+age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
+# Bob
+age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg
+$ age -R recipients.txt example.jpg > example.jpg.age
+```
+
+If the argument to `-R` (or `-i`) is `-`, the file is read from standard input.
+
+### Passphrases
+
+Files can be encrypted with a passphrase by using `-p/--passphrase`. By default age will automatically generate a secure passphrase. Passphrase protected files are automatically detected at decrypt time.
+
+```
+$ age -p secrets.txt > secrets.txt.age
+Enter passphrase (leave empty to autogenerate a secure one):
+Using the autogenerated passphrase "release-response-step-brand-wrap-ankle-pair-unusual-sword-train".
+$ age -d secrets.txt.age > secrets.txt
+Enter passphrase:
+```
+
+### Passphrase-protected key files
+
+If an identity file passed to `-i` is a passphrase encrypted age file, it will be automatically decrypted.
+
+```
+$ age-keygen | age -p > key.age
+Public key: age1yhm4gctwfmrpz87tdslm550wrx6m79y9f2hdzt0lndjnehwj0ukqrjpyx5
+Enter passphrase (leave empty to autogenerate a secure one):
+Using the autogenerated passphrase "hip-roast-boring-snake-mention-east-wasp-honey-input-actress".
+$ age -r age1yhm4gctwfmrpz87tdslm550wrx6m79y9f2hdzt0lndjnehwj0ukqrjpyx5 secrets.txt > secrets.txt.age
+$ age -d -i key.age secrets.txt.age > secrets.txt
+Enter passphrase for identity file "key.age":
+```
+
+Passphrase-protected identity files are not necessary for most use cases, where access to the encrypted identity file implies access to the whole system. However, they can be useful if the identity file is stored remotely.
+
+### SSH keys
+
+As a convenience feature, age also supports encrypting to `ssh-rsa` and `ssh-ed25519` SSH public keys, and decrypting with the respective private key file. (`ssh-agent` is not supported.)
+
+```
+$ age -R ~/.ssh/id_ed25519.pub example.jpg > example.jpg.age
+$ age -d -i ~/.ssh/id_ed25519 example.jpg.age > example.jpg
+```
+
+Note that SSH key support employs more complex cryptography, and embeds a public key tag in the encrypted file, making it possible to track files that are encrypted to a specific public key.
+
+#### Encrypting to a GitHub user
+
+Combining SSH key support and `-R`, you can easily encrypt a file to the SSH keys listed on a GitHub profile.
+
+```
+$ curl https://github.com/benjojo.keys | age -R - example.jpg > example.jpg.age
+```
+
+Keep in mind that people might not protect SSH keys long-term, since they are revokable when used only for authentication, and that SSH keys held on YubiKeys can't be used to decrypt files.

implant/vendor/filippo.io/age/age.go

@@ -0,0 +1,238 @@
+// Copyright 2019 The age Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package age implements file encryption according to the age-encryption.org/v1
+// specification.
+//
+// For most use cases, use the Encrypt and Decrypt functions with
+// X25519Recipient and X25519Identity. If passphrase encryption is required, use
+// ScryptRecipient and ScryptIdentity. For compatibility with existing SSH keys
+// use the filippo.io/age/agessh package.
+//
+// age encrypted files are binary and not malleable. For encoding them as text,
+// use the filippo.io/age/armor package.
+//
+// Key management
+//
+// age does not have a global keyring. Instead, since age keys are small,
+// textual, and cheap, you are encouraged to generate dedicated keys for each
+// task and application.
+//
+// Recipient public keys can be passed around as command line flags and in
+// config files, while secret keys should be stored in dedicated files, through
+// secret management systems, or as environment variables.
+//
+// There is no default path for age keys. Instead, they should be stored at
+// application-specific paths. The CLI supports files where private keys are
+// listed one per line, ignoring empty lines and lines starting with "#". These
+// files can be parsed with ParseIdentities.
+//
+// When integrating age into a new system, it's recommended that you only
+// support X25519 keys, and not SSH keys. The latter are supported for manual
+// encryption operations. If you need to tie into existing key management
+// infrastructure, you might want to consider implementing your own Recipient
+// and Identity.
+//
+// Backwards compatibility
+//
+// Files encrypted with a stable version (not alpha, beta, or release candidate)
+// of age, or with any v1.0.0 beta or release candidate, will decrypt with any
+// later versions of the v1 API. This might change in v2, in which case v1 will
+// be maintained with security fixes for compatibility with older files.
+//
+// If decrypting an older file poses a security risk, doing so might require an
+// explicit opt-in in the API.
+package age
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"io"
+
+	"filippo.io/age/internal/format"
+	"filippo.io/age/internal/stream"
+)
+
+// An Identity is passed to Decrypt to unwrap an opaque file key from a
+// recipient stanza. It can be for example a secret key like X25519Identity, a
+// plugin, or a custom implementation.
+//
+// Unwrap must return an error wrapping ErrIncorrectIdentity if none of the
+// recipient stanzas match the identity, any other error will be considered
+// fatal.
+//
+// Most age API users won't need to interact with this directly, and should
+// instead pass Recipient implementations to Encrypt and Identity
+// implementations to Decrypt.
+type Identity interface {
+	Unwrap(stanzas []*Stanza) (fileKey []byte, err error)
+}
+
+var ErrIncorrectIdentity = errors.New("incorrect identity for recipient block")
+
+// A Recipient is passed to Encrypt to wrap an opaque file key to one or more
+// recipient stanza(s). It can be for example a public key like X25519Recipient,
+// a plugin, or a custom implementation.
+//
+// Most age API users won't need to interact with this directly, and should
+// instead pass Recipient implementations to Encrypt and Identity
+// implementations to Decrypt.
+type Recipient interface {
+	Wrap(fileKey []byte) ([]*Stanza, error)
+}
+
+// A Stanza is a section of the age header that encapsulates the file key as
+// encrypted to a specific recipient.
+//
+// Most age API users won't need to interact with this directly, and should
+// instead pass Recipient implementations to Encrypt and Identity
+// implementations to Decrypt.
+type Stanza struct {
+	Type string
+	Args []string
+	Body []byte
+}
+
+const fileKeySize = 16
+const streamNonceSize = 16
+
+// Encrypt encrypts a file to one or more recipients.
+//
+// Writes to the returned WriteCloser are encrypted and written to dst as an age
+// file. Every recipient will be able to decrypt the file.
+//
+// The caller must call Close on the WriteCloser when done for the last chunk to
+// be encrypted and flushed to dst.
+func Encrypt(dst io.Writer, recipients ...Recipient) (io.WriteCloser, error) {
+	if len(recipients) == 0 {
+		return nil, errors.New("no recipients specified")
+	}
+
+	// As a best effort, prevent an API user from generating a file that the
+	// ScryptIdentity will refuse to decrypt. This check can't unfortunately be
+	// implemented as part of the Recipient interface, so it lives as a special
+	// case in Encrypt.
+	for _, r := range recipients {
+		if _, ok := r.(*ScryptRecipient); ok && len(recipients) != 1 {
+			return nil, errors.New("an ScryptRecipient must be the only one for the file")
+		}
+	}
+
+	fileKey := make([]byte, fileKeySize)
+	if _, err := rand.Read(fileKey); err != nil {
+		return nil, err
+	}
+
+	hdr := &format.Header{}
+	for i, r := range recipients {
+		stanzas, err := r.Wrap(fileKey)
+		if err != nil {
+			return nil, fmt.Errorf("failed to wrap key for recipient #%d: %v", i, err)
+		}
+		for _, s := range stanzas {
+			hdr.Recipients = append(hdr.Recipients, (*format.Stanza)(s))
+		}
+	}
+	if mac, err := headerMAC(fileKey, hdr); err != nil {
+		return nil, fmt.Errorf("failed to compute header MAC: %v", err)
+	} else {
+		hdr.MAC = mac
+	}
+	if err := hdr.Marshal(dst); err != nil {
+		return nil, fmt.Errorf("failed to write header: %v", err)
+	}
+
+	nonce := make([]byte, streamNonceSize)
+	if _, err := rand.Read(nonce); err != nil {
+		return nil, err
+	}
+	if _, err := dst.Write(nonce); err != nil {
+		return nil, fmt.Errorf("failed to write nonce: %v", err)
+	}
+
+	return stream.NewWriter(streamKey(fileKey, nonce), dst)
+}
+
+// NoIdentityMatchError is returned by Decrypt when none of the supplied
+// identities match the encrypted file.
+type NoIdentityMatchError struct {
+	// Errors is a slice of all the errors returned to Decrypt by the Unwrap
+	// calls it made. They all wrap ErrIncorrectIdentity.
+	Errors []error
+}
+
+func (*NoIdentityMatchError) Error() string {
+	return "no identity matched any of the recipients"
+}
+
+// Decrypt decrypts a file encrypted to one or more identities.
+//
+// It returns a Reader reading the decrypted plaintext of the age file read
+// from src. All identities will be tried until one successfully decrypts the file.
+func Decrypt(src io.Reader, identities ...Identity) (io.Reader, error) {
+	if len(identities) == 0 {
+		return nil, errors.New("no identities specified")
+	}
+
+	hdr, payload, err := format.Parse(src)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read header: %w", err)
+	}
+
+	stanzas := make([]*Stanza, 0, len(hdr.Recipients))
+	for _, s := range hdr.Recipients {
+		stanzas = append(stanzas, (*Stanza)(s))
+	}
+	errNoMatch := &NoIdentityMatchError{}
+	var fileKey []byte
+	for _, id := range identities {
+		fileKey, err = id.Unwrap(stanzas)
+		if errors.Is(err, ErrIncorrectIdentity) {
+			errNoMatch.Errors = append(errNoMatch.Errors, err)
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+
+		break
+	}
+	if fileKey == nil {
+		return nil, errNoMatch
+	}
+
+	if mac, err := headerMAC(fileKey, hdr); err != nil {
+		return nil, fmt.Errorf("failed to compute header MAC: %v", err)
+	} else if !hmac.Equal(mac, hdr.MAC) {
+		return nil, errors.New("bad header MAC")
+	}
+
+	nonce := make([]byte, streamNonceSize)
+	if _, err := io.ReadFull(payload, nonce); err != nil {
+		return nil, fmt.Errorf("failed to read nonce: %w", err)
+	}
+
+	return stream.NewReader(streamKey(fileKey, nonce), payload)
+}
+
+// multiUnwrap is a helper that implements Identity.Unwrap in terms of a
+// function that unwraps a single recipient stanza.
+func multiUnwrap(unwrap func(*Stanza) ([]byte, error), stanzas []*Stanza) ([]byte, error) {
+	for _, s := range stanzas {
+		fileKey, err := unwrap(s)
+		if errors.Is(err, ErrIncorrectIdentity) {
+			// If we ever start returning something interesting wrapping
+			// ErrIncorrectIdentity, we should let it make its way up through
+			// Decrypt into NoIdentityMatchError.Errors.
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		return fileKey, nil
+	}
+	return nil, ErrIncorrectIdentity
+}

implant/vendor/filippo.io/age/internal/bech32/bech32.go

@@ -0,0 +1,173 @@
+// Copyright (c) 2017 Takatoshi Nakagawa
+// Copyright (c) 2019 The age Authors
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+// Package bech32 is a modified version of the reference implementation of BIP173.
+package bech32
+
+import (
+	"fmt"
+	"strings"
+)
+
+var charset = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
+
+var generator = []uint32{0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3}
+
+func polymod(values []byte) uint32 {
+	chk := uint32(1)
+	for _, v := range values {
+		top := chk >> 25
+		chk = (chk & 0x1ffffff) << 5
+		chk = chk ^ uint32(v)
+		for i := 0; i < 5; i++ {
+			bit := top >> i & 1
+			if bit == 1 {
+				chk ^= generator[i]
+			}
+		}
+	}
+	return chk
+}
+
+func hrpExpand(hrp string) []byte {
+	h := []byte(strings.ToLower(hrp))
+	var ret []byte
+	for _, c := range h {
+		ret = append(ret, c>>5)
+	}
+	ret = append(ret, 0)
+	for _, c := range h {
+		ret = append(ret, c&31)
+	}
+	return ret
+}
+
+func verifyChecksum(hrp string, data []byte) bool {
+	return polymod(append(hrpExpand(hrp), data...)) == 1
+}
+
+func createChecksum(hrp string, data []byte) []byte {
+	values := append(hrpExpand(hrp), data...)
+	values = append(values, []byte{0, 0, 0, 0, 0, 0}...)
+	mod := polymod(values) ^ 1
+	ret := make([]byte, 6)
+	for p := range ret {
+		shift := 5 * (5 - p)
+		ret[p] = byte(mod>>shift) & 31
+	}
+	return ret
+}
+
+func convertBits(data []byte, frombits, tobits byte, pad bool) ([]byte, error) {
+	var ret []byte
+	acc := uint32(0)
+	bits := byte(0)
+	maxv := byte(1<<tobits - 1)
+	for idx, value := range data {
+		if value>>frombits != 0 {
+			return nil, fmt.Errorf("invalid data range: data[%d]=%d (frombits=%d)", idx, value, frombits)
+		}
+		acc = acc<<frombits | uint32(value)
+		bits += frombits
+		for bits >= tobits {
+			bits -= tobits
+			ret = append(ret, byte(acc>>bits)&maxv)
+		}
+	}
+	if pad {
+		if bits > 0 {
+			ret = append(ret, byte(acc<<(tobits-bits))&maxv)
+		}
+	} else if bits >= frombits {
+		return nil, fmt.Errorf("illegal zero padding")
+	} else if byte(acc<<(tobits-bits))&maxv != 0 {
+		return nil, fmt.Errorf("non-zero padding")
+	}
+	return ret, nil
+}
+
+// Encode encodes the HRP and a bytes slice to Bech32. If the HRP is uppercase,
+// the output will be uppercase.
+func Encode(hrp string, data []byte) (string, error) {
+	values, err := convertBits(data, 8, 5, true)
+	if err != nil {
+		return "", err
+	}
+	if len(hrp) < 1 {
+		return "", fmt.Errorf("invalid HRP: %q", hrp)
+	}
+	for p, c := range hrp {
+		if c < 33 || c > 126 {
+			return "", fmt.Errorf("invalid HRP character: hrp[%d]=%d", p, c)
+		}
+	}
+	if strings.ToUpper(hrp) != hrp && strings.ToLower(hrp) != hrp {
+		return "", fmt.Errorf("mixed case HRP: %q", hrp)
+	}
+	lower := strings.ToLower(hrp) == hrp
+	hrp = strings.ToLower(hrp)
+	var ret strings.Builder
+	ret.WriteString(hrp)
+	ret.WriteString("1")
+	for _, p := range values {
+		ret.WriteByte(charset[p])
+	}
+	for _, p := range createChecksum(hrp, values) {
+		ret.WriteByte(charset[p])
+	}
+	if lower {
+		return ret.String(), nil
+	}
+	return strings.ToUpper(ret.String()), nil
+}
+
+// Decode decodes a Bech32 string. If the string is uppercase, the HRP will be uppercase.
+func Decode(s string) (hrp string, data []byte, err error) {
+	if strings.ToLower(s) != s && strings.ToUpper(s) != s {
+		return "", nil, fmt.Errorf("mixed case")
+	}
+	pos := strings.LastIndex(s, "1")
+	if pos < 1 || pos+7 > len(s) {
+		return "", nil, fmt.Errorf("separator '1' at invalid position: pos=%d, len=%d", pos, len(s))
+	}
+	hrp = s[:pos]
+	for p, c := range hrp {
+		if c < 33 || c > 126 {
+			return "", nil, fmt.Errorf("invalid character human-readable part: s[%d]=%d", p, c)
+		}
+	}
+	s = strings.ToLower(s)
+	for p, c := range s[pos+1:] {
+		d := strings.IndexRune(charset, c)
+		if d == -1 {
+			return "", nil, fmt.Errorf("invalid character data part: s[%d]=%v", p, c)
+		}
+		data = append(data, byte(d))
+	}
+	if !verifyChecksum(hrp, data) {
+		return "", nil, fmt.Errorf("invalid checksum")
+	}
+	data, err = convertBits(data[:len(data)-6], 5, 8, false)
+	if err != nil {
+		return "", nil, err
+	}
+	return hrp, data, nil
+}

implant/vendor/filippo.io/age/internal/format/format.go

@@ -0,0 +1,311 @@
+// Copyright 2019 The age Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package format implements the age file format.
+package format
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+)
+
+type Header struct {
+	Recipients []*Stanza
+	MAC        []byte
+}
+
+// Stanza is assignable to age.Stanza, and if this package is made public,
+// age.Stanza can be made a type alias of this type.
+type Stanza struct {
+	Type string
+	Args []string
+	Body []byte
+}
+
+var b64 = base64.RawStdEncoding.Strict()
+
+func DecodeString(s string) ([]byte, error) {
+	// CR and LF are ignored by DecodeString, but we don't want any malleability.
+	if strings.ContainsAny(s, "\n\r") {
+		return nil, errors.New(`unexpected newline character`)
+	}
+	return b64.DecodeString(s)
+}
+
+var EncodeToString = b64.EncodeToString
+
+const ColumnsPerLine = 64
+
+const BytesPerLine = ColumnsPerLine / 4 * 3
+
+// NewWrappedBase64Encoder returns a WrappedBase64Encoder that writes to dst.
+func NewWrappedBase64Encoder(enc *base64.Encoding, dst io.Writer) *WrappedBase64Encoder {
+	w := &WrappedBase64Encoder{dst: dst}
+	w.enc = base64.NewEncoder(enc, WriterFunc(w.writeWrapped))
+	return w
+}
+
+type WriterFunc func(p []byte) (int, error)
+
+func (f WriterFunc) Write(p []byte) (int, error) { return f(p) }
+
+// WrappedBase64Encoder is a standard base64 encoder that inserts an LF
+// character every ColumnsPerLine bytes. It does not insert a newline neither at
+// the beginning nor at the end of the stream, but it ensures the last line is
+// shorter than ColumnsPerLine, which means it might be empty.
+type WrappedBase64Encoder struct {
+	enc     io.WriteCloser
+	dst     io.Writer
+	written int
+	buf     bytes.Buffer
+}
+
+func (w *WrappedBase64Encoder) Write(p []byte) (int, error) { return w.enc.Write(p) }
+
+func (w *WrappedBase64Encoder) Close() error {
+	return w.enc.Close()
+}
+
+func (w *WrappedBase64Encoder) writeWrapped(p []byte) (int, error) {
+	if w.buf.Len() != 0 {
+		panic("age: internal error: non-empty WrappedBase64Encoder.buf")
+	}
+	for len(p) > 0 {
+		toWrite := ColumnsPerLine - (w.written % ColumnsPerLine)
+		if toWrite > len(p) {
+			toWrite = len(p)
+		}
+		n, _ := w.buf.Write(p[:toWrite])
+		w.written += n
+		p = p[n:]
+		if w.written%ColumnsPerLine == 0 {
+			w.buf.Write([]byte("\n"))
+		}
+	}
+	if _, err := w.buf.WriteTo(w.dst); err != nil {
+		// We always return n = 0 on error because it's hard to work back to the
+		// input length that ended up written out. Not ideal, but Write errors
+		// are not recoverable anyway.
+		return 0, err
+	}
+	return len(p), nil
+}
+
+// LastLineIsEmpty returns whether the last output line was empty, either
+// because no input was written, or because a multiple of BytesPerLine was.
+//
+// Calling LastLineIsEmpty before Close is meaningless.
+func (w *WrappedBase64Encoder) LastLineIsEmpty() bool {
+	return w.written%ColumnsPerLine == 0
+}
+
+const intro = "age-encryption.org/v1\n"
+
+var stanzaPrefix = []byte("->")
+var footerPrefix = []byte("---")
+
+func (r *Stanza) Marshal(w io.Writer) error {
+	if _, err := w.Write(stanzaPrefix); err != nil {
+		return err
+	}
+	for _, a := range append([]string{r.Type}, r.Args...) {
+		if _, err := io.WriteString(w, " "+a); err != nil {
+			return err
+		}
+	}
+	if _, err := io.WriteString(w, "\n"); err != nil {
+		return err
+	}
+	ww := NewWrappedBase64Encoder(b64, w)
+	if _, err := ww.Write(r.Body); err != nil {
+		return err
+	}
+	if err := ww.Close(); err != nil {
+		return err
+	}
+	_, err := io.WriteString(w, "\n")
+	return err
+}
+
+func (h *Header) MarshalWithoutMAC(w io.Writer) error {
+	if _, err := io.WriteString(w, intro); err != nil {
+		return err
+	}
+	for _, r := range h.Recipients {
+		if err := r.Marshal(w); err != nil {
+			return err
+		}
+	}
+	_, err := fmt.Fprintf(w, "%s", footerPrefix)
+	return err
+}
+
+func (h *Header) Marshal(w io.Writer) error {
+	if err := h.MarshalWithoutMAC(w); err != nil {
+		return err
+	}
+	mac := b64.EncodeToString(h.MAC)
+	_, err := fmt.Fprintf(w, " %s\n", mac)
+	return err
+}
+
+type StanzaReader struct {
+	r   *bufio.Reader
+	err error
+}
+
+func NewStanzaReader(r *bufio.Reader) *StanzaReader {
+	return &StanzaReader{r: r}
+}
+
+func (r *StanzaReader) ReadStanza() (s *Stanza, err error) {
+	// Read errors are unrecoverable.
+	if r.err != nil {
+		return nil, r.err
+	}
+	defer func() { r.err = err }()
+
+	s = &Stanza{}
+
+	line, err := r.r.ReadBytes('\n')
+	if err != nil {
+		return nil, fmt.Errorf("failed to read line: %w", err)
+	}
+	if !bytes.HasPrefix(line, stanzaPrefix) {
+		return nil, fmt.Errorf("malformed stanza opening line: %q", line)
+	}
+	prefix, args := splitArgs(line)
+	if prefix != string(stanzaPrefix) || len(args) < 1 {
+		return nil, fmt.Errorf("malformed stanza: %q", line)
+	}
+	for _, a := range args {
+		if !isValidString(a) {
+			return nil, fmt.Errorf("malformed stanza: %q", line)
+		}
+	}
+	s.Type = args[0]
+	s.Args = args[1:]
+
+	for {
+		line, err := r.r.ReadBytes('\n')
+		if err != nil {
+			return nil, fmt.Errorf("failed to read line: %w", err)
+		}
+
+		b, err := DecodeString(strings.TrimSuffix(string(line), "\n"))
+		if err != nil {
+			if bytes.HasPrefix(line, footerPrefix) || bytes.HasPrefix(line, stanzaPrefix) {
+				return nil, fmt.Errorf("malformed body line %q: stanza ended without a short line\nNote: this might be a file encrypted with an old beta version of age or rage. Use age v1.0.0-beta6 or rage to decrypt it.", line)
+			}
+			return nil, errorf("malformed body line %q: %v", line, err)
+		}
+		if len(b) > BytesPerLine {
+			return nil, errorf("malformed body line %q: too long", line)
+		}
+		s.Body = append(s.Body, b...)
+		if len(b) < BytesPerLine {
+			// A stanza body always ends with a short line.
+			return s, nil
+		}
+	}
+}
+
+type ParseError struct {
+	err error
+}
+
+func (e *ParseError) Error() string {
+	return "parsing age header: " + e.err.Error()
+}
+
+func (e *ParseError) Unwrap() error {
+	return e.err
+}
+
+func errorf(format string, a ...interface{}) error {
+	return &ParseError{fmt.Errorf(format, a...)}
+}
+
+// Parse returns the header and a Reader that begins at the start of the
+// payload.
+func Parse(input io.Reader) (*Header, io.Reader, error) {
+	h := &Header{}
+	rr := bufio.NewReader(input)
+
+	line, err := rr.ReadString('\n')
+	if err != nil {
+		return nil, nil, errorf("failed to read intro: %w", err)
+	}
+	if line != intro {
+		return nil, nil, errorf("unexpected intro: %q", line)
+	}
+
+	sr := NewStanzaReader(rr)
+	for {
+		peek, err := rr.Peek(len(footerPrefix))
+		if err != nil {
+			return nil, nil, errorf("failed to read header: %w", err)
+		}
+
+		if bytes.Equal(peek, footerPrefix) {
+			line, err := rr.ReadBytes('\n')
+			if err != nil {
+				return nil, nil, fmt.Errorf("failed to read header: %w", err)
+			}
+
+			prefix, args := splitArgs(line)
+			if prefix != string(footerPrefix) || len(args) != 1 {
+				return nil, nil, errorf("malformed closing line: %q", line)
+			}
+			h.MAC, err = DecodeString(args[0])
+			if err != nil || len(h.MAC) != 32 {
+				return nil, nil, errorf("malformed closing line %q: %v", line, err)
+			}
+			break
+		}
+
+		s, err := sr.ReadStanza()
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to parse header: %w", err)
+		}
+		h.Recipients = append(h.Recipients, s)
+	}
+
+	// If input is a bufio.Reader, rr might be equal to input because
+	// bufio.NewReader short-circuits. In this case we can just return it (and
+	// we would end up reading the buffer twice if we prepended the peek below).
+	if rr == input {
+		return h, rr, nil
+	}
+	// Otherwise, unwind the bufio overread and return the unbuffered input.
+	buf, err := rr.Peek(rr.Buffered())
+	if err != nil {
+		return nil, nil, errorf("internal error: %v", err)
+	}
+	payload := io.MultiReader(bytes.NewReader(buf), input)
+	return h, payload, nil
+}
+
+func splitArgs(line []byte) (string, []string) {
+	l := strings.TrimSuffix(string(line), "\n")
+	parts := strings.Split(l, " ")
+	return parts[0], parts[1:]
+}
+
+func isValidString(s string) bool {
+	if len(s) == 0 {
+		return false
+	}
+	for _, c := range s {
+		if c < 33 || c > 126 {
+			return false
+		}
+	}
+	return true
+}

implant/vendor/filippo.io/age/internal/stream/stream.go

@@ -0,0 +1,231 @@
+// Copyright 2019 The age Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package stream implements a variant of the STREAM chunked encryption scheme.
+package stream
+
+import (
+	"crypto/cipher"
+	"errors"
+	"fmt"
+	"io"
+
+	"golang.org/x/crypto/chacha20poly1305"
+	"golang.org/x/crypto/poly1305"
+)
+
+const ChunkSize = 64 * 1024
+
+type Reader struct {
+	a   cipher.AEAD
+	src io.Reader
+
+	unread []byte // decrypted but unread data, backed by buf
+	buf    [encChunkSize]byte
+
+	err   error
+	nonce [chacha20poly1305.NonceSize]byte
+}
+
+const (
+	encChunkSize  = ChunkSize + poly1305.TagSize
+	lastChunkFlag = 0x01
+)
+
+func NewReader(key []byte, src io.Reader) (*Reader, error) {
+	aead, err := chacha20poly1305.New(key)
+	if err != nil {
+		return nil, err
+	}
+	return &Reader{
+		a:   aead,
+		src: src,
+	}, nil
+}
+
+func (r *Reader) Read(p []byte) (int, error) {
+	if len(r.unread) > 0 {
+		n := copy(p, r.unread)
+		r.unread = r.unread[n:]
+		return n, nil
+	}
+	if r.err != nil {
+		return 0, r.err
+	}
+	if len(p) == 0 {
+		return 0, nil
+	}
+
+	last, err := r.readChunk()
+	if err != nil {
+		r.err = err
+		return 0, err
+	}
+
+	n := copy(p, r.unread)
+	r.unread = r.unread[n:]
+
+	if last {
+		// Ensure there is an EOF after the last chunk as expected. In other
+		// words, check for trailing data after a full-length final chunk.
+		// Hopefully, the underlying reader supports returning EOF even if it
+		// had previously returned an EOF to ReadFull.
+		if _, err := r.src.Read(make([]byte, 1)); err == nil {
+			r.err = errors.New("trailing data after end of encrypted file")
+		} else if err != io.EOF {
+			r.err = fmt.Errorf("non-EOF error reading after end of encrypted file: %w", err)
+		} else {
+			r.err = io.EOF
+		}
+	}
+
+	return n, nil
+}
+
+// readChunk reads the next chunk of ciphertext from r.src and makes it available
+// in r.unread. last is true if the chunk was marked as the end of the message.
+// readChunk must not be called again after returning a last chunk or an error.
+func (r *Reader) readChunk() (last bool, err error) {
+	if len(r.unread) != 0 {
+		panic("stream: internal error: readChunk called with dirty buffer")
+	}
+
+	in := r.buf[:]
+	n, err := io.ReadFull(r.src, in)
+	switch {
+	case err == io.EOF:
+		// A message can't end without a marked chunk. This message is truncated.
+		return false, io.ErrUnexpectedEOF
+	case err == io.ErrUnexpectedEOF:
+		// The last chunk can be short, but not empty unless it's the first and
+		// only chunk.
+		if !nonceIsZero(&r.nonce) && n == r.a.Overhead() {
+			return false, errors.New("last chunk is empty, try age v1.0.0, and please consider reporting this")
+		}
+		in = in[:n]
+		last = true
+		setLastChunkFlag(&r.nonce)
+	case err != nil:
+		return false, err
+	}
+
+	outBuf := make([]byte, 0, ChunkSize)
+	out, err := r.a.Open(outBuf, r.nonce[:], in, nil)
+	if err != nil && !last {
+		// Check if this was a full-length final chunk.
+		last = true
+		setLastChunkFlag(&r.nonce)
+		out, err = r.a.Open(outBuf, r.nonce[:], in, nil)
+	}
+	if err != nil {
+		return false, errors.New("failed to decrypt and authenticate payload chunk")
+	}
+
+	incNonce(&r.nonce)
+	r.unread = r.buf[:copy(r.buf[:], out)]
+	return last, nil
+}
+
+func incNonce(nonce *[chacha20poly1305.NonceSize]byte) {
+	for i := len(nonce) - 2; i >= 0; i-- {
+		nonce[i]++
+		if nonce[i] != 0 {
+			break
+		} else if i == 0 {
+			// The counter is 88 bits, this is unreachable.
+			panic("stream: chunk counter wrapped around")
+		}
+	}
+}
+
+func setLastChunkFlag(nonce *[chacha20poly1305.NonceSize]byte) {
+	nonce[len(nonce)-1] = lastChunkFlag
+}
+
+func nonceIsZero(nonce *[chacha20poly1305.NonceSize]byte) bool {
+	return *nonce == [chacha20poly1305.NonceSize]byte{}
+}
+
+type Writer struct {
+	a         cipher.AEAD
+	dst       io.Writer
+	unwritten []byte // backed by buf
+	buf       [encChunkSize]byte
+	nonce     [chacha20poly1305.NonceSize]byte
+	err       error
+}
+
+func NewWriter(key []byte, dst io.Writer) (*Writer, error) {
+	aead, err := chacha20poly1305.New(key)
+	if err != nil {
+		return nil, err
+	}
+	w := &Writer{
+		a:   aead,
+		dst: dst,
+	}
+	w.unwritten = w.buf[:0]
+	return w, nil
+}
+
+func (w *Writer) Write(p []byte) (n int, err error) {
+	// TODO: consider refactoring with a bytes.Buffer.
+	if w.err != nil {
+		return 0, w.err
+	}
+	if len(p) == 0 {
+		return 0, nil
+	}
+
+	total := len(p)
+	for len(p) > 0 {
+		freeBuf := w.buf[len(w.unwritten):ChunkSize]
+		n := copy(freeBuf, p)
+		p = p[n:]
+		w.unwritten = w.unwritten[:len(w.unwritten)+n]
+
+		if len(w.unwritten) == ChunkSize && len(p) > 0 {
+			if err := w.flushChunk(notLastChunk); err != nil {
+				w.err = err
+				return 0, err
+			}
+		}
+	}
+	return total, nil
+}
+
+// Close flushes the last chunk. It does not close the underlying Writer.
+func (w *Writer) Close() error {
+	if w.err != nil {
+		return w.err
+	}
+
+	w.err = w.flushChunk(lastChunk)
+	if w.err != nil {
+		return w.err
+	}
+
+	w.err = errors.New("stream.Writer is already closed")
+	return nil
+}
+
+const (
+	lastChunk    = true
+	notLastChunk = false
+)
+
+func (w *Writer) flushChunk(last bool) error {
+	if !last && len(w.unwritten) != ChunkSize {
+		panic("stream: internal error: flush called with partial chunk")
+	}
+
+	if last {
+		setLastChunkFlag(&w.nonce)
+	}
+	buf := w.a.Seal(w.buf[:0], w.nonce[:], w.unwritten, nil)
+	_, err := w.dst.Write(buf)
+	w.unwritten = w.buf[:0]
+	incNonce(&w.nonce)
+	return err
+}

implant/vendor/filippo.io/age/parse.go

@@ -0,0 +1,84 @@
+// Copyright 2021 The age Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package age
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"strings"
+)
+
+// ParseIdentities parses a file with one or more private key encodings, one per
+// line. Empty lines and lines starting with "#" are ignored.
+//
+// This is the same syntax as the private key files accepted by the CLI, except
+// the CLI also accepts SSH private keys, which are not recommended for the
+// average application.
+//
+// Currently, all returned values are of type *X25519Identity, but different
+// types might be returned in the future.
+func ParseIdentities(f io.Reader) ([]Identity, error) {
+	const privateKeySizeLimit = 1 << 24 // 16 MiB
+	var ids []Identity
+	scanner := bufio.NewScanner(io.LimitReader(f, privateKeySizeLimit))
+	var n int
+	for scanner.Scan() {
+		n++
+		line := scanner.Text()
+		if strings.HasPrefix(line, "#") || line == "" {
+			continue
+		}
+		i, err := ParseX25519Identity(line)
+		if err != nil {
+			return nil, fmt.Errorf("error at line %d: %v", n, err)
+		}
+		ids = append(ids, i)
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("failed to read secret keys file: %v", err)
+	}
+	if len(ids) == 0 {
+		return nil, fmt.Errorf("no secret keys found")
+	}
+	return ids, nil
+}
+
+// ParseRecipients parses a file with one or more public key encodings, one per
+// line. Empty lines and lines starting with "#" are ignored.
+//
+// This is the same syntax as the recipients files accepted by the CLI, except
+// the CLI also accepts SSH recipients, which are not recommended for the
+// average application.
+//
+// Currently, all returned values are of type *X25519Recipient, but different
+// types might be returned in the future.
+func ParseRecipients(f io.Reader) ([]Recipient, error) {
+	const recipientFileSizeLimit = 1 << 24 // 16 MiB
+	var recs []Recipient
+	scanner := bufio.NewScanner(io.LimitReader(f, recipientFileSizeLimit))
+	var n int
+	for scanner.Scan() {
+		n++
+		line := scanner.Text()
+		if strings.HasPrefix(line, "#") || line == "" {
+			continue
+		}
+		r, err := ParseX25519Recipient(line)
+		if err != nil {
+			// Hide the error since it might unintentionally leak the contents
+			// of confidential files.
+			return nil, fmt.Errorf("malformed recipient at line %d", n)
+		}
+		recs = append(recs, r)
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("failed to read recipients file: %v", err)
+	}
+	if len(recs) == 0 {
+		return nil, fmt.Errorf("no recipients found")
+	}
+	return recs, nil
+}

implant/vendor/filippo.io/age/primitives.go

@@ -0,0 +1,72 @@
+// Copyright 2019 The age Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package age
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"errors"
+	"io"
+
+	"filippo.io/age/internal/format"
+	"golang.org/x/crypto/chacha20poly1305"
+	"golang.org/x/crypto/hkdf"
+)
+
+// aeadEncrypt encrypts a message with a one-time key.
+func aeadEncrypt(key, plaintext []byte) ([]byte, error) {
+	aead, err := chacha20poly1305.New(key)
+	if err != nil {
+		return nil, err
+	}
+	// The nonce is fixed because this function is only used in places where the
+	// spec guarantees each key is only used once (by deriving it from values
+	// that include fresh randomness), allowing us to save the overhead.
+	// For the code that encrypts the actual payload, look at the
+	// filippo.io/age/internal/stream package.
+	nonce := make([]byte, chacha20poly1305.NonceSize)
+	return aead.Seal(nil, nonce, plaintext, nil), nil
+}
+
+var errIncorrectCiphertextSize = errors.New("encrypted value has unexpected length")
+
+// aeadDecrypt decrypts a message of an expected fixed size.
+//
+// The message size is limited to mitigate multi-key attacks, where a ciphertext
+// can be crafted that decrypts successfully under multiple keys. Short
+// ciphertexts can only target two keys, which has limited impact.
+func aeadDecrypt(key []byte, size int, ciphertext []byte) ([]byte, error) {
+	aead, err := chacha20poly1305.New(key)
+	if err != nil {
+		return nil, err
+	}
+	if len(ciphertext) != size+aead.Overhead() {
+		return nil, errIncorrectCiphertextSize
+	}
+	nonce := make([]byte, chacha20poly1305.NonceSize)
+	return aead.Open(nil, nonce, ciphertext, nil)
+}
+
+func headerMAC(fileKey []byte, hdr *format.Header) ([]byte, error) {
+	h := hkdf.New(sha256.New, fileKey, nil, []byte("header"))
+	hmacKey := make([]byte, 32)
+	if _, err := io.ReadFull(h, hmacKey); err != nil {
+		return nil, err
+	}
+	hh := hmac.New(sha256.New, hmacKey)
+	if err := hdr.MarshalWithoutMAC(hh); err != nil {
+		return nil, err
+	}
+	return hh.Sum(nil), nil
+}
+
+func streamKey(fileKey, nonce []byte) []byte {
+	h := hkdf.New(sha256.New, fileKey, nonce, []byte("payload"))
+	streamKey := make([]byte, chacha20poly1305.KeySize)
+	if _, err := io.ReadFull(h, streamKey); err != nil {
+		panic("age: internal error: failed to read from HKDF: " + err.Error())
+	}
+	return streamKey
+}

implant/vendor/filippo.io/age/scrypt.go

@@ -0,0 +1,182 @@
+// Copyright 2019 The age Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package age
+
+import (
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"regexp"
+	"strconv"
+
+	"filippo.io/age/internal/format"
+	"golang.org/x/crypto/chacha20poly1305"
+	"golang.org/x/crypto/scrypt"
+)
+
+const scryptLabel = "age-encryption.org/v1/scrypt"
+
+// ScryptRecipient is a password-based recipient. Anyone with the password can
+// decrypt the message.
+//
+// If a ScryptRecipient is used, it must be the only recipient for the file: it
+// can't be mixed with other recipient types and can't be used multiple times
+// for the same file.
+//
+// Its use is not recommended for automated systems, which should prefer
+// X25519Recipient.
+type ScryptRecipient struct {
+	password   []byte
+	workFactor int
+}
+
+var _ Recipient = &ScryptRecipient{}
+
+// NewScryptRecipient returns a new ScryptRecipient with the provided password.
+func NewScryptRecipient(password string) (*ScryptRecipient, error) {
+	if len(password) == 0 {
+		return nil, errors.New("passphrase can't be empty")
+	}
+	r := &ScryptRecipient{
+		password: []byte(password),
+		// TODO: automatically scale this to 1s (with a min) in the CLI.
+		workFactor: 18, // 1s on a modern machine
+	}
+	return r, nil
+}
+
+// SetWorkFactor sets the scrypt work factor to 2^logN.
+// It must be called before Wrap.
+//
+// If SetWorkFactor is not called, a reasonable default is used.
+func (r *ScryptRecipient) SetWorkFactor(logN int) {
+	if logN > 30 || logN < 1 {
+		panic("age: SetWorkFactor called with illegal value")
+	}
+	r.workFactor = logN
+}
+
+const scryptSaltSize = 16
+
+func (r *ScryptRecipient) Wrap(fileKey []byte) ([]*Stanza, error) {
+	salt := make([]byte, scryptSaltSize)
+	if _, err := rand.Read(salt[:]); err != nil {
+		return nil, err
+	}
+
+	logN := r.workFactor
+	l := &Stanza{
+		Type: "scrypt",
+		Args: []string{format.EncodeToString(salt), strconv.Itoa(logN)},
+	}
+
+	salt = append([]byte(scryptLabel), salt...)
+	k, err := scrypt.Key(r.password, salt, 1<<logN, 8, 1, chacha20poly1305.KeySize)
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate scrypt hash: %v", err)
+	}
+
+	wrappedKey, err := aeadEncrypt(k, fileKey)
+	if err != nil {
+		return nil, err
+	}
+	l.Body = wrappedKey
+
+	return []*Stanza{l}, nil
+}
+
+// ScryptIdentity is a password-based identity.
+type ScryptIdentity struct {
+	password      []byte
+	maxWorkFactor int
+}
+
+var _ Identity = &ScryptIdentity{}
+
+// NewScryptIdentity returns a new ScryptIdentity with the provided password.
+func NewScryptIdentity(password string) (*ScryptIdentity, error) {
+	if len(password) == 0 {
+		return nil, errors.New("passphrase can't be empty")
+	}
+	i := &ScryptIdentity{
+		password:      []byte(password),
+		maxWorkFactor: 22, // 15s on a modern machine
+	}
+	return i, nil
+}
+
+// SetMaxWorkFactor sets the maximum accepted scrypt work factor to 2^logN.
+// It must be called before Unwrap.
+//
+// This caps the amount of work that Decrypt might have to do to process
+// received files. If SetMaxWorkFactor is not called, a fairly high default is
+// used, which might not be suitable for systems processing untrusted files.
+func (i *ScryptIdentity) SetMaxWorkFactor(logN int) {
+	if logN > 30 || logN < 1 {
+		panic("age: SetMaxWorkFactor called with illegal value")
+	}
+	i.maxWorkFactor = logN
+}
+
+func (i *ScryptIdentity) Unwrap(stanzas []*Stanza) ([]byte, error) {
+	for _, s := range stanzas {
+		if s.Type == "scrypt" && len(stanzas) != 1 {
+			return nil, errors.New("an scrypt recipient must be the only one")
+		}
+	}
+	return multiUnwrap(i.unwrap, stanzas)
+}
+
+var digitsRe = regexp.MustCompile(`^[1-9][0-9]*$`)
+
+func (i *ScryptIdentity) unwrap(block *Stanza) ([]byte, error) {
+	if block.Type != "scrypt" {
+		return nil, ErrIncorrectIdentity
+	}
+	if len(block.Args) != 2 {
+		return nil, errors.New("invalid scrypt recipient block")
+	}
+	salt, err := format.DecodeString(block.Args[0])
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse scrypt salt: %v", err)
+	}
+	if len(salt) != scryptSaltSize {
+		return nil, errors.New("invalid scrypt recipient block")
+	}
+	if w := block.Args[1]; !digitsRe.MatchString(w) {
+		return nil, fmt.Errorf("scrypt work factor encoding invalid: %q", w)
+	}
+	logN, err := strconv.Atoi(block.Args[1])
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse scrypt work factor: %v", err)
+	}
+	if logN > i.maxWorkFactor {
+		return nil, fmt.Errorf("scrypt work factor too large: %v", logN)
+	}
+	if logN <= 0 { // unreachable
+		return nil, fmt.Errorf("invalid scrypt work factor: %v", logN)
+	}
+
+	salt = append([]byte(scryptLabel), salt...)
+	k, err := scrypt.Key(i.password, salt, 1<<logN, 8, 1, chacha20poly1305.KeySize)
+	if err != nil { // unreachable
+		return nil, fmt.Errorf("failed to generate scrypt hash: %v", err)
+	}
+
+	// This AEAD is not robust, so an attacker could craft a message that
+	// decrypts under two different keys (meaning two different passphrases) and
+	// then use an error side-channel in an online decryption oracle to learn if
+	// either key is correct. This is deemed acceptable because the use case (an
+	// online decryption oracle) is not recommended, and the security loss is
+	// only one bit. This also does not bypass any scrypt work, although that work
+	// can be precomputed in an online oracle scenario.
+	fileKey, err := aeadDecrypt(k, fileKeySize, block.Body)
+	if err == errIncorrectCiphertextSize {
+		return nil, errors.New("invalid scrypt recipient block: incorrect file key size")
+	} else if err != nil {
+		return nil, ErrIncorrectIdentity
+	}
+	return fileKey, nil
+}

implant/vendor/filippo.io/age/x25519.go

@@ -0,0 +1,208 @@
+// Copyright 2019 The age Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package age
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+
+	"filippo.io/age/internal/bech32"
+	"filippo.io/age/internal/format"
+	"golang.org/x/crypto/chacha20poly1305"
+	"golang.org/x/crypto/curve25519"
+	"golang.org/x/crypto/hkdf"
+)
+
+const x25519Label = "age-encryption.org/v1/X25519"
+
+// X25519Recipient is the standard age public key. Messages encrypted to this
+// recipient can be decrypted with the corresponding X25519Identity.
+//
+// This recipient is anonymous, in the sense that an attacker can't tell from
+// the message alone if it is encrypted to a certain recipient.
+type X25519Recipient struct {
+	theirPublicKey []byte
+}
+
+var _ Recipient = &X25519Recipient{}
+
+// newX25519RecipientFromPoint returns a new X25519Recipient from a raw Curve25519 point.
+func newX25519RecipientFromPoint(publicKey []byte) (*X25519Recipient, error) {
+	if len(publicKey) != curve25519.PointSize {
+		return nil, errors.New("invalid X25519 public key")
+	}
+	r := &X25519Recipient{
+		theirPublicKey: make([]byte, curve25519.PointSize),
+	}
+	copy(r.theirPublicKey, publicKey)
+	return r, nil
+}
+
+// ParseX25519Recipient returns a new X25519Recipient from a Bech32 public key
+// encoding with the "age1" prefix.
+func ParseX25519Recipient(s string) (*X25519Recipient, error) {
+	t, k, err := bech32.Decode(s)
+	if err != nil {
+		return nil, fmt.Errorf("malformed recipient %q: %v", s, err)
+	}
+	if t != "age" {
+		return nil, fmt.Errorf("malformed recipient %q: invalid type %q", s, t)
+	}
+	r, err := newX25519RecipientFromPoint(k)
+	if err != nil {
+		return nil, fmt.Errorf("malformed recipient %q: %v", s, err)
+	}
+	return r, nil
+}
+
+func (r *X25519Recipient) Wrap(fileKey []byte) ([]*Stanza, error) {
+	ephemeral := make([]byte, curve25519.ScalarSize)
+	if _, err := rand.Read(ephemeral); err != nil {
+		return nil, err
+	}
+	ourPublicKey, err := curve25519.X25519(ephemeral, curve25519.Basepoint)
+	if err != nil {
+		return nil, err
+	}
+
+	sharedSecret, err := curve25519.X25519(ephemeral, r.theirPublicKey)
+	if err != nil {
+		return nil, err
+	}
+
+	l := &Stanza{
+		Type: "X25519",
+		Args: []string{format.EncodeToString(ourPublicKey)},
+	}
+
+	salt := make([]byte, 0, len(ourPublicKey)+len(r.theirPublicKey))
+	salt = append(salt, ourPublicKey...)
+	salt = append(salt, r.theirPublicKey...)
+	h := hkdf.New(sha256.New, sharedSecret, salt, []byte(x25519Label))
+	wrappingKey := make([]byte, chacha20poly1305.KeySize)
+	if _, err := io.ReadFull(h, wrappingKey); err != nil {
+		return nil, err
+	}
+
+	wrappedKey, err := aeadEncrypt(wrappingKey, fileKey)
+	if err != nil {
+		return nil, err
+	}
+	l.Body = wrappedKey
+
+	return []*Stanza{l}, nil
+}
+
+// String returns the Bech32 public key encoding of r.
+func (r *X25519Recipient) String() string {
+	s, _ := bech32.Encode("age", r.theirPublicKey)
+	return s
+}
+
+// X25519Identity is the standard age private key, which can decrypt messages
+// encrypted to the corresponding X25519Recipient.
+type X25519Identity struct {
+	secretKey, ourPublicKey []byte
+}
+
+var _ Identity = &X25519Identity{}
+
+// newX25519IdentityFromScalar returns a new X25519Identity from a raw Curve25519 scalar.
+func newX25519IdentityFromScalar(secretKey []byte) (*X25519Identity, error) {
+	if len(secretKey) != curve25519.ScalarSize {
+		return nil, errors.New("invalid X25519 secret key")
+	}
+	i := &X25519Identity{
+		secretKey: make([]byte, curve25519.ScalarSize),
+	}
+	copy(i.secretKey, secretKey)
+	i.ourPublicKey, _ = curve25519.X25519(i.secretKey, curve25519.Basepoint)
+	return i, nil
+}
+
+// GenerateX25519Identity randomly generates a new X25519Identity.
+func GenerateX25519Identity() (*X25519Identity, error) {
+	secretKey := make([]byte, curve25519.ScalarSize)
+	if _, err := rand.Read(secretKey); err != nil {
+		return nil, fmt.Errorf("internal error: %v", err)
+	}
+	return newX25519IdentityFromScalar(secretKey)
+}
+
+// ParseX25519Identity returns a new X25519Identity from a Bech32 private key
+// encoding with the "AGE-SECRET-KEY-1" prefix.
+func ParseX25519Identity(s string) (*X25519Identity, error) {
+	t, k, err := bech32.Decode(s)
+	if err != nil {
+		return nil, fmt.Errorf("malformed secret key: %v", err)
+	}
+	if t != "AGE-SECRET-KEY-" {
+		return nil, fmt.Errorf("malformed secret key: unknown type %q", t)
+	}
+	r, err := newX25519IdentityFromScalar(k)
+	if err != nil {
+		return nil, fmt.Errorf("malformed secret key: %v", err)
+	}
+	return r, nil
+}
+
+func (i *X25519Identity) Unwrap(stanzas []*Stanza) ([]byte, error) {
+	return multiUnwrap(i.unwrap, stanzas)
+}
+
+func (i *X25519Identity) unwrap(block *Stanza) ([]byte, error) {
+	if block.Type != "X25519" {
+		return nil, ErrIncorrectIdentity
+	}
+	if len(block.Args) != 1 {
+		return nil, errors.New("invalid X25519 recipient block")
+	}
+	publicKey, err := format.DecodeString(block.Args[0])
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse X25519 recipient: %v", err)
+	}
+	if len(publicKey) != curve25519.PointSize {
+		return nil, errors.New("invalid X25519 recipient block")
+	}
+
+	sharedSecret, err := curve25519.X25519(i.secretKey, publicKey)
+	if err != nil {
+		return nil, fmt.Errorf("invalid X25519 recipient: %v", err)
+	}
+
+	salt := make([]byte, 0, len(publicKey)+len(i.ourPublicKey))
+	salt = append(salt, publicKey...)
+	salt = append(salt, i.ourPublicKey...)
+	h := hkdf.New(sha256.New, sharedSecret, salt, []byte(x25519Label))
+	wrappingKey := make([]byte, chacha20poly1305.KeySize)
+	if _, err := io.ReadFull(h, wrappingKey); err != nil {
+		return nil, err
+	}
+
+	fileKey, err := aeadDecrypt(wrappingKey, fileKeySize, block.Body)
+	if err == errIncorrectCiphertextSize {
+		return nil, errors.New("invalid X25519 recipient block: incorrect file key size")
+	} else if err != nil {
+		return nil, ErrIncorrectIdentity
+	}
+	return fileKey, nil
+}
+
+// Recipient returns the public X25519Recipient value corresponding to i.
+func (i *X25519Identity) Recipient() *X25519Recipient {
+	r := &X25519Recipient{}
+	r.theirPublicKey = i.ourPublicKey
+	return r
+}
+
+// String returns the Bech32 private key encoding of i.
+func (i *X25519Identity) String() string {
+	s, _ := bech32.Encode("AGE-SECRET-KEY-", i.secretKey)
+	return strings.ToUpper(s)
+}

implant/vendor/github.com/Microsoft/go-winio/pkg/guid/guid.go

@@ -1,5 +1,3 @@
-// +build windows
-
 // Package guid provides a GUID type. The backing structure for a GUID is
 // identical to that used by the golang.org/x/sys/windows GUID type.
 // There are two main binary encodings used for a GUID, the big-endian encoding,
@@ -9,26 +7,26 @@ package guid
 
 import (
 	"crypto/rand"
-	"crypto/sha1"
+	"crypto/sha1" //nolint:gosec // not used for secure application
 	"encoding"
 	"encoding/binary"
 	"fmt"
 	"strconv"
-
-	"golang.org/x/sys/windows"
 )
 
+//go:generate go run golang.org/x/tools/cmd/stringer -type=Variant -trimprefix=Variant -linecomment
+
 // Variant specifies which GUID variant (or "type") of the GUID. It determines
 // how the entirety of the rest of the GUID is interpreted.
 type Variant uint8
 
-// The variants specified by RFC 4122.
+// The variants specified by RFC 4122 section 4.1.1.
 const (
 	// VariantUnknown specifies a GUID variant which does not conform to one of
 	// the variant encodings specified in RFC 4122.
 	VariantUnknown Variant = iota
 	VariantNCS
-	VariantRFC4122
+	VariantRFC4122 // RFC 4122
 	VariantMicrosoft
 	VariantFuture
 )
@@ -38,16 +36,13 @@ const (
 // hash of an input string.
 type Version uint8
 
+func (v Version) String() string {
+	return strconv.FormatUint(uint64(v), 10)
+}
+
 var _ = (encoding.TextMarshaler)(GUID{})
 var _ = (encoding.TextUnmarshaler)(&GUID{})
 
-// GUID represents a GUID/UUID. It has the same structure as
-// golang.org/x/sys/windows.GUID so that it can be used with functions expecting
-// that type. It is defined as its own type so that stringification and
-// marshaling can be supported. The representation matches that used by native
-// Windows code.
-type GUID windows.GUID
-
 // NewV4 returns a new version 4 (pseudorandom) GUID, as defined by RFC 4122.
 func NewV4() (GUID, error) {
 	var b [16]byte
@@ -70,7 +65,7 @@ func NewV4() (GUID, error) {
 // big-endian UTF16 stream of bytes. If that is desired, the string can be
 // encoded as such before being passed to this function.
 func NewV5(namespace GUID, name []byte) (GUID, error) {
-	b := sha1.New()
+	b := sha1.New() //nolint:gosec // not used for secure application
 	namespaceBytes := namespace.ToArray()
 	b.Write(namespaceBytes[:])
 	b.Write(name)

implant/vendor/github.com/Microsoft/go-winio/pkg/guid/guid_nonwindows.go

@@ -0,0 +1,16 @@
+//go:build !windows
+// +build !windows
+
+package guid
+
+// GUID represents a GUID/UUID. It has the same structure as
+// golang.org/x/sys/windows.GUID so that it can be used with functions expecting
+// that type. It is defined as its own type as that is only available to builds
+// targeted at `windows`. The representation matches that used by native Windows
+// code.
+type GUID struct {
+	Data1 uint32
+	Data2 uint16
+	Data3 uint16
+	Data4 [8]byte
+}

implant/vendor/github.com/Microsoft/go-winio/pkg/guid/guid_windows.go

@@ -0,0 +1,13 @@
+//go:build windows
+// +build windows
+
+package guid
+
+import "golang.org/x/sys/windows"
+
+// GUID represents a GUID/UUID. It has the same structure as
+// golang.org/x/sys/windows.GUID so that it can be used with functions expecting
+// that type. It is defined as its own type so that stringification and
+// marshaling can be supported. The representation matches that used by native
+// Windows code.
+type GUID windows.GUID

implant/vendor/github.com/Microsoft/go-winio/pkg/guid/variant_string.go

@@ -0,0 +1,27 @@
+// Code generated by "stringer -type=Variant -trimprefix=Variant -linecomment"; DO NOT EDIT.
+
+package guid
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[VariantUnknown-0]
+	_ = x[VariantNCS-1]
+	_ = x[VariantRFC4122-2]
+	_ = x[VariantMicrosoft-3]
+	_ = x[VariantFuture-4]
+}
+
+const _Variant_name = "UnknownNCSRFC 4122MicrosoftFuture"
+
+var _Variant_index = [...]uint8{0, 7, 10, 18, 27, 33}
+
+func (i Variant) String() string {
+	if i >= Variant(len(_Variant_index)-1) {
+		return "Variant(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _Variant_name[_Variant_index[i]:_Variant_index[i+1]]
+}

implant/vendor/github.com/boombuler/barcode/.gitignore

@@ -1 +0,0 @@
-.vscode/

implant/vendor/github.com/boombuler/barcode/README.md

@@ -1,53 +0,0 @@
-[![Join the chat at https://gitter.im/golang-barcode/Lobby](https://badges.gitter.im/golang-barcode/Lobby.svg)](https://gitter.im/golang-barcode/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
-
-## Introduction ##
-
-This is a package for GO which can be used to create different types of barcodes.
-
-## Supported Barcode Types ##
-* 2 of 5
-* Aztec Code
-* Codabar
-* Code 128
-* Code 39
-* Code 93
-* Datamatrix
-* EAN 13
-* EAN 8
-* PDF 417
-* QR Code
-
-## Example ##
-
-This is a simple example on how to create a QR-Code and write it to a png-file
-```go
-package main
-
-import (
-	"image/png"
-	"os"
-
-	"github.com/boombuler/barcode"
-	"github.com/boombuler/barcode/qr"
-)
-
-func main() {
-	// Create the barcode
-	qrCode, _ := qr.Encode("Hello World", qr.M, qr.Auto)
-
-	// Scale the barcode to 200x200 pixels
-	qrCode, _ = barcode.Scale(qrCode, 200, 200)
-
-	// create the output file
-	file, _ := os.Create("qrcode.png")
-	defer file.Close()
-
-	// encode the barcode as png
-	png.Encode(file, qrCode)
-}
-```
-
-## Documentation ##
-See [GoDoc](https://godoc.org/github.com/boombuler/barcode)
-
-To create a barcode use the Encode function from one of the subpackages.

implant/vendor/github.com/boombuler/barcode/barcode.go

@@ -1,42 +0,0 @@
-package barcode
-
-import "image"
-
-const (
-	TypeAztec           = "Aztec"
-	TypeCodabar         = "Codabar"
-	TypeCode128         = "Code 128"
-	TypeCode39          = "Code 39"
-	TypeCode93          = "Code 93"
-	TypeDataMatrix      = "DataMatrix"
-	TypeEAN8            = "EAN 8"
-	TypeEAN13           = "EAN 13"
-	TypePDF             = "PDF417"
-	TypeQR              = "QR Code"
-	Type2of5            = "2 of 5"
-	Type2of5Interleaved = "2 of 5 (interleaved)"
-)
-
-// Contains some meta information about a barcode
-type Metadata struct {
-	// the name of the barcode kind
-	CodeKind string
-	// contains 1 for 1D barcodes or 2 for 2D barcodes
-	Dimensions byte
-}
-
-// a rendered and encoded barcode
-type Barcode interface {
-	image.Image
-	// returns some meta information about the barcode
-	Metadata() Metadata
-	// the data that was encoded in this barcode
-	Content() string
-}
-
-// Additional interface that some barcodes might implement to provide
-// the value of its checksum.
-type BarcodeIntCS interface {
-	Barcode
-	CheckSum() int
-}

implant/vendor/github.com/boombuler/barcode/qr/alphanumeric.go

@@ -1,66 +0,0 @@
-package qr
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-
-	"github.com/boombuler/barcode/utils"
-)
-
-const charSet string = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ $%*+-./:"
-
-func stringToAlphaIdx(content string) <-chan int {
-	result := make(chan int)
-	go func() {
-		for _, r := range content {
-			idx := strings.IndexRune(charSet, r)
-			result <- idx
-			if idx < 0 {
-				break
-			}
-		}
-		close(result)
-	}()
-
-	return result
-}
-
-func encodeAlphaNumeric(content string, ecl ErrorCorrectionLevel) (*utils.BitList, *versionInfo, error) {
-
-	contentLenIsOdd := len(content)%2 == 1
-	contentBitCount := (len(content) / 2) * 11
-	if contentLenIsOdd {
-		contentBitCount += 6
-	}
-	vi := findSmallestVersionInfo(ecl, alphaNumericMode, contentBitCount)
-	if vi == nil {
-		return nil, nil, errors.New("To much data to encode")
-	}
-
-	res := new(utils.BitList)
-	res.AddBits(int(alphaNumericMode), 4)
-	res.AddBits(len(content), vi.charCountBits(alphaNumericMode))
-
-	encoder := stringToAlphaIdx(content)
-
-	for idx := 0; idx < len(content)/2; idx++ {
-		c1 := <-encoder
-		c2 := <-encoder
-		if c1 < 0 || c2 < 0 {
-			return nil, nil, fmt.Errorf("\"%s\" can not be encoded as %s", content, AlphaNumeric)
-		}
-		res.AddBits(c1*45+c2, 11)
-	}
-	if contentLenIsOdd {
-		c := <-encoder
-		if c < 0 {
-			return nil, nil, fmt.Errorf("\"%s\" can not be encoded as %s", content, AlphaNumeric)
-		}
-		res.AddBits(c, 6)
-	}
-
-	addPaddingAndTerminator(res, vi)
-
-	return res, vi, nil
-}

implant/vendor/github.com/boombuler/barcode/qr/automatic.go

@@ -1,23 +0,0 @@
-package qr
-
-import (
-	"fmt"
-
-	"github.com/boombuler/barcode/utils"
-)
-
-func encodeAuto(content string, ecl ErrorCorrectionLevel) (*utils.BitList, *versionInfo, error) {
-	bits, vi, _ := Numeric.getEncoder()(content, ecl)
-	if bits != nil && vi != nil {
-		return bits, vi, nil
-	}
-	bits, vi, _ = AlphaNumeric.getEncoder()(content, ecl)
-	if bits != nil && vi != nil {
-		return bits, vi, nil
-	}
-	bits, vi, _ = Unicode.getEncoder()(content, ecl)
-	if bits != nil && vi != nil {
-		return bits, vi, nil
-	}
-	return nil, nil, fmt.Errorf("No encoding found to encode \"%s\"", content)
-}

implant/vendor/github.com/boombuler/barcode/qr/blocks.go

@@ -1,59 +0,0 @@
-package qr
-
-type block struct {
-	data []byte
-	ecc  []byte
-}
-type blockList []*block
-
-func splitToBlocks(data <-chan byte, vi *versionInfo) blockList {
-	result := make(blockList, vi.NumberOfBlocksInGroup1+vi.NumberOfBlocksInGroup2)
-
-	for b := 0; b < int(vi.NumberOfBlocksInGroup1); b++ {
-		blk := new(block)
-		blk.data = make([]byte, vi.DataCodeWordsPerBlockInGroup1)
-		for cw := 0; cw < int(vi.DataCodeWordsPerBlockInGroup1); cw++ {
-			blk.data[cw] = <-data
-		}
-		blk.ecc = ec.calcECC(blk.data, vi.ErrorCorrectionCodewordsPerBlock)
-		result[b] = blk
-	}
-
-	for b := 0; b < int(vi.NumberOfBlocksInGroup2); b++ {
-		blk := new(block)
-		blk.data = make([]byte, vi.DataCodeWordsPerBlockInGroup2)
-		for cw := 0; cw < int(vi.DataCodeWordsPerBlockInGroup2); cw++ {
-			blk.data[cw] = <-data
-		}
-		blk.ecc = ec.calcECC(blk.data, vi.ErrorCorrectionCodewordsPerBlock)
-		result[int(vi.NumberOfBlocksInGroup1)+b] = blk
-	}
-
-	return result
-}
-
-func (bl blockList) interleave(vi *versionInfo) []byte {
-	var maxCodewordCount int
-	if vi.DataCodeWordsPerBlockInGroup1 > vi.DataCodeWordsPerBlockInGroup2 {
-		maxCodewordCount = int(vi.DataCodeWordsPerBlockInGroup1)
-	} else {
-		maxCodewordCount = int(vi.DataCodeWordsPerBlockInGroup2)
-	}
-	resultLen := (vi.DataCodeWordsPerBlockInGroup1+vi.ErrorCorrectionCodewordsPerBlock)*vi.NumberOfBlocksInGroup1 +
-		(vi.DataCodeWordsPerBlockInGroup2+vi.ErrorCorrectionCodewordsPerBlock)*vi.NumberOfBlocksInGroup2
-
-	result := make([]byte, 0, resultLen)
-	for i := 0; i < maxCodewordCount; i++ {
-		for b := 0; b < len(bl); b++ {
-			if len(bl[b].data) > i {
-				result = append(result, bl[b].data[i])
-			}
-		}
-	}
-	for i := 0; i < int(vi.ErrorCorrectionCodewordsPerBlock); i++ {
-		for b := 0; b < len(bl); b++ {
-			result = append(result, bl[b].ecc[i])
-		}
-	}
-	return result
-}

implant/vendor/github.com/boombuler/barcode/qr/encoder.go

@@ -1,416 +0,0 @@
-// Package qr can be used to create QR barcodes.
-package qr
-
-import (
-	"image"
-
-	"github.com/boombuler/barcode"
-	"github.com/boombuler/barcode/utils"
-)
-
-type encodeFn func(content string, eccLevel ErrorCorrectionLevel) (*utils.BitList, *versionInfo, error)
-
-// Encoding mode for QR Codes.
-type Encoding byte
-
-const (
-	// Auto will choose ths best matching encoding
-	Auto Encoding = iota
-	// Numeric encoding only encodes numbers [0-9]
-	Numeric
-	// AlphaNumeric encoding only encodes uppercase letters, numbers and  [Space], $, %, *, +, -, ., /, :
-	AlphaNumeric
-	// Unicode encoding encodes the string as utf-8
-	Unicode
-	// only for testing purpose
-	unknownEncoding
-)
-
-func (e Encoding) getEncoder() encodeFn {
-	switch e {
-	case Auto:
-		return encodeAuto
-	case Numeric:
-		return encodeNumeric
-	case AlphaNumeric:
-		return encodeAlphaNumeric
-	case Unicode:
-		return encodeUnicode
-	}
-	return nil
-}
-
-func (e Encoding) String() string {
-	switch e {
-	case Auto:
-		return "Auto"
-	case Numeric:
-		return "Numeric"
-	case AlphaNumeric:
-		return "AlphaNumeric"
-	case Unicode:
-		return "Unicode"
-	}
-	return ""
-}
-
-// Encode returns a QR barcode with the given content, error correction level and uses the given encoding
-func Encode(content string, level ErrorCorrectionLevel, mode Encoding) (barcode.Barcode, error) {
-	bits, vi, err := mode.getEncoder()(content, level)
-	if err != nil {
-		return nil, err
-	}
-
-	blocks := splitToBlocks(bits.IterateBytes(), vi)
-	data := blocks.interleave(vi)
-	result := render(data, vi)
-	result.content = content
-	return result, nil
-}
-
-func render(data []byte, vi *versionInfo) *qrcode {
-	dim := vi.modulWidth()
-	results := make([]*qrcode, 8)
-	for i := 0; i < 8; i++ {
-		results[i] = newBarcode(dim)
-	}
-
-	occupied := newBarcode(dim)
-
-	setAll := func(x int, y int, val bool) {
-		occupied.Set(x, y, true)
-		for i := 0; i < 8; i++ {
-			results[i].Set(x, y, val)
-		}
-	}
-
-	drawFinderPatterns(vi, setAll)
-	drawAlignmentPatterns(occupied, vi, setAll)
-
-	//Timing Pattern:
-	var i int
-	for i = 0; i < dim; i++ {
-		if !occupied.Get(i, 6) {
-			setAll(i, 6, i%2 == 0)
-		}
-		if !occupied.Get(6, i) {
-			setAll(6, i, i%2 == 0)
-		}
-	}
-	// Dark Module
-	setAll(8, dim-8, true)
-
-	drawVersionInfo(vi, setAll)
-	drawFormatInfo(vi, -1, occupied.Set)
-	for i := 0; i < 8; i++ {
-		drawFormatInfo(vi, i, results[i].Set)
-	}
-
-	// Write the data
-	var curBitNo int
-
-	for pos := range iterateModules(occupied) {
-		var curBit bool
-		if curBitNo < len(data)*8 {
-			curBit = ((data[curBitNo/8] >> uint(7-(curBitNo%8))) & 1) == 1
-		} else {
-			curBit = false
-		}
-
-		for i := 0; i < 8; i++ {
-			setMasked(pos.X, pos.Y, curBit, i, results[i].Set)
-		}
-		curBitNo++
-	}
-
-	lowestPenalty := ^uint(0)
-	lowestPenaltyIdx := -1
-	for i := 0; i < 8; i++ {
-		p := results[i].calcPenalty()
-		if p < lowestPenalty {
-			lowestPenalty = p
-			lowestPenaltyIdx = i
-		}
-	}
-	return results[lowestPenaltyIdx]
-}
-
-func setMasked(x, y int, val bool, mask int, set func(int, int, bool)) {
-	switch mask {
-	case 0:
-		val = val != (((y + x) % 2) == 0)
-		break
-	case 1:
-		val = val != ((y % 2) == 0)
-		break
-	case 2:
-		val = val != ((x % 3) == 0)
-		break
-	case 3:
-		val = val != (((y + x) % 3) == 0)
-		break
-	case 4:
-		val = val != (((y/2 + x/3) % 2) == 0)
-		break
-	case 5:
-		val = val != (((y*x)%2)+((y*x)%3) == 0)
-		break
-	case 6:
-		val = val != ((((y*x)%2)+((y*x)%3))%2 == 0)
-		break
-	case 7:
-		val = val != ((((y+x)%2)+((y*x)%3))%2 == 0)
-	}
-	set(x, y, val)
-}
-
-func iterateModules(occupied *qrcode) <-chan image.Point {
-	result := make(chan image.Point)
-	allPoints := make(chan image.Point)
-	go func() {
-		curX := occupied.dimension - 1
-		curY := occupied.dimension - 1
-		isUpward := true
-
-		for true {
-			if isUpward {
-				allPoints <- image.Pt(curX, curY)
-				allPoints <- image.Pt(curX-1, curY)
-				curY--
-				if curY < 0 {
-					curY = 0
-					curX -= 2
-					if curX == 6 {
-						curX--
-					}
-					if curX < 0 {
-						break
-					}
-					isUpward = false
-				}
-			} else {
-				allPoints <- image.Pt(curX, curY)
-				allPoints <- image.Pt(curX-1, curY)
-				curY++
-				if curY >= occupied.dimension {
-					curY = occupied.dimension - 1
-					curX -= 2
-					if curX == 6 {
-						curX--
-					}
-					isUpward = true
-					if curX < 0 {
-						break
-					}
-				}
-			}
-		}
-
-		close(allPoints)
-	}()
-	go func() {
-		for pt := range allPoints {
-			if !occupied.Get(pt.X, pt.Y) {
-				result <- pt
-			}
-		}
-		close(result)
-	}()
-	return result
-}
-
-func drawFinderPatterns(vi *versionInfo, set func(int, int, bool)) {
-	dim := vi.modulWidth()
-	drawPattern := func(xoff int, yoff int) {
-		for x := -1; x < 8; x++ {
-			for y := -1; y < 8; y++ {
-				val := (x == 0 || x == 6 || y == 0 || y == 6 || (x > 1 && x < 5 && y > 1 && y < 5)) && (x <= 6 && y <= 6 && x >= 0 && y >= 0)
-
-				if x+xoff >= 0 && x+xoff < dim && y+yoff >= 0 && y+yoff < dim {
-					set(x+xoff, y+yoff, val)
-				}
-			}
-		}
-	}
-	drawPattern(0, 0)
-	drawPattern(0, dim-7)
-	drawPattern(dim-7, 0)
-}
-
-func drawAlignmentPatterns(occupied *qrcode, vi *versionInfo, set func(int, int, bool)) {
-	drawPattern := func(xoff int, yoff int) {
-		for x := -2; x <= 2; x++ {
-			for y := -2; y <= 2; y++ {
-				val := x == -2 || x == 2 || y == -2 || y == 2 || (x == 0 && y == 0)
-				set(x+xoff, y+yoff, val)
-			}
-		}
-	}
-	positions := vi.alignmentPatternPlacements()
-
-	for _, x := range positions {
-		for _, y := range positions {
-			if occupied.Get(x, y) {
-				continue
-			}
-			drawPattern(x, y)
-		}
-	}
-}
-
-var formatInfos = map[ErrorCorrectionLevel]map[int][]bool{
-	L: {
-		0: []bool{true, true, true, false, true, true, true, true, true, false, false, false, true, false, false},
-		1: []bool{true, true, true, false, false, true, false, true, true, true, true, false, false, true, true},
-		2: []bool{true, true, true, true, true, false, true, true, false, true, false, true, false, true, false},
-		3: []bool{true, true, true, true, false, false, false, true, false, false, true, true, true, false, true},
-		4: []bool{true, true, false, false, true, true, false, false, false, true, false, true, true, true, true},
-		5: []bool{true, true, false, false, false, true, true, false, false, false, true, true, false, false, false},
-		6: []bool{true, true, false, true, true, false, false, false, true, false, false, false, false, false, true},
-		7: []bool{true, true, false, true, false, false, true, false, true, true, true, false, true, true, false},
-	},
-	M: {
-		0: []bool{true, false, true, false, true, false, false, false, false, false, true, false, false, true, false},
-		1: []bool{true, false, true, false, false, false, true, false, false, true, false, false, true, false, true},
-		2: []bool{true, false, true, true, true, true, false, false, true, true, true, true, true, false, false},
-		3: []bool{true, false, true, true, false, true, true, false, true, false, false, true, false, true, true},
-		4: []bool{true, false, false, false, true, false, true, true, true, true, true, true, false, false, true},
-		5: []bool{true, false, false, false, false, false, false, true, true, false, false, true, true, true, false},
-		6: []bool{true, false, false, true, true, true, true, true, false, false, true, false, true, true, true},
-		7: []bool{true, false, false, true, false, true, false, true, false, true, false, false, false, false, false},
-	},
-	Q: {
-		0: []bool{false, true, true, false, true, false, true, false, true, false, true, true, true, true, true},
-		1: []bool{false, true, true, false, false, false, false, false, true, true, false, true, false, false, false},
-		2: []bool{false, true, true, true, true, true, true, false, false, true, true, false, false, false, true},
-		3: []bool{false, true, true, true, false, true, false, false, false, false, false, false, true, true, false},
-		4: []bool{false, true, false, false, true, false, false, true, false, true, true, false, true, false, false},
-		5: []bool{false, true, false, false, false, false, true, true, false, false, false, false, false, true, true},
-		6: []bool{false, true, false, true, true, true, false, true, true, false, true, true, false, true, false},
-		7: []bool{false, true, false, true, false, true, true, true, true, true, false, true, true, false, true},
-	},
-	H: {
-		0: []bool{false, false, true, false, true, true, false, true, false, false, false, true, false, false, true},
-		1: []bool{false, false, true, false, false, true, true, true, false, true, true, true, true, true, false},
-		2: []bool{false, false, true, true, true, false, false, true, true, true, false, false, true, true, true},
-		3: []bool{false, false, true, true, false, false, true, true, true, false, true, false, false, false, false},
-		4: []bool{false, false, false, false, true, true, true, false, true, true, false, false, false, true, false},
-		5: []bool{false, false, false, false, false, true, false, false, true, false, true, false, true, false, true},
-		6: []bool{false, false, false, true, true, false, true, false, false, false, false, true, true, false, false},
-		7: []bool{false, false, false, true, false, false, false, false, false, true, true, true, false, true, true},
-	},
-}
-
-func drawFormatInfo(vi *versionInfo, usedMask int, set func(int, int, bool)) {
-	var formatInfo []bool
-
-	if usedMask == -1 {
-		formatInfo = []bool{true, true, true, true, true, true, true, true, true, true, true, true, true, true, true} // Set all to true cause -1 --> occupied mask.
-	} else {
-		formatInfo = formatInfos[vi.Level][usedMask]
-	}
-
-	if len(formatInfo) == 15 {
-		dim := vi.modulWidth()
-		set(0, 8, formatInfo[0])
-		set(1, 8, formatInfo[1])
-		set(2, 8, formatInfo[2])
-		set(3, 8, formatInfo[3])
-		set(4, 8, formatInfo[4])
-		set(5, 8, formatInfo[5])
-		set(7, 8, formatInfo[6])
-		set(8, 8, formatInfo[7])
-		set(8, 7, formatInfo[8])
-		set(8, 5, formatInfo[9])
-		set(8, 4, formatInfo[10])
-		set(8, 3, formatInfo[11])
-		set(8, 2, formatInfo[12])
-		set(8, 1, formatInfo[13])
-		set(8, 0, formatInfo[14])
-
-		set(8, dim-1, formatInfo[0])
-		set(8, dim-2, formatInfo[1])
-		set(8, dim-3, formatInfo[2])
-		set(8, dim-4, formatInfo[3])
-		set(8, dim-5, formatInfo[4])
-		set(8, dim-6, formatInfo[5])
-		set(8, dim-7, formatInfo[6])
-		set(dim-8, 8, formatInfo[7])
-		set(dim-7, 8, formatInfo[8])
-		set(dim-6, 8, formatInfo[9])
-		set(dim-5, 8, formatInfo[10])
-		set(dim-4, 8, formatInfo[11])
-		set(dim-3, 8, formatInfo[12])
-		set(dim-2, 8, formatInfo[13])
-		set(dim-1, 8, formatInfo[14])
-	}
-}
-
-var versionInfoBitsByVersion = map[byte][]bool{
-	7:  []bool{false, false, false, true, true, true, true, true, false, false, true, false, false, true, false, true, false, false},
-	8:  []bool{false, false, true, false, false, false, false, true, false, true, true, false, true, true, true, true, false, false},
-	9:  []bool{false, false, true, false, false, true, true, false, true, false, true, false, false, true, true, false, false, true},
-	10: []bool{false, false, true, false, true, false, false, true, false, false, true, true, false, true, false, false, true, true},
-	11: []bool{false, false, true, false, true, true, true, false, true, true, true, true, true, true, false, true, true, false},
-	12: []bool{false, false, true, true, false, false, false, true, true, true, false, true, true, false, false, false, true, false},
-	13: []bool{false, false, true, true, false, true, true, false, false, false, false, true, false, false, false, true, true, true},
-	14: []bool{false, false, true, true, true, false, false, true, true, false, false, false, false, false, true, true, false, true},
-	15: []bool{false, false, true, true, true, true, true, false, false, true, false, false, true, false, true, false, false, false},
-	16: []bool{false, true, false, false, false, false, true, false, true, true, false, true, true, true, true, false, false, false},
-	17: []bool{false, true, false, false, false, true, false, true, false, false, false, true, false, true, true, true, false, true},
-	18: []bool{false, true, false, false, true, false, true, false, true, false, false, false, false, true, false, true, true, true},
-	19: []bool{false, true, false, false, true, true, false, true, false, true, false, false, true, true, false, false, true, false},
-	20: []bool{false, true, false, true, false, false, true, false, false, true, true, false, true, false, false, true, true, false},
-	21: []bool{false, true, false, true, false, true, false, true, true, false, true, false, false, false, false, false, true, true},
-	22: []bool{false, true, false, true, true, false, true, false, false, false, true, true, false, false, true, false, false, true},
-	23: []bool{false, true, false, true, true, true, false, true, true, true, true, true, true, false, true, true, false, false},
-	24: []bool{false, true, true, false, false, false, true, true, true, false, true, true, false, false, false, true, false, false},
-	25: []bool{false, true, true, false, false, true, false, false, false, true, true, true, true, false, false, false, false, true},
-	26: []bool{false, true, true, false, true, false, true, true, true, true, true, false, true, false, true, false, true, true},
-	27: []bool{false, true, true, false, true, true, false, false, false, false, true, false, false, false, true, true, true, false},
-	28: []bool{false, true, true, true, false, false, true, true, false, false, false, false, false, true, true, false, true, false},
-	29: []bool{false, true, true, true, false, true, false, false, true, true, false, false, true, true, true, true, true, true},
-	30: []bool{false, true, true, true, true, false, true, true, false, true, false, true, true, true, false, true, false, true},
-	31: []bool{false, true, true, true, true, true, false, false, true, false, false, true, false, true, false, false, false, false},
-	32: []bool{true, false, false, false, false, false, true, false, false, true, true, true, false, true, false, true, false, true},
-	33: []bool{true, false, false, false, false, true, false, true, true, false, true, true, true, true, false, false, false, false},
-	34: []bool{true, false, false, false, true, false, true, false, false, false, true, false, true, true, true, false, true, false},
-	35: []bool{true, false, false, false, true, true, false, true, true, true, true, false, false, true, true, true, true, true},
-	36: []bool{true, false, false, true, false, false, true, false, true, true, false, false, false, false, true, false, true, true},
-	37: []bool{true, false, false, true, false, true, false, true, false, false, false, false, true, false, true, true, true, false},
-	38: []bool{true, false, false, true, true, false, true, false, true, false, false, true, true, false, false, true, false, false},
-	39: []bool{true, false, false, true, true, true, false, true, false, true, false, true, false, false, false, false, false, true},
-	40: []bool{true, false, true, false, false, false, true, true, false, false, false, true, true, false, true, false, false, true},
-}
-
-func drawVersionInfo(vi *versionInfo, set func(int, int, bool)) {
-	versionInfoBits, ok := versionInfoBitsByVersion[vi.Version]
-
-	if ok && len(versionInfoBits) > 0 {
-		for i := 0; i < len(versionInfoBits); i++ {
-			x := (vi.modulWidth() - 11) + i%3
-			y := i / 3
-			set(x, y, versionInfoBits[len(versionInfoBits)-i-1])
-			set(y, x, versionInfoBits[len(versionInfoBits)-i-1])
-		}
-	}
-
-}
-
-func addPaddingAndTerminator(bl *utils.BitList, vi *versionInfo) {
-	for i := 0; i < 4 && bl.Len() < vi.totalDataBytes()*8; i++ {
-		bl.AddBit(false)
-	}
-
-	for bl.Len()%8 != 0 {
-		bl.AddBit(false)
-	}
-
-	for i := 0; bl.Len() < vi.totalDataBytes()*8; i++ {
-		if i%2 == 0 {
-			bl.AddByte(236)
-		} else {
-			bl.AddByte(17)
-		}
-	}
-}

implant/vendor/github.com/boombuler/barcode/qr/errorcorrection.go

@@ -1,29 +0,0 @@
-package qr
-
-import (
-	"github.com/boombuler/barcode/utils"
-)
-
-type errorCorrection struct {
-	rs *utils.ReedSolomonEncoder
-}
-
-var ec = newErrorCorrection()
-
-func newErrorCorrection() *errorCorrection {
-	fld := utils.NewGaloisField(285, 256, 0)
-	return &errorCorrection{utils.NewReedSolomonEncoder(fld)}
-}
-
-func (ec *errorCorrection) calcECC(data []byte, eccCount byte) []byte {
-	dataInts := make([]int, len(data))
-	for i := 0; i < len(data); i++ {
-		dataInts[i] = int(data[i])
-	}
-	res := ec.rs.Encode(dataInts, int(eccCount))
-	result := make([]byte, len(res))
-	for i := 0; i < len(res); i++ {
-		result[i] = byte(res[i])
-	}
-	return result
-}

implant/vendor/github.com/boombuler/barcode/qr/numeric.go

@@ -1,56 +0,0 @@
-package qr
-
-import (
-	"errors"
-	"fmt"
-	"strconv"
-
-	"github.com/boombuler/barcode/utils"
-)
-
-func encodeNumeric(content string, ecl ErrorCorrectionLevel) (*utils.BitList, *versionInfo, error) {
-	contentBitCount := (len(content) / 3) * 10
-	switch len(content) % 3 {
-	case 1:
-		contentBitCount += 4
-	case 2:
-		contentBitCount += 7
-	}
-	vi := findSmallestVersionInfo(ecl, numericMode, contentBitCount)
-	if vi == nil {
-		return nil, nil, errors.New("To much data to encode")
-	}
-	res := new(utils.BitList)
-	res.AddBits(int(numericMode), 4)
-	res.AddBits(len(content), vi.charCountBits(numericMode))
-
-	for pos := 0; pos < len(content); pos += 3 {
-		var curStr string
-		if pos+3 <= len(content) {
-			curStr = content[pos : pos+3]
-		} else {
-			curStr = content[pos:]
-		}
-
-		i, err := strconv.Atoi(curStr)
-		if err != nil || i < 0 {
-			return nil, nil, fmt.Errorf("\"%s\" can not be encoded as %s", content, Numeric)
-		}
-		var bitCnt byte
-		switch len(curStr) % 3 {
-		case 0:
-			bitCnt = 10
-		case 1:
-			bitCnt = 4
-			break
-		case 2:
-			bitCnt = 7
-			break
-		}
-
-		res.AddBits(i, bitCnt)
-	}
-
-	addPaddingAndTerminator(res, vi)
-	return res, vi, nil
-}

implant/vendor/github.com/boombuler/barcode/qr/qrcode.go

@@ -1,166 +0,0 @@
-package qr
-
-import (
-	"image"
-	"image/color"
-	"math"
-
-	"github.com/boombuler/barcode"
-	"github.com/boombuler/barcode/utils"
-)
-
-type qrcode struct {
-	dimension int
-	data      *utils.BitList
-	content   string
-}
-
-func (qr *qrcode) Content() string {
-	return qr.content
-}
-
-func (qr *qrcode) Metadata() barcode.Metadata {
-	return barcode.Metadata{barcode.TypeQR, 2}
-}
-
-func (qr *qrcode) ColorModel() color.Model {
-	return color.Gray16Model
-}
-
-func (qr *qrcode) Bounds() image.Rectangle {
-	return image.Rect(0, 0, qr.dimension, qr.dimension)
-}
-
-func (qr *qrcode) At(x, y int) color.Color {
-	if qr.Get(x, y) {
-		return color.Black
-	}
-	return color.White
-}
-
-func (qr *qrcode) Get(x, y int) bool {
-	return qr.data.GetBit(x*qr.dimension + y)
-}
-
-func (qr *qrcode) Set(x, y int, val bool) {
-	qr.data.SetBit(x*qr.dimension+y, val)
-}
-
-func (qr *qrcode) calcPenalty() uint {
-	return qr.calcPenaltyRule1() + qr.calcPenaltyRule2() + qr.calcPenaltyRule3() + qr.calcPenaltyRule4()
-}
-
-func (qr *qrcode) calcPenaltyRule1() uint {
-	var result uint
-	for x := 0; x < qr.dimension; x++ {
-		checkForX := false
-		var cntX uint
-		checkForY := false
-		var cntY uint
-
-		for y := 0; y < qr.dimension; y++ {
-			if qr.Get(x, y) == checkForX {
-				cntX++
-			} else {
-				checkForX = !checkForX
-				if cntX >= 5 {
-					result += cntX - 2
-				}
-				cntX = 1
-			}
-
-			if qr.Get(y, x) == checkForY {
-				cntY++
-			} else {
-				checkForY = !checkForY
-				if cntY >= 5 {
-					result += cntY - 2
-				}
-				cntY = 1
-			}
-		}
-
-		if cntX >= 5 {
-			result += cntX - 2
-		}
-		if cntY >= 5 {
-			result += cntY - 2
-		}
-	}
-
-	return result
-}
-
-func (qr *qrcode) calcPenaltyRule2() uint {
-	var result uint
-	for x := 0; x < qr.dimension-1; x++ {
-		for y := 0; y < qr.dimension-1; y++ {
-			check := qr.Get(x, y)
-			if qr.Get(x, y+1) == check && qr.Get(x+1, y) == check && qr.Get(x+1, y+1) == check {
-				result += 3
-			}
-		}
-	}
-	return result
-}
-
-func (qr *qrcode) calcPenaltyRule3() uint {
-	pattern1 := []bool{true, false, true, true, true, false, true, false, false, false, false}
-	pattern2 := []bool{false, false, false, false, true, false, true, true, true, false, true}
-
-	var result uint
-	for x := 0; x <= qr.dimension-len(pattern1); x++ {
-		for y := 0; y < qr.dimension; y++ {
-			pattern1XFound := true
-			pattern2XFound := true
-			pattern1YFound := true
-			pattern2YFound := true
-
-			for i := 0; i < len(pattern1); i++ {
-				iv := qr.Get(x+i, y)
-				if iv != pattern1[i] {
-					pattern1XFound = false
-				}
-				if iv != pattern2[i] {
-					pattern2XFound = false
-				}
-				iv = qr.Get(y, x+i)
-				if iv != pattern1[i] {
-					pattern1YFound = false
-				}
-				if iv != pattern2[i] {
-					pattern2YFound = false
-				}
-			}
-			if pattern1XFound || pattern2XFound {
-				result += 40
-			}
-			if pattern1YFound || pattern2YFound {
-				result += 40
-			}
-		}
-	}
-
-	return result
-}
-
-func (qr *qrcode) calcPenaltyRule4() uint {
-	totalNum := qr.data.Len()
-	trueCnt := 0
-	for i := 0; i < totalNum; i++ {
-		if qr.data.GetBit(i) {
-			trueCnt++
-		}
-	}
-	percDark := float64(trueCnt) * 100 / float64(totalNum)
-	floor := math.Abs(math.Floor(percDark/5) - 10)
-	ceil := math.Abs(math.Ceil(percDark/5) - 10)
-	return uint(math.Min(floor, ceil) * 10)
-}
-
-func newBarcode(dim int) *qrcode {
-	res := new(qrcode)
-	res.dimension = dim
-	res.data = utils.NewBitList(dim * dim)
-	return res
-}

implant/vendor/github.com/boombuler/barcode/qr/unicode.go

@@ -1,27 +0,0 @@
-package qr
-
-import (
-	"errors"
-
-	"github.com/boombuler/barcode/utils"
-)
-
-func encodeUnicode(content string, ecl ErrorCorrectionLevel) (*utils.BitList, *versionInfo, error) {
-	data := []byte(content)
-
-	vi := findSmallestVersionInfo(ecl, byteMode, len(data)*8)
-	if vi == nil {
-		return nil, nil, errors.New("To much data to encode")
-	}
-
-	// It's not correct to add the unicode bytes to the result directly but most readers can't handle the
-	// required ECI header...
-	res := new(utils.BitList)
-	res.AddBits(int(byteMode), 4)
-	res.AddBits(len(content), vi.charCountBits(byteMode))
-	for _, b := range data {
-		res.AddByte(b)
-	}
-	addPaddingAndTerminator(res, vi)
-	return res, vi, nil
-}

implant/vendor/github.com/boombuler/barcode/qr/versioninfo.go

@@ -1,310 +0,0 @@
-package qr
-
-import "math"
-
-// ErrorCorrectionLevel indicates the amount of "backup data" stored in the QR code
-type ErrorCorrectionLevel byte
-
-const (
-	// L recovers 7% of data
-	L ErrorCorrectionLevel = iota
-	// M recovers 15% of data
-	M
-	// Q recovers 25% of data
-	Q
-	// H recovers 30% of data
-	H
-)
-
-func (ecl ErrorCorrectionLevel) String() string {
-	switch ecl {
-	case L:
-		return "L"
-	case M:
-		return "M"
-	case Q:
-		return "Q"
-	case H:
-		return "H"
-	}
-	return "unknown"
-}
-
-type encodingMode byte
-
-const (
-	numericMode      encodingMode = 1
-	alphaNumericMode encodingMode = 2
-	byteMode         encodingMode = 4
-	kanjiMode        encodingMode = 8
-)
-
-type versionInfo struct {
-	Version                          byte
-	Level                            ErrorCorrectionLevel
-	ErrorCorrectionCodewordsPerBlock byte
-	NumberOfBlocksInGroup1           byte
-	DataCodeWordsPerBlockInGroup1    byte
-	NumberOfBlocksInGroup2           byte
-	DataCodeWordsPerBlockInGroup2    byte
-}
-
-var versionInfos = []*versionInfo{
-	&versionInfo{1, L, 7, 1, 19, 0, 0},
-	&versionInfo{1, M, 10, 1, 16, 0, 0},
-	&versionInfo{1, Q, 13, 1, 13, 0, 0},
-	&versionInfo{1, H, 17, 1, 9, 0, 0},
-	&versionInfo{2, L, 10, 1, 34, 0, 0},
-	&versionInfo{2, M, 16, 1, 28, 0, 0},
-	&versionInfo{2, Q, 22, 1, 22, 0, 0},
-	&versionInfo{2, H, 28, 1, 16, 0, 0},
-	&versionInfo{3, L, 15, 1, 55, 0, 0},
-	&versionInfo{3, M, 26, 1, 44, 0, 0},
-	&versionInfo{3, Q, 18, 2, 17, 0, 0},
-	&versionInfo{3, H, 22, 2, 13, 0, 0},
-	&versionInfo{4, L, 20, 1, 80, 0, 0},
-	&versionInfo{4, M, 18, 2, 32, 0, 0},
-	&versionInfo{4, Q, 26, 2, 24, 0, 0},
-	&versionInfo{4, H, 16, 4, 9, 0, 0},
-	&versionInfo{5, L, 26, 1, 108, 0, 0},
-	&versionInfo{5, M, 24, 2, 43, 0, 0},
-	&versionInfo{5, Q, 18, 2, 15, 2, 16},
-	&versionInfo{5, H, 22, 2, 11, 2, 12},
-	&versionInfo{6, L, 18, 2, 68, 0, 0},
-	&versionInfo{6, M, 16, 4, 27, 0, 0},
-	&versionInfo{6, Q, 24, 4, 19, 0, 0},
-	&versionInfo{6, H, 28, 4, 15, 0, 0},
-	&versionInfo{7, L, 20, 2, 78, 0, 0},
-	&versionInfo{7, M, 18, 4, 31, 0, 0},
-	&versionInfo{7, Q, 18, 2, 14, 4, 15},
-	&versionInfo{7, H, 26, 4, 13, 1, 14},
-	&versionInfo{8, L, 24, 2, 97, 0, 0},
-	&versionInfo{8, M, 22, 2, 38, 2, 39},
-	&versionInfo{8, Q, 22, 4, 18, 2, 19},
-	&versionInfo{8, H, 26, 4, 14, 2, 15},
-	&versionInfo{9, L, 30, 2, 116, 0, 0},
-	&versionInfo{9, M, 22, 3, 36, 2, 37},
-	&versionInfo{9, Q, 20, 4, 16, 4, 17},
-	&versionInfo{9, H, 24, 4, 12, 4, 13},
-	&versionInfo{10, L, 18, 2, 68, 2, 69},
-	&versionInfo{10, M, 26, 4, 43, 1, 44},
-	&versionInfo{10, Q, 24, 6, 19, 2, 20},
-	&versionInfo{10, H, 28, 6, 15, 2, 16},
-	&versionInfo{11, L, 20, 4, 81, 0, 0},
-	&versionInfo{11, M, 30, 1, 50, 4, 51},
-	&versionInfo{11, Q, 28, 4, 22, 4, 23},
-	&versionInfo{11, H, 24, 3, 12, 8, 13},
-	&versionInfo{12, L, 24, 2, 92, 2, 93},
-	&versionInfo{12, M, 22, 6, 36, 2, 37},
-	&versionInfo{12, Q, 26, 4, 20, 6, 21},
-	&versionInfo{12, H, 28, 7, 14, 4, 15},
-	&versionInfo{13, L, 26, 4, 107, 0, 0},
-	&versionInfo{13, M, 22, 8, 37, 1, 38},
-	&versionInfo{13, Q, 24, 8, 20, 4, 21},
-	&versionInfo{13, H, 22, 12, 11, 4, 12},
-	&versionInfo{14, L, 30, 3, 115, 1, 116},
-	&versionInfo{14, M, 24, 4, 40, 5, 41},
-	&versionInfo{14, Q, 20, 11, 16, 5, 17},
-	&versionInfo{14, H, 24, 11, 12, 5, 13},
-	&versionInfo{15, L, 22, 5, 87, 1, 88},
-	&versionInfo{15, M, 24, 5, 41, 5, 42},
-	&versionInfo{15, Q, 30, 5, 24, 7, 25},
-	&versionInfo{15, H, 24, 11, 12, 7, 13},
-	&versionInfo{16, L, 24, 5, 98, 1, 99},
-	&versionInfo{16, M, 28, 7, 45, 3, 46},
-	&versionInfo{16, Q, 24, 15, 19, 2, 20},
-	&versionInfo{16, H, 30, 3, 15, 13, 16},
-	&versionInfo{17, L, 28, 1, 107, 5, 108},
-	&versionInfo{17, M, 28, 10, 46, 1, 47},
-	&versionInfo{17, Q, 28, 1, 22, 15, 23},
-	&versionInfo{17, H, 28, 2, 14, 17, 15},
-	&versionInfo{18, L, 30, 5, 120, 1, 121},
-	&versionInfo{18, M, 26, 9, 43, 4, 44},
-	&versionInfo{18, Q, 28, 17, 22, 1, 23},
-	&versionInfo{18, H, 28, 2, 14, 19, 15},
-	&versionInfo{19, L, 28, 3, 113, 4, 114},
-	&versionInfo{19, M, 26, 3, 44, 11, 45},
-	&versionInfo{19, Q, 26, 17, 21, 4, 22},
-	&versionInfo{19, H, 26, 9, 13, 16, 14},
-	&versionInfo{20, L, 28, 3, 107, 5, 108},
-	&versionInfo{20, M, 26, 3, 41, 13, 42},
-	&versionInfo{20, Q, 30, 15, 24, 5, 25},
-	&versionInfo{20, H, 28, 15, 15, 10, 16},
-	&versionInfo{21, L, 28, 4, 116, 4, 117},
-	&versionInfo{21, M, 26, 17, 42, 0, 0},
-	&versionInfo{21, Q, 28, 17, 22, 6, 23},
-	&versionInfo{21, H, 30, 19, 16, 6, 17},
-	&versionInfo{22, L, 28, 2, 111, 7, 112},
-	&versionInfo{22, M, 28, 17, 46, 0, 0},
-	&versionInfo{22, Q, 30, 7, 24, 16, 25},
-	&versionInfo{22, H, 24, 34, 13, 0, 0},
-	&versionInfo{23, L, 30, 4, 121, 5, 122},
-	&versionInfo{23, M, 28, 4, 47, 14, 48},
-	&versionInfo{23, Q, 30, 11, 24, 14, 25},
-	&versionInfo{23, H, 30, 16, 15, 14, 16},
-	&versionInfo{24, L, 30, 6, 117, 4, 118},
-	&versionInfo{24, M, 28, 6, 45, 14, 46},
-	&versionInfo{24, Q, 30, 11, 24, 16, 25},
-	&versionInfo{24, H, 30, 30, 16, 2, 17},
-	&versionInfo{25, L, 26, 8, 106, 4, 107},
-	&versionInfo{25, M, 28, 8, 47, 13, 48},
-	&versionInfo{25, Q, 30, 7, 24, 22, 25},
-	&versionInfo{25, H, 30, 22, 15, 13, 16},
-	&versionInfo{26, L, 28, 10, 114, 2, 115},
-	&versionInfo{26, M, 28, 19, 46, 4, 47},
-	&versionInfo{26, Q, 28, 28, 22, 6, 23},
-	&versionInfo{26, H, 30, 33, 16, 4, 17},
-	&versionInfo{27, L, 30, 8, 122, 4, 123},
-	&versionInfo{27, M, 28, 22, 45, 3, 46},
-	&versionInfo{27, Q, 30, 8, 23, 26, 24},
-	&versionInfo{27, H, 30, 12, 15, 28, 16},
-	&versionInfo{28, L, 30, 3, 117, 10, 118},
-	&versionInfo{28, M, 28, 3, 45, 23, 46},
-	&versionInfo{28, Q, 30, 4, 24, 31, 25},
-	&versionInfo{28, H, 30, 11, 15, 31, 16},
-	&versionInfo{29, L, 30, 7, 116, 7, 117},
-	&versionInfo{29, M, 28, 21, 45, 7, 46},
-	&versionInfo{29, Q, 30, 1, 23, 37, 24},
-	&versionInfo{29, H, 30, 19, 15, 26, 16},
-	&versionInfo{30, L, 30, 5, 115, 10, 116},
-	&versionInfo{30, M, 28, 19, 47, 10, 48},
-	&versionInfo{30, Q, 30, 15, 24, 25, 25},
-	&versionInfo{30, H, 30, 23, 15, 25, 16},
-	&versionInfo{31, L, 30, 13, 115, 3, 116},
-	&versionInfo{31, M, 28, 2, 46, 29, 47},
-	&versionInfo{31, Q, 30, 42, 24, 1, 25},
-	&versionInfo{31, H, 30, 23, 15, 28, 16},
-	&versionInfo{32, L, 30, 17, 115, 0, 0},
-	&versionInfo{32, M, 28, 10, 46, 23, 47},
-	&versionInfo{32, Q, 30, 10, 24, 35, 25},
-	&versionInfo{32, H, 30, 19, 15, 35, 16},
-	&versionInfo{33, L, 30, 17, 115, 1, 116},
-	&versionInfo{33, M, 28, 14, 46, 21, 47},
-	&versionInfo{33, Q, 30, 29, 24, 19, 25},
-	&versionInfo{33, H, 30, 11, 15, 46, 16},
-	&versionInfo{34, L, 30, 13, 115, 6, 116},
-	&versionInfo{34, M, 28, 14, 46, 23, 47},
-	&versionInfo{34, Q, 30, 44, 24, 7, 25},
-	&versionInfo{34, H, 30, 59, 16, 1, 17},
-	&versionInfo{35, L, 30, 12, 121, 7, 122},
-	&versionInfo{35, M, 28, 12, 47, 26, 48},
-	&versionInfo{35, Q, 30, 39, 24, 14, 25},
-	&versionInfo{35, H, 30, 22, 15, 41, 16},
-	&versionInfo{36, L, 30, 6, 121, 14, 122},
-	&versionInfo{36, M, 28, 6, 47, 34, 48},
-	&versionInfo{36, Q, 30, 46, 24, 10, 25},
-	&versionInfo{36, H, 30, 2, 15, 64, 16},
-	&versionInfo{37, L, 30, 17, 122, 4, 123},
-	&versionInfo{37, M, 28, 29, 46, 14, 47},
-	&versionInfo{37, Q, 30, 49, 24, 10, 25},
-	&versionInfo{37, H, 30, 24, 15, 46, 16},
-	&versionInfo{38, L, 30, 4, 122, 18, 123},
-	&versionInfo{38, M, 28, 13, 46, 32, 47},
-	&versionInfo{38, Q, 30, 48, 24, 14, 25},
-	&versionInfo{38, H, 30, 42, 15, 32, 16},
-	&versionInfo{39, L, 30, 20, 117, 4, 118},
-	&versionInfo{39, M, 28, 40, 47, 7, 48},
-	&versionInfo{39, Q, 30, 43, 24, 22, 25},
-	&versionInfo{39, H, 30, 10, 15, 67, 16},
-	&versionInfo{40, L, 30, 19, 118, 6, 119},
-	&versionInfo{40, M, 28, 18, 47, 31, 48},
-	&versionInfo{40, Q, 30, 34, 24, 34, 25},
-	&versionInfo{40, H, 30, 20, 15, 61, 16},
-}
-
-func (vi *versionInfo) totalDataBytes() int {
-	g1Data := int(vi.NumberOfBlocksInGroup1) * int(vi.DataCodeWordsPerBlockInGroup1)
-	g2Data := int(vi.NumberOfBlocksInGroup2) * int(vi.DataCodeWordsPerBlockInGroup2)
-	return (g1Data + g2Data)
-}
-
-func (vi *versionInfo) charCountBits(m encodingMode) byte {
-	switch m {
-	case numericMode:
-		if vi.Version < 10 {
-			return 10
-		} else if vi.Version < 27 {
-			return 12
-		}
-		return 14
-
-	case alphaNumericMode:
-		if vi.Version < 10 {
-			return 9
-		} else if vi.Version < 27 {
-			return 11
-		}
-		return 13
-
-	case byteMode:
-		if vi.Version < 10 {
-			return 8
-		}
-		return 16
-
-	case kanjiMode:
-		if vi.Version < 10 {
-			return 8
-		} else if vi.Version < 27 {
-			return 10
-		}
-		return 12
-	default:
-		return 0
-	}
-}
-
-func (vi *versionInfo) modulWidth() int {
-	return ((int(vi.Version) - 1) * 4) + 21
-}
-
-func (vi *versionInfo) alignmentPatternPlacements() []int {
-	if vi.Version == 1 {
-		return make([]int, 0)
-	}
-
-	first := 6
-	last := vi.modulWidth() - 7
-	space := float64(last - first)
-	count := int(math.Ceil(space/28)) + 1
-
-	result := make([]int, count)
-	result[0] = first
-	result[len(result)-1] = last
-	if count > 2 {
-		step := int(math.Ceil(float64(last-first) / float64(count-1)))
-		if step%2 == 1 {
-			frac := float64(last-first) / float64(count-1)
-			_, x := math.Modf(frac)
-			if x >= 0.5 {
-				frac = math.Ceil(frac)
-			} else {
-				frac = math.Floor(frac)
-			}
-
-			if int(frac)%2 == 0 {
-				step--
-			} else {
-				step++
-			}
-		}
-
-		for i := 1; i <= count-2; i++ {
-			result[i] = last - (step * (count - 1 - i))
-		}
-	}
-
-	return result
-}
-
-func findSmallestVersionInfo(ecl ErrorCorrectionLevel, mode encodingMode, dataBits int) *versionInfo {
-	dataBits = dataBits + 4 // mode indicator
-	for _, vi := range versionInfos {
-		if vi.Level == ecl {
-			if (vi.totalDataBytes() * 8) >= (dataBits + int(vi.charCountBits(mode))) {
-				return vi
-			}
-		}
-	}
-	return nil
-}

implant/vendor/github.com/boombuler/barcode/scaledbarcode.go

@@ -1,134 +0,0 @@
-package barcode
-
-import (
-	"errors"
-	"fmt"
-	"image"
-	"image/color"
-	"math"
-)
-
-type wrapFunc func(x, y int) color.Color
-
-type scaledBarcode struct {
-	wrapped     Barcode
-	wrapperFunc wrapFunc
-	rect        image.Rectangle
-}
-
-type intCSscaledBC struct {
-	scaledBarcode
-}
-
-func (bc *scaledBarcode) Content() string {
-	return bc.wrapped.Content()
-}
-
-func (bc *scaledBarcode) Metadata() Metadata {
-	return bc.wrapped.Metadata()
-}
-
-func (bc *scaledBarcode) ColorModel() color.Model {
-	return bc.wrapped.ColorModel()
-}
-
-func (bc *scaledBarcode) Bounds() image.Rectangle {
-	return bc.rect
-}
-
-func (bc *scaledBarcode) At(x, y int) color.Color {
-	return bc.wrapperFunc(x, y)
-}
-
-func (bc *intCSscaledBC) CheckSum() int {
-	if cs, ok := bc.wrapped.(BarcodeIntCS); ok {
-		return cs.CheckSum()
-	}
-	return 0
-}
-
-// Scale returns a resized barcode with the given width and height.
-func Scale(bc Barcode, width, height int) (Barcode, error) {
-	switch bc.Metadata().Dimensions {
-	case 1:
-		return scale1DCode(bc, width, height)
-	case 2:
-		return scale2DCode(bc, width, height)
-	}
-
-	return nil, errors.New("unsupported barcode format")
-}
-
-func newScaledBC(wrapped Barcode, wrapperFunc wrapFunc, rect image.Rectangle) Barcode {
-	result := &scaledBarcode{
-		wrapped:     wrapped,
-		wrapperFunc: wrapperFunc,
-		rect:        rect,
-	}
-
-	if _, ok := wrapped.(BarcodeIntCS); ok {
-		return &intCSscaledBC{*result}
-	}
-	return result
-}
-
-func scale2DCode(bc Barcode, width, height int) (Barcode, error) {
-	orgBounds := bc.Bounds()
-	orgWidth := orgBounds.Max.X - orgBounds.Min.X
-	orgHeight := orgBounds.Max.Y - orgBounds.Min.Y
-
-	factor := int(math.Min(float64(width)/float64(orgWidth), float64(height)/float64(orgHeight)))
-	if factor <= 0 {
-		return nil, fmt.Errorf("can not scale barcode to an image smaller than %dx%d", orgWidth, orgHeight)
-	}
-
-	offsetX := (width - (orgWidth * factor)) / 2
-	offsetY := (height - (orgHeight * factor)) / 2
-
-	wrap := func(x, y int) color.Color {
-		if x < offsetX || y < offsetY {
-			return color.White
-		}
-		x = (x - offsetX) / factor
-		y = (y - offsetY) / factor
-		if x >= orgWidth || y >= orgHeight {
-			return color.White
-		}
-		return bc.At(x, y)
-	}
-
-	return newScaledBC(
-		bc,
-		wrap,
-		image.Rect(0, 0, width, height),
-	), nil
-}
-
-func scale1DCode(bc Barcode, width, height int) (Barcode, error) {
-	orgBounds := bc.Bounds()
-	orgWidth := orgBounds.Max.X - orgBounds.Min.X
-	factor := int(float64(width) / float64(orgWidth))
-
-	if factor <= 0 {
-		return nil, fmt.Errorf("can not scale barcode to an image smaller than %dx1", orgWidth)
-	}
-	offsetX := (width - (orgWidth * factor)) / 2
-
-	wrap := func(x, y int) color.Color {
-		if x < offsetX {
-			return color.White
-		}
-		x = (x - offsetX) / factor
-
-		if x >= orgWidth {
-			return color.White
-		}
-		return bc.At(x, 0)
-	}
-
-	return newScaledBC(
-		bc,
-		wrap,
-		image.Rect(0, 0, width, height),
-	), nil
-}

implant/vendor/github.com/boombuler/barcode/utils/base1dcode.go

@@ -1,57 +0,0 @@
-// Package utils contain some utilities which are needed to create barcodes
-package utils
-
-import (
-	"image"
-	"image/color"
-
-	"github.com/boombuler/barcode"
-)
-
-type base1DCode struct {
-	*BitList
-	kind    string
-	content string
-}
-
-type base1DCodeIntCS struct {
-	base1DCode
-	checksum int
-}
-
-func (c *base1DCode) Content() string {
-	return c.content
-}
-
-func (c *base1DCode) Metadata() barcode.Metadata {
-	return barcode.Metadata{c.kind, 1}
-}
-
-func (c *base1DCode) ColorModel() color.Model {
-	return color.Gray16Model
-}
-
-func (c *base1DCode) Bounds() image.Rectangle {
-	return image.Rect(0, 0, c.Len(), 1)
-}
-
-func (c *base1DCode) At(x, y int) color.Color {
-	if c.GetBit(x) {
-		return color.Black
-	}
-	return color.White
-}
-
-func (c *base1DCodeIntCS) CheckSum() int {
-	return c.checksum
-}
-
-// New1DCodeIntCheckSum creates a new 1D barcode where the bars are represented by the bits in the bars BitList
-func New1DCodeIntCheckSum(codeKind, content string, bars *BitList, checksum int) barcode.BarcodeIntCS {
-	return &base1DCodeIntCS{base1DCode{bars, codeKind, content}, checksum}
-}
-
-// New1DCode creates a new 1D barcode where the bars are represented by the bits in the bars BitList
-func New1DCode(codeKind, content string, bars *BitList) barcode.Barcode {
-	return &base1DCode{bars, codeKind, content}
-}

implant/vendor/github.com/boombuler/barcode/utils/bitlist.go

@@ -1,119 +0,0 @@
-package utils
-
-// BitList is a list that contains bits
-type BitList struct {
-	count int
-	data  []int32
-}
-
-// NewBitList returns a new BitList with the given length
-// all bits are initialize with false
-func NewBitList(capacity int) *BitList {
-	bl := new(BitList)
-	bl.count = capacity
-	x := 0
-	if capacity%32 != 0 {
-		x = 1
-	}
-	bl.data = make([]int32, capacity/32+x)
-	return bl
-}
-
-// Len returns the number of contained bits
-func (bl *BitList) Len() int {
-	return bl.count
-}
-
-func (bl *BitList) grow() {
-	growBy := len(bl.data)
-	if growBy < 128 {
-		growBy = 128
-	} else if growBy >= 1024 {
-		growBy = 1024
-	}
-
-	nd := make([]int32, len(bl.data)+growBy)
-	copy(nd, bl.data)
-	bl.data = nd
-}
-
-// AddBit appends the given bits to the end of the list
-func (bl *BitList) AddBit(bits ...bool) {
-	for _, bit := range bits {
-		itmIndex := bl.count / 32
-		for itmIndex >= len(bl.data) {
-			bl.grow()
-		}
-		bl.SetBit(bl.count, bit)
-		bl.count++
-	}
-}
-
-// SetBit sets the bit at the given index to the given value
-func (bl *BitList) SetBit(index int, value bool) {
-	itmIndex := index / 32
-	itmBitShift := 31 - (index % 32)
-	if value {
-		bl.data[itmIndex] = bl.data[itmIndex] | 1<<uint(itmBitShift)
-	} else {
-		bl.data[itmIndex] = bl.data[itmIndex] & ^(1 << uint(itmBitShift))
-	}
-}
-
-// GetBit returns the bit at the given index
-func (bl *BitList) GetBit(index int) bool {
-	itmIndex := index / 32
-	itmBitShift := 31 - (index % 32)
-	return ((bl.data[itmIndex] >> uint(itmBitShift)) & 1) == 1
-}
-
-// AddByte appends all 8 bits of the given byte to the end of the list
-func (bl *BitList) AddByte(b byte) {
-	for i := 7; i >= 0; i-- {
-		bl.AddBit(((b >> uint(i)) & 1) == 1)
-	}
-}
-
-// AddBits appends the last (LSB) 'count' bits of 'b' the the end of the list
-func (bl *BitList) AddBits(b int, count byte) {
-	for i := int(count) - 1; i >= 0; i-- {
-		bl.AddBit(((b >> uint(i)) & 1) == 1)
-	}
-}
-
-// GetBytes returns all bits of the BitList as a []byte
-func (bl *BitList) GetBytes() []byte {
-	len := bl.count >> 3
-	if (bl.count % 8) != 0 {
-		len++
-	}
-	result := make([]byte, len)
-	for i := 0; i < len; i++ {
-		shift := (3 - (i % 4)) * 8
-		result[i] = (byte)((bl.data[i/4] >> uint(shift)) & 0xFF)
-	}
-	return result
-}
-
-// IterateBytes iterates through all bytes contained in the BitList
-func (bl *BitList) IterateBytes() <-chan byte {
-	res := make(chan byte)
-
-	go func() {
-		c := bl.count
-		shift := 24
-		i := 0
-		for c > 0 {
-			res <- byte((bl.data[i] >> uint(shift)) & 0xFF)
-			shift -= 8
-			if shift < 0 {
-				shift = 24
-				i++
-			}
-			c -= 8
-		}
-		close(res)
-	}()
-
-	return res
-}

implant/vendor/github.com/boombuler/barcode/utils/galoisfield.go

@@ -1,65 +0,0 @@
-package utils
-
-// GaloisField encapsulates galois field arithmetics
-type GaloisField struct {
-	Size    int
-	Base    int
-	ALogTbl []int
-	LogTbl  []int
-}
-
-// NewGaloisField creates a new galois field
-func NewGaloisField(pp, fieldSize, b int) *GaloisField {
-	result := new(GaloisField)
-
-	result.Size = fieldSize
-	result.Base = b
-	result.ALogTbl = make([]int, fieldSize)
-	result.LogTbl = make([]int, fieldSize)
-
-	x := 1
-	for i := 0; i < fieldSize; i++ {
-		result.ALogTbl[i] = x
-		x = x * 2
-		if x >= fieldSize {
-			x = (x ^ pp) & (fieldSize - 1)
-		}
-	}
-
-	for i := 0; i < fieldSize; i++ {
-		result.LogTbl[result.ALogTbl[i]] = int(i)
-	}
-
-	return result
-}
-
-func (gf *GaloisField) Zero() *GFPoly {
-	return NewGFPoly(gf, []int{0})
-}
-
-// AddOrSub add or substract two numbers
-func (gf *GaloisField) AddOrSub(a, b int) int {
-	return a ^ b
-}
-
-// Multiply multiplys two numbers
-func (gf *GaloisField) Multiply(a, b int) int {
-	if a == 0 || b == 0 {
-		return 0
-	}
-	return gf.ALogTbl[(gf.LogTbl[a]+gf.LogTbl[b])%(gf.Size-1)]
-}
-
-// Divide divides two numbers
-func (gf *GaloisField) Divide(a, b int) int {
-	if b == 0 {
-		panic("divide by zero")
-	} else if a == 0 {
-		return 0
-	}
-	return gf.ALogTbl[(gf.LogTbl[a]-gf.LogTbl[b])%(gf.Size-1)]
-}
-
-func (gf *GaloisField) Invers(num int) int {
-	return gf.ALogTbl[(gf.Size-1)-gf.LogTbl[num]]
-}

implant/vendor/github.com/boombuler/barcode/utils/gfpoly.go

@@ -1,103 +0,0 @@
-package utils
-
-type GFPoly struct {
-	gf           *GaloisField
-	Coefficients []int
-}
-
-func (gp *GFPoly) Degree() int {
-	return len(gp.Coefficients) - 1
-}
-
-func (gp *GFPoly) Zero() bool {
-	return gp.Coefficients[0] == 0
-}
-
-// GetCoefficient returns the coefficient of x ^ degree
-func (gp *GFPoly) GetCoefficient(degree int) int {
-	return gp.Coefficients[gp.Degree()-degree]
-}
-
-func (gp *GFPoly) AddOrSubstract(other *GFPoly) *GFPoly {
-	if gp.Zero() {
-		return other
-	} else if other.Zero() {
-		return gp
-	}
-	smallCoeff := gp.Coefficients
-	largeCoeff := other.Coefficients
-	if len(smallCoeff) > len(largeCoeff) {
-		largeCoeff, smallCoeff = smallCoeff, largeCoeff
-	}
-	sumDiff := make([]int, len(largeCoeff))
-	lenDiff := len(largeCoeff) - len(smallCoeff)
-	copy(sumDiff, largeCoeff[:lenDiff])
-	for i := lenDiff; i < len(largeCoeff); i++ {
-		sumDiff[i] = int(gp.gf.AddOrSub(int(smallCoeff[i-lenDiff]), int(largeCoeff[i])))
-	}
-	return NewGFPoly(gp.gf, sumDiff)
-}
-
-func (gp *GFPoly) MultByMonominal(degree int, coeff int) *GFPoly {
-	if coeff == 0 {
-		return gp.gf.Zero()
-	}
-	size := len(gp.Coefficients)
-	result := make([]int, size+degree)
-	for i := 0; i < size; i++ {
-		result[i] = int(gp.gf.Multiply(int(gp.Coefficients[i]), int(coeff)))
-	}
-	return NewGFPoly(gp.gf, result)
-}
-
-func (gp *GFPoly) Multiply(other *GFPoly) *GFPoly {
-	if gp.Zero() || other.Zero() {
-		return gp.gf.Zero()
-	}
-	aCoeff := gp.Coefficients
-	aLen := len(aCoeff)
-	bCoeff := other.Coefficients
-	bLen := len(bCoeff)
-	product := make([]int, aLen+bLen-1)
-	for i := 0; i < aLen; i++ {
-		ac := int(aCoeff[i])
-		for j := 0; j < bLen; j++ {
-			bc := int(bCoeff[j])
-			product[i+j] = int(gp.gf.AddOrSub(int(product[i+j]), gp.gf.Multiply(ac, bc)))
-		}
-	}
-	return NewGFPoly(gp.gf, product)
-}
-
-func (gp *GFPoly) Divide(other *GFPoly) (quotient *GFPoly, remainder *GFPoly) {
-	quotient = gp.gf.Zero()
-	remainder = gp
-	fld := gp.gf
-	denomLeadTerm := other.GetCoefficient(other.Degree())
-	inversDenomLeadTerm := fld.Invers(int(denomLeadTerm))
-	for remainder.Degree() >= other.Degree() && !remainder.Zero() {
-		degreeDiff := remainder.Degree() - other.Degree()
-		scale := int(fld.Multiply(int(remainder.GetCoefficient(remainder.Degree())), inversDenomLeadTerm))
-		term := other.MultByMonominal(degreeDiff, scale)
-		itQuot := NewMonominalPoly(fld, degreeDiff, scale)
-		quotient = quotient.AddOrSubstract(itQuot)
-		remainder = remainder.AddOrSubstract(term)
-	}
-	return
-}
-
-func NewMonominalPoly(field *GaloisField, degree int, coeff int) *GFPoly {
-	if coeff == 0 {
-		return field.Zero()
-	}
-	result := make([]int, degree+1)
-	result[0] = coeff
-	return NewGFPoly(field, result)
-}
-
-func NewGFPoly(field *GaloisField, coefficients []int) *GFPoly {
-	for len(coefficients) > 1 && coefficients[0] == 0 {
-		coefficients = coefficients[1:]
-	}
-	return &GFPoly{field, coefficients}
-}

implant/vendor/github.com/boombuler/barcode/utils/reedsolomon.go

@@ -1,44 +0,0 @@
-package utils
-
-import (
-	"sync"
-)
-
-type ReedSolomonEncoder struct {
-	gf        *GaloisField
-	polynomes []*GFPoly
-	m         *sync.Mutex
-}
-
-func NewReedSolomonEncoder(gf *GaloisField) *ReedSolomonEncoder {
-	return &ReedSolomonEncoder{
-		gf, []*GFPoly{NewGFPoly(gf, []int{1})}, new(sync.Mutex),
-	}
-}
-
-func (rs *ReedSolomonEncoder) getPolynomial(degree int) *GFPoly {
-	rs.m.Lock()
-	defer rs.m.Unlock()
-
-	if degree >= len(rs.polynomes) {
-		last := rs.polynomes[len(rs.polynomes)-1]
-		for d := len(rs.polynomes); d <= degree; d++ {
-			next := last.Multiply(NewGFPoly(rs.gf, []int{1, rs.gf.ALogTbl[d-1+rs.gf.Base]}))
-			rs.polynomes = append(rs.polynomes, next)
-			last = next
-		}
-	}
-	return rs.polynomes[degree]
-}
-
-func (rs *ReedSolomonEncoder) Encode(data []int, eccCount int) []int {
-	generator := rs.getPolynomial(eccCount)
-	info := NewGFPoly(rs.gf, data)
-	info = info.MultByMonominal(eccCount, 1)
-	_, remainder := info.Divide(generator)
-
-	result := make([]int, eccCount)
-	numZero := int(eccCount) - len(remainder.Coefficients)
-	copy(result[numZero:], remainder.Coefficients)
-	return result
-}

implant/vendor/github.com/boombuler/barcode/utils/runeint.go

@@ -1,19 +0,0 @@
-package utils
-
-// RuneToInt converts a rune between '0' and '9' to an integer between 0 and 9
-// If the rune is outside of this range -1 is returned.
-func RuneToInt(r rune) int {
-	if r >= '0' && r <= '9' {
-		return int(r - '0')
-	}
-	return -1
-}
-
-// IntToRune converts a digit 0 - 9 to the rune '0' - '9'. If the given int is outside
-// of this range 'F' is returned!
-func IntToRune(i int) rune {
-	if i >= 0 && i <= 9 {
-		return rune(i + '0')
-	}
-	return 'F'
-}

implant/vendor/github.com/pquerna/otp/.travis.yml

@@ -1,10 +0,0 @@
-arch:
-  - amd64
-  - ppc64le
-language: go
-
-env:
-  - GO111MODULE=on
-
-go:
-  - "1.15"

implant/vendor/github.com/pquerna/otp/NOTICE

@@ -1,5 +0,0 @@
-otp
-Copyright (c) 2014, Paul Querna
-
-This product includes software developed by 
-Paul Querna (http://paul.querna.org/).

implant/vendor/github.com/pquerna/otp/README.md

@@ -1,60 +0,0 @@
-# otp: One Time Password utilities Go / Golang
-
-[![PkgGoDev](https://pkg.go.dev/badge/github.com/pquerna/otp)](https://pkg.go.dev/github.com/pquerna/otp) [![Build Status](https://travis-ci.org/pquerna/otp.svg?branch=master)](https://travis-ci.org/pquerna/otp)
-
-# Why One Time Passwords?
-
-One Time Passwords (OTPs) are an mechanism to  improve security over passwords alone. When a Time-based OTP (TOTP) is stored on a user's phone, and combined with something the user knows (Password), you have an easy on-ramp to [Multi-factor authentication](http://en.wikipedia.org/wiki/Multi-factor_authentication) without adding a dependency on a SMS provider.  This Password and TOTP combination is used by many popular websites including Google, Github, Facebook, Salesforce and many others.
-
-The `otp` library enables you to easily add TOTPs to your own application, increasing your user's security against mass-password breaches and malware.
-
-Because TOTP is standardized and widely deployed, there are many [mobile clients and software implementations](http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm#Client_implementations).
-
-## `otp` Supports:
-
-* Generating QR Code images for easy user enrollment.
-* Time-based One-time Password Algorithm (TOTP) (RFC 6238): Time based OTP, the most commonly used method.
-* HMAC-based One-time Password Algorithm (HOTP) (RFC 4226): Counter based OTP, which TOTP is based upon.
-* Generation and Validation of codes for either algorithm.
-
-## Implementing TOTP in your application:
-
-### User Enrollment
-
-For an example of a working enrollment work flow, [Github has documented theirs](https://help.github.com/articles/configuring-two-factor-authentication-via-a-totp-mobile-app/
-),  but the basics are:
-
-1. Generate new TOTP Key for a User. `key,_ := totp.Generate(...)`.
-1. Display the Key's Secret and QR-Code for the User. `key.Secret()` and `key.Image(...)`.
-1. Test that the user can successfully use their TOTP. `totp.Validate(...)`.
-1. Store TOTP Secret for the User in your backend. `key.Secret()`
-1. Provide the user with "recovery codes". (See Recovery Codes bellow)
-
-### Code Generation
-
-* In either TOTP or HOTP cases, use the `GenerateCode` function and a counter or
-  `time.Time` struct to generate a valid code compatible with most implementations.
-* For uncommon or custom settings, or to catch unlikely errors, use `GenerateCodeCustom`
-  in either module.
-
-### Validation
-
-1. Prompt and validate User's password as normal.
-1. If the user has TOTP enabled, prompt for TOTP passcode.
-1. Retrieve the User's TOTP Secret from your backend.
-1. Validate the user's passcode. `totp.Validate(...)`
-
-
-### Recovery Codes
-
-When a user loses access to their TOTP device, they would no longer have access to their account.  Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, this is a common problem. For this reason many providers give their users "backup codes" or "recovery codes".  These are a set of one time use codes that can be used instead of the TOTP.  These can simply be randomly generated strings that you store in your backend.  [Github's documentation provides an overview of the user experience](
-https://help.github.com/articles/downloading-your-two-factor-authentication-recovery-codes/).
-
-
-## Improvements, bugs, adding feature, etc:
-
-Please [open issues in Github](https://github.com/pquerna/otp/issues) for ideas, bugs, and general thoughts.  Pull requests are of course preferred :)
-
-## License
-
-`otp` is licensed under the [Apache License, Version 2.0](./LICENSE)

implant/vendor/github.com/pquerna/otp/doc.go

@@ -1,70 +0,0 @@
-/**
- *  Copyright 2014 Paul Querna
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- */
-
-// Package otp implements both HOTP and TOTP based
-// one time passcodes in a Google Authenticator compatible manner.
-//
-// When adding a TOTP for a user, you must store the "secret" value
-// persistently. It is recommend to store the secret in an encrypted field in your
-// datastore.  Due to how TOTP works, it is not possible to store a hash
-// for the secret value like you would a password.
-//
-// To enroll a user, you must first generate an OTP for them.  Google
-// Authenticator supports using a QR code as an enrollment method:
-//
-//	import (
-//		"github.com/pquerna/otp/totp"
-//
-//		"bytes"
-//		"image/png"
-//	)
-//
-//	key, err := totp.Generate(totp.GenerateOpts{
-//			Issuer: "Example.com",
-//			AccountName: "[email protected]",
-//	})
-//
-//	// Convert TOTP key into a QR code encoded as a PNG image.
-//	var buf bytes.Buffer
-//	img, err := key.Image(200, 200)
-//	png.Encode(&buf, img)
-//
-//	// display the QR code to the user.
-//	display(buf.Bytes())
-//
-//	// Now Validate that the user's successfully added the passcode.
-//	passcode := promptForPasscode()
-//	valid := totp.Validate(passcode, key.Secret())
-//
-//	if valid {
-//		// User successfully used their TOTP, save it to your backend!
-//		storeSecret("[email protected]", key.Secret())
-//	}
-//
-// Validating a TOTP passcode is very easy, just prompt the user for a passcode
-// and retrieve the associated user's previously stored secret.
-//	import "github.com/pquerna/otp/totp"
-//
-//	passcode := promptForPasscode()
-//	secret := getSecret("[email protected]")
-//
-//	valid := totp.Validate(passcode, secret)
-//
-//	if valid {
-//		// Success! continue login process.
-//	}
-package otp

implant/vendor/github.com/pquerna/otp/hotp/hotp.go

@@ -1,211 +0,0 @@
-/**
- *  Copyright 2014 Paul Querna
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- */
-
-package hotp
-
-import (
-	"github.com/pquerna/otp"
-	"io"
-
-	"crypto/hmac"
-	"crypto/rand"
-	"crypto/subtle"
-	"encoding/base32"
-	"encoding/binary"
-	"fmt"
-	"math"
-	"net/url"
-	"strings"
-)
-
-const debug = false
-
-// Validate a HOTP passcode given a counter and secret.
-// This is a shortcut for ValidateCustom, with parameters that
-// are compataible with Google-Authenticator.
-func Validate(passcode string, counter uint64, secret string) bool {
-	rv, _ := ValidateCustom(
-		passcode,
-		counter,
-		secret,
-		ValidateOpts{
-			Digits:    otp.DigitsSix,
-			Algorithm: otp.AlgorithmSHA1,
-		},
-	)
-	return rv
-}
-
-// ValidateOpts provides options for ValidateCustom().
-type ValidateOpts struct {
-	// Digits as part of the input. Defaults to 6.
-	Digits otp.Digits
-	// Algorithm to use for HMAC. Defaults to SHA1.
-	Algorithm otp.Algorithm
-}
-
-// GenerateCode creates a HOTP passcode given a counter and secret.
-// This is a shortcut for GenerateCodeCustom, with parameters that
-// are compataible with Google-Authenticator.
-func GenerateCode(secret string, counter uint64) (string, error) {
-	return GenerateCodeCustom(secret, counter, ValidateOpts{
-		Digits:    otp.DigitsSix,
-		Algorithm: otp.AlgorithmSHA1,
-	})
-}
-
-// GenerateCodeCustom uses a counter and secret value and options struct to
-// create a passcode.
-func GenerateCodeCustom(secret string, counter uint64, opts ValidateOpts) (passcode string, err error) {
-	// As noted in issue #10 and #17 this adds support for TOTP secrets that are
-	// missing their padding.
-	secret = strings.TrimSpace(secret)
-	if n := len(secret) % 8; n != 0 {
-		secret = secret + strings.Repeat("=", 8-n)
-	}
-
-	// As noted in issue #24 Google has started producing base32 in lower case,
-	// but the StdEncoding (and the RFC), expect a dictionary of only upper case letters.
-	secret = strings.ToUpper(secret)
-
-	secretBytes, err := base32.StdEncoding.DecodeString(secret)
-	if err != nil {
-		return "", otp.ErrValidateSecretInvalidBase32
-	}
-
-	buf := make([]byte, 8)
-	mac := hmac.New(opts.Algorithm.Hash, secretBytes)
-	binary.BigEndian.PutUint64(buf, counter)
-	if debug {
-		fmt.Printf("counter=%v\n", counter)
-		fmt.Printf("buf=%v\n", buf)
-	}
-
-	mac.Write(buf)
-	sum := mac.Sum(nil)
-
-	// "Dynamic truncation" in RFC 4226
-	// http://tools.ietf.org/html/rfc4226#section-5.4
-	offset := sum[len(sum)-1] & 0xf
-	value := int64(((int(sum[offset]) & 0x7f) << 24) |
-		((int(sum[offset+1] & 0xff)) << 16) |
-		((int(sum[offset+2] & 0xff)) << 8) |
-		(int(sum[offset+3]) & 0xff))
-
-	l := opts.Digits.Length()
-	mod := int32(value % int64(math.Pow10(l)))
-
-	if debug {
-		fmt.Printf("offset=%v\n", offset)
-		fmt.Printf("value=%v\n", value)
-		fmt.Printf("mod'ed=%v\n", mod)
-	}
-
-	return opts.Digits.Format(mod), nil
-}
-
-// ValidateCustom validates an HOTP with customizable options. Most users should
-// use Validate().
-func ValidateCustom(passcode string, counter uint64, secret string, opts ValidateOpts) (bool, error) {
-	passcode = strings.TrimSpace(passcode)
-
-	if len(passcode) != opts.Digits.Length() {
-		return false, otp.ErrValidateInputInvalidLength
-	}
-
-	otpstr, err := GenerateCodeCustom(secret, counter, opts)
-	if err != nil {
-		return false, err
-	}
-
-	if subtle.ConstantTimeCompare([]byte(otpstr), []byte(passcode)) == 1 {
-		return true, nil
-	}
-
-	return false, nil
-}
-
-// GenerateOpts provides options for .Generate()
-type GenerateOpts struct {
-	// Name of the issuing Organization/Company.
-	Issuer string
-	// Name of the User's Account (eg, email address)
-	AccountName string
-	// Size in size of the generated Secret. Defaults to 10 bytes.
-	SecretSize uint
-	// Secret to store. Defaults to a randomly generated secret of SecretSize.  You should generally leave this empty.
-	Secret []byte
-	// Digits to request. Defaults to 6.
-	Digits otp.Digits
-	// Algorithm to use for HMAC. Defaults to SHA1.
-	Algorithm otp.Algorithm
-	// Reader to use for generating HOTP Key.
-	Rand io.Reader
-}
-
-var b32NoPadding = base32.StdEncoding.WithPadding(base32.NoPadding)
-
-// Generate creates a new HOTP Key.
-func Generate(opts GenerateOpts) (*otp.Key, error) {
-	// url encode the Issuer/AccountName
-	if opts.Issuer == "" {
-		return nil, otp.ErrGenerateMissingIssuer
-	}
-
-	if opts.AccountName == "" {
-		return nil, otp.ErrGenerateMissingAccountName
-	}
-
-	if opts.SecretSize == 0 {
-		opts.SecretSize = 10
-	}
-
-	if opts.Digits == 0 {
-		opts.Digits = otp.DigitsSix
-	}
-
-	if opts.Rand == nil {
-		opts.Rand = rand.Reader
-	}
-
-	// otpauth://totp/Example:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Example
-
-	v := url.Values{}
-	if len(opts.Secret) != 0 {
-		v.Set("secret", b32NoPadding.EncodeToString(opts.Secret))
-	} else {
-		secret := make([]byte, opts.SecretSize)
-		_, err := opts.Rand.Read(secret)
-		if err != nil {
-			return nil, err
-		}
-		v.Set("secret", b32NoPadding.EncodeToString(secret))
-	}
-
-	v.Set("issuer", opts.Issuer)
-	v.Set("algorithm", opts.Algorithm.String())
-	v.Set("digits", opts.Digits.String())
-
-	u := url.URL{
-		Scheme:   "otpauth",
-		Host:     "hotp",
-		Path:     "/" + opts.Issuer + ":" + opts.AccountName,
-		RawQuery: v.Encode(),
-	}
-
-	return otp.NewKeyFromURL(u.String())
-}

implant/vendor/github.com/pquerna/otp/otp.go

@@ -1,223 +0,0 @@
-/**
- *  Copyright 2014 Paul Querna
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- */
-
-package otp
-
-import (
-	"github.com/boombuler/barcode"
-	"github.com/boombuler/barcode/qr"
-
-	"crypto/md5"
-	"crypto/sha1"
-	"crypto/sha256"
-	"crypto/sha512"
-	"errors"
-	"fmt"
-	"hash"
-	"image"
-	"net/url"
-	"strings"
-	"strconv"
-)
-
-// Error when attempting to convert the secret from base32 to raw bytes.
-var ErrValidateSecretInvalidBase32 = errors.New("Decoding of secret as base32 failed.")
-
-// The user provided passcode length was not expected.
-var ErrValidateInputInvalidLength = errors.New("Input length unexpected")
-
-// When generating a Key, the Issuer must be set.
-var ErrGenerateMissingIssuer = errors.New("Issuer must be set")
-
-// When generating a Key, the Account Name must be set.
-var ErrGenerateMissingAccountName = errors.New("AccountName must be set")
-
-// Key represents an TOTP or HTOP key.
-type Key struct {
-	orig string
-	url  *url.URL
-}
-
-// NewKeyFromURL creates a new Key from an TOTP or HOTP url.
-//
-// The URL format is documented here:
-//   https://github.com/google/google-authenticator/wiki/Key-Uri-Format
-//
-func NewKeyFromURL(orig string) (*Key, error) {
-	s := strings.TrimSpace(orig)
-
-	u, err := url.Parse(s)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return &Key{
-		orig: s,
-		url:  u,
-	}, nil
-}
-
-func (k *Key) String() string {
-	return k.orig
-}
-
-// Image returns an QR-Code image of the specified width and height,
-// suitable for use by many clients like Google-Authenricator
-// to enroll a user's TOTP/HOTP key.
-func (k *Key) Image(width int, height int) (image.Image, error) {
-	b, err := qr.Encode(k.orig, qr.M, qr.Auto)
-
-	if err != nil {
-		return nil, err
-	}
-
-	b, err = barcode.Scale(b, width, height)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return b, nil
-}
-
-// Type returns "hotp" or "totp".
-func (k *Key) Type() string {
-	return k.url.Host
-}
-
-// Issuer returns the name of the issuing organization.
-func (k *Key) Issuer() string {
-	q := k.url.Query()
-
-	issuer := q.Get("issuer")
-
-	if issuer != "" {
-		return issuer
-	}
-
-	p := strings.TrimPrefix(k.url.Path, "/")
-	i := strings.Index(p, ":")
-
-	if i == -1 {
-		return ""
-	}
-
-	return p[:i]
-}
-
-// AccountName returns the name of the user's account.
-func (k *Key) AccountName() string {
-	p := strings.TrimPrefix(k.url.Path, "/")
-	i := strings.Index(p, ":")
-
-	if i == -1 {
-		return p
-	}
-
-	return p[i+1:]
-}
-
-// Secret returns the opaque secret for this Key.
-func (k *Key) Secret() string {
-	q := k.url.Query()
-
-	return q.Get("secret")
-}
-
-// Period returns a tiny int representing the rotation time in seconds.
-func (k *Key) Period() uint64 {
-	q := k.url.Query()
-
-	if u, err := strconv.ParseUint(q.Get("period"), 10, 64); err == nil {
-		return u
-	}
-	
-	// If no period is defined 30 seconds is the default per (rfc6238)
-	return 30
-}
-
-// URL returns the OTP URL as a string
-func (k *Key) URL() string {
-	return k.url.String()
-}
-
-// Algorithm represents the hashing function to use in the HMAC
-// operation needed for OTPs.
-type Algorithm int
-
-const (
-	// AlgorithmSHA1 should be used for compatibility with Google Authenticator.
-	//
-	// See https://github.com/pquerna/otp/issues/55 for additional details.
-	AlgorithmSHA1 Algorithm = iota
-	AlgorithmSHA256
-	AlgorithmSHA512
-	AlgorithmMD5
-)
-
-func (a Algorithm) String() string {
-	switch a {
-	case AlgorithmSHA1:
-		return "SHA1"
-	case AlgorithmSHA256:
-		return "SHA256"
-	case AlgorithmSHA512:
-		return "SHA512"
-	case AlgorithmMD5:
-		return "MD5"
-	}
-	panic("unreached")
-}
-
-func (a Algorithm) Hash() hash.Hash {
-	switch a {
-	case AlgorithmSHA1:
-		return sha1.New()
-	case AlgorithmSHA256:
-		return sha256.New()
-	case AlgorithmSHA512:
-		return sha512.New()
-	case AlgorithmMD5:
-		return md5.New()
-	}
-	panic("unreached")
-}
-
-// Digits represents the number of digits present in the
-// user's OTP passcode. Six and Eight are the most common values.
-type Digits int
-
-const (
-	DigitsSix   Digits = 6
-	DigitsEight Digits = 8
-)
-
-// Format converts an integer into the zero-filled size for this Digits.
-func (d Digits) Format(in int32) string {
-	f := fmt.Sprintf("%%0%dd", d)
-	return fmt.Sprintf(f, in)
-}
-
-// Length returns the number of characters for this Digits.
-func (d Digits) Length() int {
-	return int(d)
-}
-
-func (d Digits) String() string {
-	return fmt.Sprintf("%d", d)
-}

implant/vendor/github.com/pquerna/otp/totp/totp.go

@@ -1,206 +0,0 @@
-/**
- *  Copyright 2014 Paul Querna
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- */
-
-package totp
-
-import (
-	"github.com/pquerna/otp"
-	"github.com/pquerna/otp/hotp"
-	"io"
-
-	"crypto/rand"
-	"encoding/base32"
-	"math"
-	"net/url"
-	"strconv"
-	"time"
-)
-
-// Validate a TOTP using the current time.
-// A shortcut for ValidateCustom, Validate uses a configuration
-// that is compatible with Google-Authenticator and most clients.
-func Validate(passcode string, secret string) bool {
-	rv, _ := ValidateCustom(
-		passcode,
-		secret,
-		time.Now().UTC(),
-		ValidateOpts{
-			Period:    30,
-			Skew:      1,
-			Digits:    otp.DigitsSix,
-			Algorithm: otp.AlgorithmSHA1,
-		},
-	)
-	return rv
-}
-
-// GenerateCode creates a TOTP token using the current time.
-// A shortcut for GenerateCodeCustom, GenerateCode uses a configuration
-// that is compatible with Google-Authenticator and most clients.
-func GenerateCode(secret string, t time.Time) (string, error) {
-	return GenerateCodeCustom(secret, t, ValidateOpts{
-		Period:    30,
-		Skew:      1,
-		Digits:    otp.DigitsSix,
-		Algorithm: otp.AlgorithmSHA1,
-	})
-}
-
-// ValidateOpts provides options for ValidateCustom().
-type ValidateOpts struct {
-	// Number of seconds a TOTP hash is valid for. Defaults to 30 seconds.
-	Period uint
-	// Periods before or after the current time to allow.  Value of 1 allows up to Period
-	// of either side of the specified time.  Defaults to 0 allowed skews.  Values greater
-	// than 1 are likely sketchy.
-	Skew uint
-	// Digits as part of the input. Defaults to 6.
-	Digits otp.Digits
-	// Algorithm to use for HMAC. Defaults to SHA1.
-	Algorithm otp.Algorithm
-}
-
-// GenerateCodeCustom takes a timepoint and produces a passcode using a
-// secret and the provided opts. (Under the hood, this is making an adapted
-// call to hotp.GenerateCodeCustom)
-func GenerateCodeCustom(secret string, t time.Time, opts ValidateOpts) (passcode string, err error) {
-	if opts.Period == 0 {
-		opts.Period = 30
-	}
-	counter := uint64(math.Floor(float64(t.Unix()) / float64(opts.Period)))
-	passcode, err = hotp.GenerateCodeCustom(secret, counter, hotp.ValidateOpts{
-		Digits:    opts.Digits,
-		Algorithm: opts.Algorithm,
-	})
-	if err != nil {
-		return "", err
-	}
-	return passcode, nil
-}
-
-// ValidateCustom validates a TOTP given a user specified time and custom options.
-// Most users should use Validate() to provide an interpolatable TOTP experience.
-func ValidateCustom(passcode string, secret string, t time.Time, opts ValidateOpts) (bool, error) {
-	if opts.Period == 0 {
-		opts.Period = 30
-	}
-
-	counters := []uint64{}
-	counter := int64(math.Floor(float64(t.Unix()) / float64(opts.Period)))
-
-	counters = append(counters, uint64(counter))
-	for i := 1; i <= int(opts.Skew); i++ {
-		counters = append(counters, uint64(counter+int64(i)))
-		counters = append(counters, uint64(counter-int64(i)))
-	}
-
-	for _, counter := range counters {
-		rv, err := hotp.ValidateCustom(passcode, counter, secret, hotp.ValidateOpts{
-			Digits:    opts.Digits,
-			Algorithm: opts.Algorithm,
-		})
-
-		if err != nil {
-			return false, err
-		}
-
-		if rv == true {
-			return true, nil
-		}
-	}
-
-	return false, nil
-}
-
-// GenerateOpts provides options for Generate().  The default values
-// are compatible with Google-Authenticator.
-type GenerateOpts struct {
-	// Name of the issuing Organization/Company.
-	Issuer string
-	// Name of the User's Account (eg, email address)
-	AccountName string
-	// Number of seconds a TOTP hash is valid for. Defaults to 30 seconds.
-	Period uint
-	// Size in size of the generated Secret. Defaults to 20 bytes.
-	SecretSize uint
-	// Secret to store. Defaults to a randomly generated secret of SecretSize.  You should generally leave this empty.
-	Secret []byte
-	// Digits to request. Defaults to 6.
-	Digits otp.Digits
-	// Algorithm to use for HMAC. Defaults to SHA1.
-	Algorithm otp.Algorithm
-	// Reader to use for generating TOTP Key.
-	Rand io.Reader
-}
-
-var b32NoPadding = base32.StdEncoding.WithPadding(base32.NoPadding)
-
-// Generate a new TOTP Key.
-func Generate(opts GenerateOpts) (*otp.Key, error) {
-	// url encode the Issuer/AccountName
-	if opts.Issuer == "" {
-		return nil, otp.ErrGenerateMissingIssuer
-	}
-
-	if opts.AccountName == "" {
-		return nil, otp.ErrGenerateMissingAccountName
-	}
-
-	if opts.Period == 0 {
-		opts.Period = 30
-	}
-
-	if opts.SecretSize == 0 {
-		opts.SecretSize = 20
-	}
-
-	if opts.Digits == 0 {
-		opts.Digits = otp.DigitsSix
-	}
-
-	if opts.Rand == nil {
-		opts.Rand = rand.Reader
-	}
-
-	// otpauth://totp/Example:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Example
-
-	v := url.Values{}
-	if len(opts.Secret) != 0 {
-		v.Set("secret", b32NoPadding.EncodeToString(opts.Secret))
-	} else {
-		secret := make([]byte, opts.SecretSize)
-		_, err := opts.Rand.Read(secret)
-		if err != nil {
-			return nil, err
-		}
-		v.Set("secret", b32NoPadding.EncodeToString(secret))
-	}
-
-	v.Set("issuer", opts.Issuer)
-	v.Set("period", strconv.FormatUint(uint64(opts.Period), 10))
-	v.Set("algorithm", opts.Algorithm.String())
-	v.Set("digits", opts.Digits.String())
-
-	u := url.URL{
-		Scheme:   "otpauth",
-		Host:     "totp",
-		Path:     "/" + opts.Issuer + ":" + opts.AccountName,
-		RawQuery: v.Encode(),
-	}
-
-	return otp.NewKeyFromURL(u.String())
-}

implant/vendor/golang.org/x/crypto/AUTHORS

@@ -1,3 +0,0 @@
-# This source code refers to The Go Authors for copyright purposes.
-# The master list of authors is in the main Go distribution,
-# visible at https://tip.golang.org/AUTHORS.

implant/vendor/golang.org/x/crypto/CONTRIBUTORS

@@ -1,3 +0,0 @@
-# This source code was written by the Go contributors.
-# The master list of contributors is in the main Go distribution,
-# visible at https://tip.golang.org/CONTRIBUTORS.

implant/vendor/golang.org/x/crypto/chacha20/chacha_generic.go

@@ -12,7 +12,7 @@ import (
 	"errors"
 	"math/bits"
 
-	"golang.org/x/crypto/internal/subtle"
+	"golang.org/x/crypto/internal/alias"
 )
 
 const (
@@ -189,7 +189,7 @@ func (s *Cipher) XORKeyStream(dst, src []byte) {
 		panic("chacha20: output smaller than input")
 	}
 	dst = dst[:len(src)]
-	if subtle.InexactOverlap(dst, src) {
+	if alias.InexactOverlap(dst, src) {
 		panic("chacha20: invalid buffer overlap")
 	}
 

implant/vendor/golang.org/x/crypto/chacha20/chacha_s390x.go

@@ -15,6 +15,7 @@ const bufSize = 256
 
 // xorKeyStreamVX is an assembly implementation of XORKeyStream. It must only
 // be called when the vector facility is available. Implementation in asm_s390x.s.
+//
 //go:noescape
 func xorKeyStreamVX(dst, src []byte, key *[8]uint32, nonce *[3]uint32, counter *uint32)
 

implant/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go

@@ -10,7 +10,7 @@ package chacha20poly1305
 import (
 	"encoding/binary"
 
-	"golang.org/x/crypto/internal/subtle"
+	"golang.org/x/crypto/internal/alias"
 	"golang.org/x/sys/cpu"
 )
 
@@ -56,7 +56,7 @@ func (c *chacha20poly1305) seal(dst, nonce, plaintext, additionalData []byte) []
 	setupState(&state, &c.key, nonce)
 
 	ret, out := sliceForAppend(dst, len(plaintext)+16)
-	if subtle.InexactOverlap(out, plaintext) {
+	if alias.InexactOverlap(out, plaintext) {
 		panic("chacha20poly1305: invalid buffer overlap")
 	}
 	chacha20Poly1305Seal(out[:], state[:], plaintext, additionalData)
@@ -73,7 +73,7 @@ func (c *chacha20poly1305) open(dst, nonce, ciphertext, additionalData []byte) (
 
 	ciphertext = ciphertext[:len(ciphertext)-16]
 	ret, out := sliceForAppend(dst, len(ciphertext))
-	if subtle.InexactOverlap(out, ciphertext) {
+	if alias.InexactOverlap(out, ciphertext) {
 		panic("chacha20poly1305: invalid buffer overlap")
 	}
 	if !chacha20Poly1305Open(out, state[:], ciphertext, additionalData) {

implant/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_generic.go

@@ -8,8 +8,8 @@ import (
 	"encoding/binary"
 
 	"golang.org/x/crypto/chacha20"
+	"golang.org/x/crypto/internal/alias"
 	"golang.org/x/crypto/internal/poly1305"
-	"golang.org/x/crypto/internal/subtle"
 )
 
 func writeWithPadding(p *poly1305.MAC, b []byte) {
@@ -30,7 +30,7 @@ func writeUint64(p *poly1305.MAC, n int) {
 func (c *chacha20poly1305) sealGeneric(dst, nonce, plaintext, additionalData []byte) []byte {
 	ret, out := sliceForAppend(dst, len(plaintext)+poly1305.TagSize)
 	ciphertext, tag := out[:len(plaintext)], out[len(plaintext):]
-	if subtle.InexactOverlap(out, plaintext) {
+	if alias.InexactOverlap(out, plaintext) {
 		panic("chacha20poly1305: invalid buffer overlap")
 	}
 
@@ -66,7 +66,7 @@ func (c *chacha20poly1305) openGeneric(dst, nonce, ciphertext, additionalData []
 	writeUint64(p, len(ciphertext))
 
 	ret, out := sliceForAppend(dst, len(ciphertext))
-	if subtle.InexactOverlap(out, ciphertext) {
+	if alias.InexactOverlap(out, ciphertext) {
 		panic("chacha20poly1305: invalid buffer overlap")
 	}
 	if !p.Verify(tag) {

implant/vendor/golang.org/x/crypto/curve25519/curve25519.go

@@ -9,7 +9,8 @@ package curve25519 // import "golang.org/x/crypto/curve25519"
 
 import (
 	"crypto/subtle"
-	"fmt"
+	"errors"
+	"strconv"
 
 	"golang.org/x/crypto/curve25519/internal/field"
 )
@@ -124,10 +125,10 @@ func X25519(scalar, point []byte) ([]byte, error) {
 func x25519(dst *[32]byte, scalar, point []byte) ([]byte, error) {
 	var in [32]byte
 	if l := len(scalar); l != 32 {
-		return nil, fmt.Errorf("bad scalar length: %d, expected %d", l, 32)
+		return nil, errors.New("bad scalar length: " + strconv.Itoa(l) + ", expected 32")
 	}
 	if l := len(point); l != 32 {
-		return nil, fmt.Errorf("bad point length: %d, expected %d", l, 32)
+		return nil, errors.New("bad point length: " + strconv.Itoa(l) + ", expected 32")
 	}
 	copy(in[:], scalar)
 	if &point[0] == &Basepoint[0] {
@@ -138,7 +139,7 @@ func x25519(dst *[32]byte, scalar, point []byte) ([]byte, error) {
 		copy(base[:], point)
 		ScalarMult(dst, &in, &base)
 		if subtle.ConstantTimeCompare(dst[:], zero[:]) == 1 {
-			return nil, fmt.Errorf("bad input point: low order point")
+			return nil, errors.New("bad input point: low order point")
 		}
 	}
 	return dst[:], nil

implant/vendor/golang.org/x/crypto/curve25519/internal/field/fe_amd64.go

@@ -1,13 +1,16 @@
 // Code generated by command: go run fe_amd64_asm.go -out ../fe_amd64.s -stubs ../fe_amd64.go -pkg field. DO NOT EDIT.
 
+//go:build amd64 && gc && !purego
 // +build amd64,gc,!purego
 
 package field
 
 // feMul sets out = a * b. It works like feMulGeneric.
+//
 //go:noescape
 func feMul(out *Element, a *Element, b *Element)
 
 // feSquare sets out = a * a. It works like feSquareGeneric.
+//
 //go:noescape
 func feSquare(out *Element, a *Element)

implant/vendor/golang.org/x/crypto/hkdf/hkdf.go

@@ -0,0 +1,93 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package hkdf implements the HMAC-based Extract-and-Expand Key Derivation
+// Function (HKDF) as defined in RFC 5869.
+//
+// HKDF is a cryptographic key derivation function (KDF) with the goal of
+// expanding limited input keying material into one or more cryptographically
+// strong secret keys.
+package hkdf // import "golang.org/x/crypto/hkdf"
+
+import (
+	"crypto/hmac"
+	"errors"
+	"hash"
+	"io"
+)
+
+// Extract generates a pseudorandom key for use with Expand from an input secret
+// and an optional independent salt.
+//
+// Only use this function if you need to reuse the extracted key with multiple
+// Expand invocations and different context values. Most common scenarios,
+// including the generation of multiple keys, should use New instead.
+func Extract(hash func() hash.Hash, secret, salt []byte) []byte {
+	if salt == nil {
+		salt = make([]byte, hash().Size())
+	}
+	extractor := hmac.New(hash, salt)
+	extractor.Write(secret)
+	return extractor.Sum(nil)
+}
+
+type hkdf struct {
+	expander hash.Hash
+	size     int
+
+	info    []byte
+	counter byte
+
+	prev []byte
+	buf  []byte
+}
+
+func (f *hkdf) Read(p []byte) (int, error) {
+	// Check whether enough data can be generated
+	need := len(p)
+	remains := len(f.buf) + int(255-f.counter+1)*f.size
+	if remains < need {
+		return 0, errors.New("hkdf: entropy limit reached")
+	}
+	// Read any leftover from the buffer
+	n := copy(p, f.buf)
+	p = p[n:]
+
+	// Fill the rest of the buffer
+	for len(p) > 0 {
+		f.expander.Reset()
+		f.expander.Write(f.prev)
+		f.expander.Write(f.info)
+		f.expander.Write([]byte{f.counter})
+		f.prev = f.expander.Sum(f.prev[:0])
+		f.counter++
+
+		// Copy the new batch into p
+		f.buf = f.prev
+		n = copy(p, f.buf)
+		p = p[n:]
+	}
+	// Save leftovers for next run
+	f.buf = f.buf[n:]
+
+	return need, nil
+}
+
+// Expand returns a Reader, from which keys can be read, using the given
+// pseudorandom key and optional context info, skipping the extraction step.
+//
+// The pseudorandomKey should have been generated by Extract, or be a uniformly
+// random or pseudorandom cryptographically strong key. See RFC 5869, Section
+// 3.3. Most common scenarios will want to use New instead.
+func Expand(hash func() hash.Hash, pseudorandomKey, info []byte) io.Reader {
+	expander := hmac.New(hash, pseudorandomKey)
+	return &hkdf{expander, expander.Size(), info, 1, nil, nil}
+}
+
+// New returns a Reader, from which keys can be read, using the given hash,
+// secret, salt and context info. Salt and info can be nil.
+func New(hash func() hash.Hash, secret, salt, info []byte) io.Reader {
+	prk := Extract(hash, secret, salt)
+	return Expand(hash, prk, info)
+}

implant/vendor/golang.org/x/crypto/internal/alias/alias.go

@@ -5,9 +5,8 @@
 //go:build !purego
 // +build !purego
 
-// Package subtle implements functions that are often useful in cryptographic
-// code but require careful thought to use correctly.
-package subtle // import "golang.org/x/crypto/internal/subtle"
+// Package alias implements memory aliasing tests.
+package alias
 
 import "unsafe"
 

implant/vendor/golang.org/x/crypto/internal/alias/alias_purego.go

@@ -5,9 +5,8 @@
 //go:build purego
 // +build purego
 
-// Package subtle implements functions that are often useful in cryptographic
-// code but require careful thought to use correctly.
-package subtle // import "golang.org/x/crypto/internal/subtle"
+// Package alias implements memory aliasing tests.
+package alias
 
 // This is the Google App Engine standard variant based on reflect
 // because the unsafe package and cgo are disallowed.

implant/vendor/golang.org/x/crypto/internal/poly1305/sum_generic.go

@@ -136,7 +136,7 @@ func shiftRightBy2(a uint128) uint128 {
 // updateGeneric absorbs msg into the state.h accumulator. For each chunk m of
 // 128 bits of message, it computes
 //
-//     h₊ = (h + m) * r  mod  2¹³⁰ - 5
+//	h₊ = (h + m) * r  mod  2¹³⁰ - 5
 //
 // If the msg length is not a multiple of TagSize, it assumes the last
 // incomplete chunk is the final one.
@@ -278,8 +278,7 @@ const (
 
 // finalize completes the modular reduction of h and computes
 //
-//     out = h + s  mod  2¹²⁸
-//
+//	out = h + s  mod  2¹²⁸
 func finalize(out *[TagSize]byte, h *[3]uint64, s *[2]uint64) {
 	h0, h1, h2 := h[0], h[1], h[2]
 

implant/vendor/golang.org/x/crypto/internal/poly1305/sum_s390x.go

@@ -14,6 +14,7 @@ import (
 // updateVX is an assembly implementation of Poly1305 that uses vector
 // instructions. It must only be called if the vector facility (vx) is
 // available.
+//
 //go:noescape
 func updateVX(state *macState, msg []byte)
 

implant/vendor/golang.org/x/crypto/md4/md4block.go

@@ -8,9 +8,11 @@
 
 package md4
 
-var shift1 = []uint{3, 7, 11, 19}
-var shift2 = []uint{3, 5, 9, 13}
-var shift3 = []uint{3, 9, 11, 15}
+import "math/bits"
+
+var shift1 = []int{3, 7, 11, 19}
+var shift2 = []int{3, 5, 9, 13}
+var shift3 = []int{3, 9, 11, 15}
 
 var xIndex2 = []uint{0, 4, 8, 12, 1, 5, 9, 13, 2, 6, 10, 14, 3, 7, 11, 15}
 var xIndex3 = []uint{0, 8, 4, 12, 2, 10, 6, 14, 1, 9, 5, 13, 3, 11, 7, 15}
@@ -48,7 +50,7 @@ func _Block(dig *digest, p []byte) int {
 			s := shift1[i%4]
 			f := ((c ^ d) & b) ^ d
 			a += f + X[x]
-			a = a<<s | a>>(32-s)
+			a = bits.RotateLeft32(a, s)
 			a, b, c, d = d, a, b, c
 		}
 
@@ -58,7 +60,7 @@ func _Block(dig *digest, p []byte) int {
 			s := shift2[i%4]
 			g := (b & c) | (b & d) | (c & d)
 			a += g + X[x] + 0x5a827999
-			a = a<<s | a>>(32-s)
+			a = bits.RotateLeft32(a, s)
 			a, b, c, d = d, a, b, c
 		}
 
@@ -68,7 +70,7 @@ func _Block(dig *digest, p []byte) int {
 			s := shift3[i%4]
 			h := b ^ c ^ d
 			a += h + X[x] + 0x6ed9eba1
-			a = a<<s | a>>(32-s)
+			a = bits.RotateLeft32(a, s)
 			a, b, c, d = d, a, b, c
 		}
 

implant/vendor/golang.org/x/crypto/nacl/box/box.go

@@ -1,182 +0,0 @@
-// Copyright 2012 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-/*
-Package box authenticates and encrypts small messages using public-key cryptography.
-
-Box uses Curve25519, XSalsa20 and Poly1305 to encrypt and authenticate
-messages. The length of messages is not hidden.
-
-It is the caller's responsibility to ensure the uniqueness of nonces—for
-example, by using nonce 1 for the first message, nonce 2 for the second
-message, etc. Nonces are long enough that randomly generated nonces have
-negligible risk of collision.
-
-Messages should be small because:
-
-1. The whole message needs to be held in memory to be processed.
-
-2. Using large messages pressures implementations on small machines to decrypt
-and process plaintext before authenticating it. This is very dangerous, and
-this API does not allow it, but a protocol that uses excessive message sizes
-might present some implementations with no other choice.
-
-3. Fixed overheads will be sufficiently amortised by messages as small as 8KB.
-
-4. Performance may be improved by working with messages that fit into data caches.
-
-Thus large amounts of data should be chunked so that each message is small.
-(Each message still needs a unique nonce.) If in doubt, 16KB is a reasonable
-chunk size.
-
-This package is interoperable with NaCl: https://nacl.cr.yp.to/box.html.
-Anonymous sealing/opening is an extension of NaCl defined by and interoperable
-with libsodium:
-https://libsodium.gitbook.io/doc/public-key_cryptography/sealed_boxes.
-*/
-package box // import "golang.org/x/crypto/nacl/box"
-
-import (
-	cryptorand "crypto/rand"
-	"io"
-
-	"golang.org/x/crypto/blake2b"
-	"golang.org/x/crypto/curve25519"
-	"golang.org/x/crypto/nacl/secretbox"
-	"golang.org/x/crypto/salsa20/salsa"
-)
-
-const (
-	// Overhead is the number of bytes of overhead when boxing a message.
-	Overhead = secretbox.Overhead
-
-	// AnonymousOverhead is the number of bytes of overhead when using anonymous
-	// sealed boxes.
-	AnonymousOverhead = Overhead + 32
-)
-
-// GenerateKey generates a new public/private key pair suitable for use with
-// Seal and Open.
-func GenerateKey(rand io.Reader) (publicKey, privateKey *[32]byte, err error) {
-	publicKey = new([32]byte)
-	privateKey = new([32]byte)
-	_, err = io.ReadFull(rand, privateKey[:])
-	if err != nil {
-		publicKey = nil
-		privateKey = nil
-		return
-	}
-
-	curve25519.ScalarBaseMult(publicKey, privateKey)
-	return
-}
-
-var zeros [16]byte
-
-// Precompute calculates the shared key between peersPublicKey and privateKey
-// and writes it to sharedKey. The shared key can be used with
-// OpenAfterPrecomputation and SealAfterPrecomputation to speed up processing
-// when using the same pair of keys repeatedly.
-func Precompute(sharedKey, peersPublicKey, privateKey *[32]byte) {
-	curve25519.ScalarMult(sharedKey, privateKey, peersPublicKey)
-	salsa.HSalsa20(sharedKey, &zeros, sharedKey, &salsa.Sigma)
-}
-
-// Seal appends an encrypted and authenticated copy of message to out, which
-// will be Overhead bytes longer than the original and must not overlap it. The
-// nonce must be unique for each distinct message for a given pair of keys.
-func Seal(out, message []byte, nonce *[24]byte, peersPublicKey, privateKey *[32]byte) []byte {
-	var sharedKey [32]byte
-	Precompute(&sharedKey, peersPublicKey, privateKey)
-	return secretbox.Seal(out, message, nonce, &sharedKey)
-}
-
-// SealAfterPrecomputation performs the same actions as Seal, but takes a
-// shared key as generated by Precompute.
-func SealAfterPrecomputation(out, message []byte, nonce *[24]byte, sharedKey *[32]byte) []byte {
-	return secretbox.Seal(out, message, nonce, sharedKey)
-}
-
-// Open authenticates and decrypts a box produced by Seal and appends the
-// message to out, which must not overlap box. The output will be Overhead
-// bytes smaller than box.
-func Open(out, box []byte, nonce *[24]byte, peersPublicKey, privateKey *[32]byte) ([]byte, bool) {
-	var sharedKey [32]byte
-	Precompute(&sharedKey, peersPublicKey, privateKey)
-	return secretbox.Open(out, box, nonce, &sharedKey)
-}
-
-// OpenAfterPrecomputation performs the same actions as Open, but takes a
-// shared key as generated by Precompute.
-func OpenAfterPrecomputation(out, box []byte, nonce *[24]byte, sharedKey *[32]byte) ([]byte, bool) {
-	return secretbox.Open(out, box, nonce, sharedKey)
-}
-
-// SealAnonymous appends an encrypted and authenticated copy of message to out,
-// which will be AnonymousOverhead bytes longer than the original and must not
-// overlap it. This differs from Seal in that the sender is not required to
-// provide a private key.
-func SealAnonymous(out, message []byte, recipient *[32]byte, rand io.Reader) ([]byte, error) {
-	if rand == nil {
-		rand = cryptorand.Reader
-	}
-	ephemeralPub, ephemeralPriv, err := GenerateKey(rand)
-	if err != nil {
-		return nil, err
-	}
-
-	var nonce [24]byte
-	if err := sealNonce(ephemeralPub, recipient, &nonce); err != nil {
-		return nil, err
-	}
-
-	if total := len(out) + AnonymousOverhead + len(message); cap(out) < total {
-		original := out
-		out = make([]byte, 0, total)
-		out = append(out, original...)
-	}
-	out = append(out, ephemeralPub[:]...)
-
-	return Seal(out, message, &nonce, recipient, ephemeralPriv), nil
-}
-
-// OpenAnonymous authenticates and decrypts a box produced by SealAnonymous and
-// appends the message to out, which must not overlap box. The output will be
-// AnonymousOverhead bytes smaller than box.
-func OpenAnonymous(out, box []byte, publicKey, privateKey *[32]byte) (message []byte, ok bool) {
-	if len(box) < AnonymousOverhead {
-		return nil, false
-	}
-
-	var ephemeralPub [32]byte
-	copy(ephemeralPub[:], box[:32])
-
-	var nonce [24]byte
-	if err := sealNonce(&ephemeralPub, publicKey, &nonce); err != nil {
-		return nil, false
-	}
-
-	return Open(out, box[32:], &nonce, &ephemeralPub, privateKey)
-}
-
-// sealNonce generates a 24 byte nonce that is a blake2b digest of the
-// ephemeral public key and the receiver's public key.
-func sealNonce(ephemeralPub, peersPublicKey *[32]byte, nonce *[24]byte) error {
-	h, err := blake2b.New(24, nil)
-	if err != nil {
-		return err
-	}
-
-	if _, err = h.Write(ephemeralPub[:]); err != nil {
-		return err
-	}
-
-	if _, err = h.Write(peersPublicKey[:]); err != nil {
-		return err
-	}
-
-	h.Sum(nonce[:0])
-
-	return nil
-}

implant/vendor/golang.org/x/crypto/nacl/secretbox/secretbox.go

@@ -1,173 +0,0 @@
-// Copyright 2012 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-/*
-Package secretbox encrypts and authenticates small messages.
-
-Secretbox uses XSalsa20 and Poly1305 to encrypt and authenticate messages with
-secret-key cryptography. The length of messages is not hidden.
-
-It is the caller's responsibility to ensure the uniqueness of nonces—for
-example, by using nonce 1 for the first message, nonce 2 for the second
-message, etc. Nonces are long enough that randomly generated nonces have
-negligible risk of collision.
-
-Messages should be small because:
-
-1. The whole message needs to be held in memory to be processed.
-
-2. Using large messages pressures implementations on small machines to decrypt
-and process plaintext before authenticating it. This is very dangerous, and
-this API does not allow it, but a protocol that uses excessive message sizes
-might present some implementations with no other choice.
-
-3. Fixed overheads will be sufficiently amortised by messages as small as 8KB.
-
-4. Performance may be improved by working with messages that fit into data caches.
-
-Thus large amounts of data should be chunked so that each message is small.
-(Each message still needs a unique nonce.) If in doubt, 16KB is a reasonable
-chunk size.
-
-This package is interoperable with NaCl: https://nacl.cr.yp.to/secretbox.html.
-*/
-package secretbox // import "golang.org/x/crypto/nacl/secretbox"
-
-import (
-	"golang.org/x/crypto/internal/poly1305"
-	"golang.org/x/crypto/internal/subtle"
-	"golang.org/x/crypto/salsa20/salsa"
-)
-
-// Overhead is the number of bytes of overhead when boxing a message.
-const Overhead = poly1305.TagSize
-
-// setup produces a sub-key and Salsa20 counter given a nonce and key.
-func setup(subKey *[32]byte, counter *[16]byte, nonce *[24]byte, key *[32]byte) {
-	// We use XSalsa20 for encryption so first we need to generate a
-	// key and nonce with HSalsa20.
-	var hNonce [16]byte
-	copy(hNonce[:], nonce[:])
-	salsa.HSalsa20(subKey, &hNonce, key, &salsa.Sigma)
-
-	// The final 8 bytes of the original nonce form the new nonce.
-	copy(counter[:], nonce[16:])
-}
-
-// sliceForAppend takes a slice and a requested number of bytes. It returns a
-// slice with the contents of the given slice followed by that many bytes and a
-// second slice that aliases into it and contains only the extra bytes. If the
-// original slice has sufficient capacity then no allocation is performed.
-func sliceForAppend(in []byte, n int) (head, tail []byte) {
-	if total := len(in) + n; cap(in) >= total {
-		head = in[:total]
-	} else {
-		head = make([]byte, total)
-		copy(head, in)
-	}
-	tail = head[len(in):]
-	return
-}
-
-// Seal appends an encrypted and authenticated copy of message to out, which
-// must not overlap message. The key and nonce pair must be unique for each
-// distinct message and the output will be Overhead bytes longer than message.
-func Seal(out, message []byte, nonce *[24]byte, key *[32]byte) []byte {
-	var subKey [32]byte
-	var counter [16]byte
-	setup(&subKey, &counter, nonce, key)
-
-	// The Poly1305 key is generated by encrypting 32 bytes of zeros. Since
-	// Salsa20 works with 64-byte blocks, we also generate 32 bytes of
-	// keystream as a side effect.
-	var firstBlock [64]byte
-	salsa.XORKeyStream(firstBlock[:], firstBlock[:], &counter, &subKey)
-
-	var poly1305Key [32]byte
-	copy(poly1305Key[:], firstBlock[:])
-
-	ret, out := sliceForAppend(out, len(message)+poly1305.TagSize)
-	if subtle.AnyOverlap(out, message) {
-		panic("nacl: invalid buffer overlap")
-	}
-
-	// We XOR up to 32 bytes of message with the keystream generated from
-	// the first block.
-	firstMessageBlock := message
-	if len(firstMessageBlock) > 32 {
-		firstMessageBlock = firstMessageBlock[:32]
-	}
-
-	tagOut := out
-	out = out[poly1305.TagSize:]
-	for i, x := range firstMessageBlock {
-		out[i] = firstBlock[32+i] ^ x
-	}
-	message = message[len(firstMessageBlock):]
-	ciphertext := out
-	out = out[len(firstMessageBlock):]
-
-	// Now encrypt the rest.
-	counter[8] = 1
-	salsa.XORKeyStream(out, message, &counter, &subKey)
-
-	var tag [poly1305.TagSize]byte
-	poly1305.Sum(&tag, ciphertext, &poly1305Key)
-	copy(tagOut, tag[:])
-
-	return ret
-}
-
-// Open authenticates and decrypts a box produced by Seal and appends the
-// message to out, which must not overlap box. The output will be Overhead
-// bytes smaller than box.
-func Open(out, box []byte, nonce *[24]byte, key *[32]byte) ([]byte, bool) {
-	if len(box) < Overhead {
-		return nil, false
-	}
-
-	var subKey [32]byte
-	var counter [16]byte
-	setup(&subKey, &counter, nonce, key)
-
-	// The Poly1305 key is generated by encrypting 32 bytes of zeros. Since
-	// Salsa20 works with 64-byte blocks, we also generate 32 bytes of
-	// keystream as a side effect.
-	var firstBlock [64]byte
-	salsa.XORKeyStream(firstBlock[:], firstBlock[:], &counter, &subKey)
-
-	var poly1305Key [32]byte
-	copy(poly1305Key[:], firstBlock[:])
-	var tag [poly1305.TagSize]byte
-	copy(tag[:], box)
-
-	if !poly1305.Verify(&tag, box[poly1305.TagSize:], &poly1305Key) {
-		return nil, false
-	}
-
-	ret, out := sliceForAppend(out, len(box)-Overhead)
-	if subtle.AnyOverlap(out, box) {
-		panic("nacl: invalid buffer overlap")
-	}
-
-	// We XOR up to 32 bytes of box with the keystream generated from
-	// the first block.
-	box = box[Overhead:]
-	firstMessageBlock := box
-	if len(firstMessageBlock) > 32 {
-		firstMessageBlock = firstMessageBlock[:32]
-	}
-	for i, x := range firstMessageBlock {
-		out[i] = firstBlock[32+i] ^ x
-	}
-
-	box = box[len(firstMessageBlock):]
-	out = out[len(firstMessageBlock):]
-
-	// Now decrypt the rest.
-	counter[8] = 1
-	salsa.XORKeyStream(out, box, &counter, &subKey)
-
-	return ret, true
-}

implant/vendor/golang.org/x/crypto/pbkdf2/pbkdf2.go

@@ -32,7 +32,7 @@ import (
 // can get a derived key for e.g. AES-256 (which needs a 32-byte key) by
 // doing:
 //
-// 	dk := pbkdf2.Key([]byte("some password"), salt, 4096, 32, sha1.New)
+//	dk := pbkdf2.Key([]byte("some password"), salt, 4096, 32, sha1.New)
 //
 // Remember to get a good random salt. At least 8 bytes is recommended by the
 // RFC.

implant/vendor/golang.org/x/crypto/salsa20/salsa/hsalsa20.go

@@ -1,144 +0,0 @@
-// Copyright 2012 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package salsa provides low-level access to functions in the Salsa family.
-package salsa // import "golang.org/x/crypto/salsa20/salsa"
-
-// Sigma is the Salsa20 constant for 256-bit keys.
-var Sigma = [16]byte{'e', 'x', 'p', 'a', 'n', 'd', ' ', '3', '2', '-', 'b', 'y', 't', 'e', ' ', 'k'}
-
-// HSalsa20 applies the HSalsa20 core function to a 16-byte input in, 32-byte
-// key k, and 16-byte constant c, and puts the result into the 32-byte array
-// out.
-func HSalsa20(out *[32]byte, in *[16]byte, k *[32]byte, c *[16]byte) {
-	x0 := uint32(c[0]) | uint32(c[1])<<8 | uint32(c[2])<<16 | uint32(c[3])<<24
-	x1 := uint32(k[0]) | uint32(k[1])<<8 | uint32(k[2])<<16 | uint32(k[3])<<24
-	x2 := uint32(k[4]) | uint32(k[5])<<8 | uint32(k[6])<<16 | uint32(k[7])<<24
-	x3 := uint32(k[8]) | uint32(k[9])<<8 | uint32(k[10])<<16 | uint32(k[11])<<24
-	x4 := uint32(k[12]) | uint32(k[13])<<8 | uint32(k[14])<<16 | uint32(k[15])<<24
-	x5 := uint32(c[4]) | uint32(c[5])<<8 | uint32(c[6])<<16 | uint32(c[7])<<24
-	x6 := uint32(in[0]) | uint32(in[1])<<8 | uint32(in[2])<<16 | uint32(in[3])<<24
-	x7 := uint32(in[4]) | uint32(in[5])<<8 | uint32(in[6])<<16 | uint32(in[7])<<24
-	x8 := uint32(in[8]) | uint32(in[9])<<8 | uint32(in[10])<<16 | uint32(in[11])<<24
-	x9 := uint32(in[12]) | uint32(in[13])<<8 | uint32(in[14])<<16 | uint32(in[15])<<24
-	x10 := uint32(c[8]) | uint32(c[9])<<8 | uint32(c[10])<<16 | uint32(c[11])<<24
-	x11 := uint32(k[16]) | uint32(k[17])<<8 | uint32(k[18])<<16 | uint32(k[19])<<24
-	x12 := uint32(k[20]) | uint32(k[21])<<8 | uint32(k[22])<<16 | uint32(k[23])<<24
-	x13 := uint32(k[24]) | uint32(k[25])<<8 | uint32(k[26])<<16 | uint32(k[27])<<24
-	x14 := uint32(k[28]) | uint32(k[29])<<8 | uint32(k[30])<<16 | uint32(k[31])<<24
-	x15 := uint32(c[12]) | uint32(c[13])<<8 | uint32(c[14])<<16 | uint32(c[15])<<24
-
-	for i := 0; i < 20; i += 2 {
-		u := x0 + x12
-		x4 ^= u<<7 | u>>(32-7)
-		u = x4 + x0
-		x8 ^= u<<9 | u>>(32-9)
-		u = x8 + x4
-		x12 ^= u<<13 | u>>(32-13)
-		u = x12 + x8
-		x0 ^= u<<18 | u>>(32-18)
-
-		u = x5 + x1
-		x9 ^= u<<7 | u>>(32-7)
-		u = x9 + x5
-		x13 ^= u<<9 | u>>(32-9)
-		u = x13 + x9
-		x1 ^= u<<13 | u>>(32-13)
-		u = x1 + x13
-		x5 ^= u<<18 | u>>(32-18)
-
-		u = x10 + x6
-		x14 ^= u<<7 | u>>(32-7)
-		u = x14 + x10
-		x2 ^= u<<9 | u>>(32-9)
-		u = x2 + x14
-		x6 ^= u<<13 | u>>(32-13)
-		u = x6 + x2
-		x10 ^= u<<18 | u>>(32-18)
-
-		u = x15 + x11
-		x3 ^= u<<7 | u>>(32-7)
-		u = x3 + x15
-		x7 ^= u<<9 | u>>(32-9)
-		u = x7 + x3
-		x11 ^= u<<13 | u>>(32-13)
-		u = x11 + x7
-		x15 ^= u<<18 | u>>(32-18)
-
-		u = x0 + x3
-		x1 ^= u<<7 | u>>(32-7)
-		u = x1 + x0
-		x2 ^= u<<9 | u>>(32-9)
-		u = x2 + x1
-		x3 ^= u<<13 | u>>(32-13)
-		u = x3 + x2
-		x0 ^= u<<18 | u>>(32-18)
-
-		u = x5 + x4
-		x6 ^= u<<7 | u>>(32-7)
-		u = x6 + x5
-		x7 ^= u<<9 | u>>(32-9)
-		u = x7 + x6
-		x4 ^= u<<13 | u>>(32-13)
-		u = x4 + x7
-		x5 ^= u<<18 | u>>(32-18)
-
-		u = x10 + x9
-		x11 ^= u<<7 | u>>(32-7)
-		u = x11 + x10
-		x8 ^= u<<9 | u>>(32-9)
-		u = x8 + x11
-		x9 ^= u<<13 | u>>(32-13)
-		u = x9 + x8
-		x10 ^= u<<18 | u>>(32-18)
-
-		u = x15 + x14
-		x12 ^= u<<7 | u>>(32-7)
-		u = x12 + x15
-		x13 ^= u<<9 | u>>(32-9)
-		u = x13 + x12
-		x14 ^= u<<13 | u>>(32-13)
-		u = x14 + x13
-		x15 ^= u<<18 | u>>(32-18)
-	}
-	out[0] = byte(x0)
-	out[1] = byte(x0 >> 8)
-	out[2] = byte(x0 >> 16)
-	out[3] = byte(x0 >> 24)
-
-	out[4] = byte(x5)
-	out[5] = byte(x5 >> 8)
-	out[6] = byte(x5 >> 16)
-	out[7] = byte(x5 >> 24)
-
-	out[8] = byte(x10)
-	out[9] = byte(x10 >> 8)
-	out[10] = byte(x10 >> 16)
-	out[11] = byte(x10 >> 24)
-
-	out[12] = byte(x15)
-	out[13] = byte(x15 >> 8)
-	out[14] = byte(x15 >> 16)
-	out[15] = byte(x15 >> 24)
-
-	out[16] = byte(x6)
-	out[17] = byte(x6 >> 8)
-	out[18] = byte(x6 >> 16)
-	out[19] = byte(x6 >> 24)
-
-	out[20] = byte(x7)
-	out[21] = byte(x7 >> 8)
-	out[22] = byte(x7 >> 16)
-	out[23] = byte(x7 >> 24)
-
-	out[24] = byte(x8)
-	out[25] = byte(x8 >> 8)
-	out[26] = byte(x8 >> 16)
-	out[27] = byte(x8 >> 24)
-
-	out[28] = byte(x9)
-	out[29] = byte(x9 >> 8)
-	out[30] = byte(x9 >> 16)
-	out[31] = byte(x9 >> 24)
-}

implant/vendor/golang.org/x/crypto/salsa20/salsa/salsa208.go

@@ -1,199 +0,0 @@
-// Copyright 2012 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package salsa
-
-// Core208 applies the Salsa20/8 core function to the 64-byte array in and puts
-// the result into the 64-byte array out. The input and output may be the same array.
-func Core208(out *[64]byte, in *[64]byte) {
-	j0 := uint32(in[0]) | uint32(in[1])<<8 | uint32(in[2])<<16 | uint32(in[3])<<24
-	j1 := uint32(in[4]) | uint32(in[5])<<8 | uint32(in[6])<<16 | uint32(in[7])<<24
-	j2 := uint32(in[8]) | uint32(in[9])<<8 | uint32(in[10])<<16 | uint32(in[11])<<24
-	j3 := uint32(in[12]) | uint32(in[13])<<8 | uint32(in[14])<<16 | uint32(in[15])<<24
-	j4 := uint32(in[16]) | uint32(in[17])<<8 | uint32(in[18])<<16 | uint32(in[19])<<24
-	j5 := uint32(in[20]) | uint32(in[21])<<8 | uint32(in[22])<<16 | uint32(in[23])<<24
-	j6 := uint32(in[24]) | uint32(in[25])<<8 | uint32(in[26])<<16 | uint32(in[27])<<24
-	j7 := uint32(in[28]) | uint32(in[29])<<8 | uint32(in[30])<<16 | uint32(in[31])<<24
-	j8 := uint32(in[32]) | uint32(in[33])<<8 | uint32(in[34])<<16 | uint32(in[35])<<24
-	j9 := uint32(in[36]) | uint32(in[37])<<8 | uint32(in[38])<<16 | uint32(in[39])<<24
-	j10 := uint32(in[40]) | uint32(in[41])<<8 | uint32(in[42])<<16 | uint32(in[43])<<24
-	j11 := uint32(in[44]) | uint32(in[45])<<8 | uint32(in[46])<<16 | uint32(in[47])<<24
-	j12 := uint32(in[48]) | uint32(in[49])<<8 | uint32(in[50])<<16 | uint32(in[51])<<24
-	j13 := uint32(in[52]) | uint32(in[53])<<8 | uint32(in[54])<<16 | uint32(in[55])<<24
-	j14 := uint32(in[56]) | uint32(in[57])<<8 | uint32(in[58])<<16 | uint32(in[59])<<24
-	j15 := uint32(in[60]) | uint32(in[61])<<8 | uint32(in[62])<<16 | uint32(in[63])<<24
-
-	x0, x1, x2, x3, x4, x5, x6, x7, x8 := j0, j1, j2, j3, j4, j5, j6, j7, j8
-	x9, x10, x11, x12, x13, x14, x15 := j9, j10, j11, j12, j13, j14, j15
-
-	for i := 0; i < 8; i += 2 {
-		u := x0 + x12
-		x4 ^= u<<7 | u>>(32-7)
-		u = x4 + x0
-		x8 ^= u<<9 | u>>(32-9)
-		u = x8 + x4
-		x12 ^= u<<13 | u>>(32-13)
-		u = x12 + x8
-		x0 ^= u<<18 | u>>(32-18)
-
-		u = x5 + x1
-		x9 ^= u<<7 | u>>(32-7)
-		u = x9 + x5
-		x13 ^= u<<9 | u>>(32-9)
-		u = x13 + x9
-		x1 ^= u<<13 | u>>(32-13)
-		u = x1 + x13
-		x5 ^= u<<18 | u>>(32-18)
-
-		u = x10 + x6
-		x14 ^= u<<7 | u>>(32-7)
-		u = x14 + x10
-		x2 ^= u<<9 | u>>(32-9)
-		u = x2 + x14
-		x6 ^= u<<13 | u>>(32-13)
-		u = x6 + x2
-		x10 ^= u<<18 | u>>(32-18)
-
-		u = x15 + x11
-		x3 ^= u<<7 | u>>(32-7)
-		u = x3 + x15
-		x7 ^= u<<9 | u>>(32-9)
-		u = x7 + x3
-		x11 ^= u<<13 | u>>(32-13)
-		u = x11 + x7
-		x15 ^= u<<18 | u>>(32-18)
-
-		u = x0 + x3
-		x1 ^= u<<7 | u>>(32-7)
-		u = x1 + x0
-		x2 ^= u<<9 | u>>(32-9)
-		u = x2 + x1
-		x3 ^= u<<13 | u>>(32-13)
-		u = x3 + x2
-		x0 ^= u<<18 | u>>(32-18)
-
-		u = x5 + x4
-		x6 ^= u<<7 | u>>(32-7)
-		u = x6 + x5
-		x7 ^= u<<9 | u>>(32-9)
-		u = x7 + x6
-		x4 ^= u<<13 | u>>(32-13)
-		u = x4 + x7
-		x5 ^= u<<18 | u>>(32-18)
-
-		u = x10 + x9
-		x11 ^= u<<7 | u>>(32-7)
-		u = x11 + x10
-		x8 ^= u<<9 | u>>(32-9)
-		u = x8 + x11
-		x9 ^= u<<13 | u>>(32-13)
-		u = x9 + x8
-		x10 ^= u<<18 | u>>(32-18)
-
-		u = x15 + x14
-		x12 ^= u<<7 | u>>(32-7)
-		u = x12 + x15
-		x13 ^= u<<9 | u>>(32-9)
-		u = x13 + x12
-		x14 ^= u<<13 | u>>(32-13)
-		u = x14 + x13
-		x15 ^= u<<18 | u>>(32-18)
-	}
-	x0 += j0
-	x1 += j1
-	x2 += j2
-	x3 += j3
-	x4 += j4
-	x5 += j5
-	x6 += j6
-	x7 += j7
-	x8 += j8
-	x9 += j9
-	x10 += j10
-	x11 += j11
-	x12 += j12
-	x13 += j13
-	x14 += j14
-	x15 += j15
-
-	out[0] = byte(x0)
-	out[1] = byte(x0 >> 8)
-	out[2] = byte(x0 >> 16)
-	out[3] = byte(x0 >> 24)
-
-	out[4] = byte(x1)
-	out[5] = byte(x1 >> 8)
-	out[6] = byte(x1 >> 16)
-	out[7] = byte(x1 >> 24)
-
-	out[8] = byte(x2)
-	out[9] = byte(x2 >> 8)
-	out[10] = byte(x2 >> 16)
-	out[11] = byte(x2 >> 24)
-
-	out[12] = byte(x3)
-	out[13] = byte(x3 >> 8)
-	out[14] = byte(x3 >> 16)
-	out[15] = byte(x3 >> 24)
-
-	out[16] = byte(x4)
-	out[17] = byte(x4 >> 8)
-	out[18] = byte(x4 >> 16)
-	out[19] = byte(x4 >> 24)
-
-	out[20] = byte(x5)
-	out[21] = byte(x5 >> 8)
-	out[22] = byte(x5 >> 16)
-	out[23] = byte(x5 >> 24)
-
-	out[24] = byte(x6)
-	out[25] = byte(x6 >> 8)
-	out[26] = byte(x6 >> 16)
-	out[27] = byte(x6 >> 24)
-
-	out[28] = byte(x7)
-	out[29] = byte(x7 >> 8)
-	out[30] = byte(x7 >> 16)
-	out[31] = byte(x7 >> 24)
-
-	out[32] = byte(x8)
-	out[33] = byte(x8 >> 8)
-	out[34] = byte(x8 >> 16)
-	out[35] = byte(x8 >> 24)
-
-	out[36] = byte(x9)
-	out[37] = byte(x9 >> 8)
-	out[38] = byte(x9 >> 16)
-	out[39] = byte(x9 >> 24)
-
-	out[40] = byte(x10)
-	out[41] = byte(x10 >> 8)
-	out[42] = byte(x10 >> 16)
-	out[43] = byte(x10 >> 24)
-
-	out[44] = byte(x11)
-	out[45] = byte(x11 >> 8)
-	out[46] = byte(x11 >> 16)
-	out[47] = byte(x11 >> 24)
-
-	out[48] = byte(x12)
-	out[49] = byte(x12 >> 8)
-	out[50] = byte(x12 >> 16)
-	out[51] = byte(x12 >> 24)
-
-	out[52] = byte(x13)
-	out[53] = byte(x13 >> 8)
-	out[54] = byte(x13 >> 16)
-	out[55] = byte(x13 >> 24)
-
-	out[56] = byte(x14)
-	out[57] = byte(x14 >> 8)
-	out[58] = byte(x14 >> 16)
-	out[59] = byte(x14 >> 24)
-
-	out[60] = byte(x15)
-	out[61] = byte(x15 >> 8)
-	out[62] = byte(x15 >> 16)
-	out[63] = byte(x15 >> 24)
-}

implant/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.go

@@ -1,24 +0,0 @@
-// Copyright 2012 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build amd64 && !purego && gc
-// +build amd64,!purego,gc
-
-package salsa
-
-//go:noescape
-
-// salsa2020XORKeyStream is implemented in salsa20_amd64.s.
-func salsa2020XORKeyStream(out, in *byte, n uint64, nonce, key *byte)
-
-// XORKeyStream crypts bytes from in to out using the given key and counters.
-// In and out must overlap entirely or not at all. Counter
-// contains the raw salsa20 counter bytes (both nonce and block counter).
-func XORKeyStream(out, in []byte, counter *[16]byte, key *[32]byte) {
-	if len(in) == 0 {
-		return
-	}
-	_ = out[len(in)-1]
-	salsa2020XORKeyStream(&out[0], &in[0], uint64(len(in)), &counter[0], &key[0])
-}

implant/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.s

@@ -1,881 +0,0 @@
-// Copyright 2012 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build amd64 && !purego && gc
-// +build amd64,!purego,gc
-
-// This code was translated into a form compatible with 6a from the public
-// domain sources in SUPERCOP: https://bench.cr.yp.to/supercop.html
-
-// func salsa2020XORKeyStream(out, in *byte, n uint64, nonce, key *byte)
-// This needs up to 64 bytes at 360(R12); hence the non-obvious frame size.
-TEXT ·salsa2020XORKeyStream(SB),0,$456-40 // frame = 424 + 32 byte alignment
-	MOVQ out+0(FP),DI
-	MOVQ in+8(FP),SI
-	MOVQ n+16(FP),DX
-	MOVQ nonce+24(FP),CX
-	MOVQ key+32(FP),R8
-
-	MOVQ SP,R12
-	ADDQ $31, R12
-	ANDQ $~31, R12
-
-	MOVQ DX,R9
-	MOVQ CX,DX
-	MOVQ R8,R10
-	CMPQ R9,$0
-	JBE DONE
-	START:
-	MOVL 20(R10),CX
-	MOVL 0(R10),R8
-	MOVL 0(DX),AX
-	MOVL 16(R10),R11
-	MOVL CX,0(R12)
-	MOVL R8, 4 (R12)
-	MOVL AX, 8 (R12)
-	MOVL R11, 12 (R12)
-	MOVL 8(DX),CX
-	MOVL 24(R10),R8
-	MOVL 4(R10),AX
-	MOVL 4(DX),R11
-	MOVL CX,16(R12)
-	MOVL R8, 20 (R12)
-	MOVL AX, 24 (R12)
-	MOVL R11, 28 (R12)
-	MOVL 12(DX),CX
-	MOVL 12(R10),DX
-	MOVL 28(R10),R8
-	MOVL 8(R10),AX
-	MOVL DX,32(R12)
-	MOVL CX, 36 (R12)
-	MOVL R8, 40 (R12)
-	MOVL AX, 44 (R12)
-	MOVQ $1634760805,DX
-	MOVQ $857760878,CX
-	MOVQ $2036477234,R8
-	MOVQ $1797285236,AX
-	MOVL DX,48(R12)
-	MOVL CX, 52 (R12)
-	MOVL R8, 56 (R12)
-	MOVL AX, 60 (R12)
-	CMPQ R9,$256
-	JB BYTESBETWEEN1AND255
-	MOVOA 48(R12),X0
-	PSHUFL $0X55,X0,X1
-	PSHUFL $0XAA,X0,X2
-	PSHUFL $0XFF,X0,X3
-	PSHUFL $0X00,X0,X0
-	MOVOA X1,64(R12)
-	MOVOA X2,80(R12)
-	MOVOA X3,96(R12)
-	MOVOA X0,112(R12)
-	MOVOA 0(R12),X0
-	PSHUFL $0XAA,X0,X1
-	PSHUFL $0XFF,X0,X2
-	PSHUFL $0X00,X0,X3
-	PSHUFL $0X55,X0,X0
-	MOVOA X1,128(R12)
-	MOVOA X2,144(R12)
-	MOVOA X3,160(R12)
-	MOVOA X0,176(R12)
-	MOVOA 16(R12),X0
-	PSHUFL $0XFF,X0,X1
-	PSHUFL $0X55,X0,X2
-	PSHUFL $0XAA,X0,X0
-	MOVOA X1,192(R12)
-	MOVOA X2,208(R12)
-	MOVOA X0,224(R12)
-	MOVOA 32(R12),X0
-	PSHUFL $0X00,X0,X1
-	PSHUFL $0XAA,X0,X2
-	PSHUFL $0XFF,X0,X0
-	MOVOA X1,240(R12)
-	MOVOA X2,256(R12)
-	MOVOA X0,272(R12)
-	BYTESATLEAST256:
-	MOVL 16(R12),DX
-	MOVL  36 (R12),CX
-	MOVL DX,288(R12)
-	MOVL CX,304(R12)
-	SHLQ $32,CX
-	ADDQ CX,DX
-	ADDQ $1,DX
-	MOVQ DX,CX
-	SHRQ $32,CX
-	MOVL DX, 292 (R12)
-	MOVL CX, 308 (R12)
-	ADDQ $1,DX
-	MOVQ DX,CX
-	SHRQ $32,CX
-	MOVL DX, 296 (R12)
-	MOVL CX, 312 (R12)
-	ADDQ $1,DX
-	MOVQ DX,CX
-	SHRQ $32,CX
-	MOVL DX, 300 (R12)
-	MOVL CX, 316 (R12)
-	ADDQ $1,DX
-	MOVQ DX,CX
-	SHRQ $32,CX
-	MOVL DX,16(R12)
-	MOVL CX, 36 (R12)
-	MOVQ R9,352(R12)
-	MOVQ $20,DX
-	MOVOA 64(R12),X0
-	MOVOA 80(R12),X1
-	MOVOA 96(R12),X2
-	MOVOA 256(R12),X3
-	MOVOA 272(R12),X4
-	MOVOA 128(R12),X5
-	MOVOA 144(R12),X6
-	MOVOA 176(R12),X7
-	MOVOA 192(R12),X8
-	MOVOA 208(R12),X9
-	MOVOA 224(R12),X10
-	MOVOA 304(R12),X11
-	MOVOA 112(R12),X12
-	MOVOA 160(R12),X13
-	MOVOA 240(R12),X14
-	MOVOA 288(R12),X15
-	MAINLOOP1:
-	MOVOA X1,320(R12)
-	MOVOA X2,336(R12)
-	MOVOA X13,X1
-	PADDL X12,X1
-	MOVOA X1,X2
-	PSLLL $7,X1
-	PXOR X1,X14
-	PSRLL $25,X2
-	PXOR X2,X14
-	MOVOA X7,X1
-	PADDL X0,X1
-	MOVOA X1,X2
-	PSLLL $7,X1
-	PXOR X1,X11
-	PSRLL $25,X2
-	PXOR X2,X11
-	MOVOA X12,X1
-	PADDL X14,X1
-	MOVOA X1,X2
-	PSLLL $9,X1
-	PXOR X1,X15
-	PSRLL $23,X2
-	PXOR X2,X15
-	MOVOA X0,X1
-	PADDL X11,X1
-	MOVOA X1,X2
-	PSLLL $9,X1
-	PXOR X1,X9
-	PSRLL $23,X2
-	PXOR X2,X9
-	MOVOA X14,X1
-	PADDL X15,X1
-	MOVOA X1,X2
-	PSLLL $13,X1
-	PXOR X1,X13
-	PSRLL $19,X2
-	PXOR X2,X13
-	MOVOA X11,X1
-	PADDL X9,X1
-	MOVOA X1,X2
-	PSLLL $13,X1
-	PXOR X1,X7
-	PSRLL $19,X2
-	PXOR X2,X7
-	MOVOA X15,X1
-	PADDL X13,X1
-	MOVOA X1,X2
-	PSLLL $18,X1
-	PXOR X1,X12
-	PSRLL $14,X2
-	PXOR X2,X12
-	MOVOA 320(R12),X1
-	MOVOA X12,320(R12)
-	MOVOA X9,X2
-	PADDL X7,X2
-	MOVOA X2,X12
-	PSLLL $18,X2
-	PXOR X2,X0
-	PSRLL $14,X12
-	PXOR X12,X0
-	MOVOA X5,X2
-	PADDL X1,X2
-	MOVOA X2,X12
-	PSLLL $7,X2
-	PXOR X2,X3
-	PSRLL $25,X12
-	PXOR X12,X3
-	MOVOA 336(R12),X2
-	MOVOA X0,336(R12)
-	MOVOA X6,X0
-	PADDL X2,X0
-	MOVOA X0,X12
-	PSLLL $7,X0
-	PXOR X0,X4
-	PSRLL $25,X12
-	PXOR X12,X4
-	MOVOA X1,X0
-	PADDL X3,X0
-	MOVOA X0,X12
-	PSLLL $9,X0
-	PXOR X0,X10
-	PSRLL $23,X12
-	PXOR X12,X10
-	MOVOA X2,X0
-	PADDL X4,X0
-	MOVOA X0,X12
-	PSLLL $9,X0
-	PXOR X0,X8
-	PSRLL $23,X12
-	PXOR X12,X8
-	MOVOA X3,X0
-	PADDL X10,X0
-	MOVOA X0,X12
-	PSLLL $13,X0
-	PXOR X0,X5
-	PSRLL $19,X12
-	PXOR X12,X5
-	MOVOA X4,X0
-	PADDL X8,X0
-	MOVOA X0,X12
-	PSLLL $13,X0
-	PXOR X0,X6
-	PSRLL $19,X12
-	PXOR X12,X6
-	MOVOA X10,X0
-	PADDL X5,X0
-	MOVOA X0,X12
-	PSLLL $18,X0
-	PXOR X0,X1
-	PSRLL $14,X12
-	PXOR X12,X1
-	MOVOA 320(R12),X0
-	MOVOA X1,320(R12)
-	MOVOA X4,X1
-	PADDL X0,X1
-	MOVOA X1,X12
-	PSLLL $7,X1
-	PXOR X1,X7
-	PSRLL $25,X12
-	PXOR X12,X7
-	MOVOA X8,X1
-	PADDL X6,X1
-	MOVOA X1,X12
-	PSLLL $18,X1
-	PXOR X1,X2
-	PSRLL $14,X12
-	PXOR X12,X2
-	MOVOA 336(R12),X12
-	MOVOA X2,336(R12)
-	MOVOA X14,X1
-	PADDL X12,X1
-	MOVOA X1,X2
-	PSLLL $7,X1
-	PXOR X1,X5
-	PSRLL $25,X2
-	PXOR X2,X5
-	MOVOA X0,X1
-	PADDL X7,X1
-	MOVOA X1,X2
-	PSLLL $9,X1
-	PXOR X1,X10
-	PSRLL $23,X2
-	PXOR X2,X10
-	MOVOA X12,X1
-	PADDL X5,X1
-	MOVOA X1,X2
-	PSLLL $9,X1
-	PXOR X1,X8
-	PSRLL $23,X2
-	PXOR X2,X8
-	MOVOA X7,X1
-	PADDL X10,X1
-	MOVOA X1,X2
-	PSLLL $13,X1
-	PXOR X1,X4
-	PSRLL $19,X2
-	PXOR X2,X4
-	MOVOA X5,X1
-	PADDL X8,X1
-	MOVOA X1,X2
-	PSLLL $13,X1
-	PXOR X1,X14
-	PSRLL $19,X2
-	PXOR X2,X14
-	MOVOA X10,X1
-	PADDL X4,X1
-	MOVOA X1,X2
-	PSLLL $18,X1
-	PXOR X1,X0
-	PSRLL $14,X2
-	PXOR X2,X0
-	MOVOA 320(R12),X1
-	MOVOA X0,320(R12)
-	MOVOA X8,X0
-	PADDL X14,X0
-	MOVOA X0,X2
-	PSLLL $18,X0
-	PXOR X0,X12
-	PSRLL $14,X2
-	PXOR X2,X12
-	MOVOA X11,X0
-	PADDL X1,X0
-	MOVOA X0,X2
-	PSLLL $7,X0
-	PXOR X0,X6
-	PSRLL $25,X2
-	PXOR X2,X6
-	MOVOA 336(R12),X2
-	MOVOA X12,336(R12)
-	MOVOA X3,X0
-	PADDL X2,X0
-	MOVOA X0,X12
-	PSLLL $7,X0
-	PXOR X0,X13
-	PSRLL $25,X12
-	PXOR X12,X13
-	MOVOA X1,X0
-	PADDL X6,X0
-	MOVOA X0,X12
-	PSLLL $9,X0
-	PXOR X0,X15
-	PSRLL $23,X12
-	PXOR X12,X15
-	MOVOA X2,X0
-	PADDL X13,X0
-	MOVOA X0,X12
-	PSLLL $9,X0
-	PXOR X0,X9
-	PSRLL $23,X12
-	PXOR X12,X9
-	MOVOA X6,X0
-	PADDL X15,X0
-	MOVOA X0,X12
-	PSLLL $13,X0
-	PXOR X0,X11
-	PSRLL $19,X12
-	PXOR X12,X11
-	MOVOA X13,X0
-	PADDL X9,X0
-	MOVOA X0,X12
-	PSLLL $13,X0
-	PXOR X0,X3
-	PSRLL $19,X12
-	PXOR X12,X3
-	MOVOA X15,X0
-	PADDL X11,X0
-	MOVOA X0,X12
-	PSLLL $18,X0
-	PXOR X0,X1
-	PSRLL $14,X12
-	PXOR X12,X1
-	MOVOA X9,X0
-	PADDL X3,X0
-	MOVOA X0,X12
-	PSLLL $18,X0
-	PXOR X0,X2
-	PSRLL $14,X12
-	PXOR X12,X2
-	MOVOA 320(R12),X12
-	MOVOA 336(R12),X0
-	SUBQ $2,DX
-	JA MAINLOOP1
-	PADDL 112(R12),X12
-	PADDL 176(R12),X7
-	PADDL 224(R12),X10
-	PADDL 272(R12),X4
-	MOVD X12,DX
-	MOVD X7,CX
-	MOVD X10,R8
-	MOVD X4,R9
-	PSHUFL $0X39,X12,X12
-	PSHUFL $0X39,X7,X7
-	PSHUFL $0X39,X10,X10
-	PSHUFL $0X39,X4,X4
-	XORL 0(SI),DX
-	XORL 4(SI),CX
-	XORL 8(SI),R8
-	XORL 12(SI),R9
-	MOVL DX,0(DI)
-	MOVL CX,4(DI)
-	MOVL R8,8(DI)
-	MOVL R9,12(DI)
-	MOVD X12,DX
-	MOVD X7,CX
-	MOVD X10,R8
-	MOVD X4,R9
-	PSHUFL $0X39,X12,X12
-	PSHUFL $0X39,X7,X7
-	PSHUFL $0X39,X10,X10
-	PSHUFL $0X39,X4,X4
-	XORL 64(SI),DX
-	XORL 68(SI),CX
-	XORL 72(SI),R8
-	XORL 76(SI),R9
-	MOVL DX,64(DI)
-	MOVL CX,68(DI)
-	MOVL R8,72(DI)
-	MOVL R9,76(DI)
-	MOVD X12,DX
-	MOVD X7,CX
-	MOVD X10,R8
-	MOVD X4,R9
-	PSHUFL $0X39,X12,X12
-	PSHUFL $0X39,X7,X7
-	PSHUFL $0X39,X10,X10
-	PSHUFL $0X39,X4,X4
-	XORL 128(SI),DX
-	XORL 132(SI),CX
-	XORL 136(SI),R8
-	XORL 140(SI),R9
-	MOVL DX,128(DI)
-	MOVL CX,132(DI)
-	MOVL R8,136(DI)
-	MOVL R9,140(DI)
-	MOVD X12,DX
-	MOVD X7,CX
-	MOVD X10,R8
-	MOVD X4,R9
-	XORL 192(SI),DX
-	XORL 196(SI),CX
-	XORL 200(SI),R8
-	XORL 204(SI),R9
-	MOVL DX,192(DI)
-	MOVL CX,196(DI)
-	MOVL R8,200(DI)
-	MOVL R9,204(DI)
-	PADDL 240(R12),X14
-	PADDL 64(R12),X0
-	PADDL 128(R12),X5
-	PADDL 192(R12),X8
-	MOVD X14,DX
-	MOVD X0,CX
-	MOVD X5,R8
-	MOVD X8,R9
-	PSHUFL $0X39,X14,X14
-	PSHUFL $0X39,X0,X0
-	PSHUFL $0X39,X5,X5
-	PSHUFL $0X39,X8,X8
-	XORL 16(SI),DX
-	XORL 20(SI),CX
-	XORL 24(SI),R8
-	XORL 28(SI),R9
-	MOVL DX,16(DI)
-	MOVL CX,20(DI)
-	MOVL R8,24(DI)
-	MOVL R9,28(DI)
-	MOVD X14,DX
-	MOVD X0,CX
-	MOVD X5,R8
-	MOVD X8,R9
-	PSHUFL $0X39,X14,X14
-	PSHUFL $0X39,X0,X0
-	PSHUFL $0X39,X5,X5
-	PSHUFL $0X39,X8,X8
-	XORL 80(SI),DX
-	XORL 84(SI),CX
-	XORL 88(SI),R8
-	XORL 92(SI),R9
-	MOVL DX,80(DI)
-	MOVL CX,84(DI)
-	MOVL R8,88(DI)
-	MOVL R9,92(DI)
-	MOVD X14,DX
-	MOVD X0,CX
-	MOVD X5,R8
-	MOVD X8,R9
-	PSHUFL $0X39,X14,X14
-	PSHUFL $0X39,X0,X0
-	PSHUFL $0X39,X5,X5
-	PSHUFL $0X39,X8,X8
-	XORL 144(SI),DX
-	XORL 148(SI),CX
-	XORL 152(SI),R8
-	XORL 156(SI),R9
-	MOVL DX,144(DI)
-	MOVL CX,148(DI)
-	MOVL R8,152(DI)
-	MOVL R9,156(DI)
-	MOVD X14,DX
-	MOVD X0,CX
-	MOVD X5,R8
-	MOVD X8,R9
-	XORL 208(SI),DX
-	XORL 212(SI),CX
-	XORL 216(SI),R8
-	XORL 220(SI),R9
-	MOVL DX,208(DI)
-	MOVL CX,212(DI)
-	MOVL R8,216(DI)
-	MOVL R9,220(DI)
-	PADDL 288(R12),X15
-	PADDL 304(R12),X11
-	PADDL 80(R12),X1
-	PADDL 144(R12),X6
-	MOVD X15,DX
-	MOVD X11,CX
-	MOVD X1,R8
-	MOVD X6,R9
-	PSHUFL $0X39,X15,X15
-	PSHUFL $0X39,X11,X11
-	PSHUFL $0X39,X1,X1
-	PSHUFL $0X39,X6,X6
-	XORL 32(SI),DX
-	XORL 36(SI),CX
-	XORL 40(SI),R8
-	XORL 44(SI),R9
-	MOVL DX,32(DI)
-	MOVL CX,36(DI)
-	MOVL R8,40(DI)
-	MOVL R9,44(DI)
-	MOVD X15,DX
-	MOVD X11,CX
-	MOVD X1,R8
-	MOVD X6,R9
-	PSHUFL $0X39,X15,X15
-	PSHUFL $0X39,X11,X11
-	PSHUFL $0X39,X1,X1
-	PSHUFL $0X39,X6,X6
-	XORL 96(SI),DX
-	XORL 100(SI),CX
-	XORL 104(SI),R8
-	XORL 108(SI),R9
-	MOVL DX,96(DI)
-	MOVL CX,100(DI)
-	MOVL R8,104(DI)
-	MOVL R9,108(DI)
-	MOVD X15,DX
-	MOVD X11,CX
-	MOVD X1,R8
-	MOVD X6,R9
-	PSHUFL $0X39,X15,X15
-	PSHUFL $0X39,X11,X11
-	PSHUFL $0X39,X1,X1
-	PSHUFL $0X39,X6,X6
-	XORL 160(SI),DX
-	XORL 164(SI),CX
-	XORL 168(SI),R8
-	XORL 172(SI),R9
-	MOVL DX,160(DI)
-	MOVL CX,164(DI)
-	MOVL R8,168(DI)
-	MOVL R9,172(DI)
-	MOVD X15,DX
-	MOVD X11,CX
-	MOVD X1,R8
-	MOVD X6,R9
-	XORL 224(SI),DX
-	XORL 228(SI),CX
-	XORL 232(SI),R8
-	XORL 236(SI),R9
-	MOVL DX,224(DI)
-	MOVL CX,228(DI)
-	MOVL R8,232(DI)
-	MOVL R9,236(DI)
-	PADDL 160(R12),X13
-	PADDL 208(R12),X9
-	PADDL 256(R12),X3
-	PADDL 96(R12),X2
-	MOVD X13,DX
-	MOVD X9,CX
-	MOVD X3,R8
-	MOVD X2,R9
-	PSHUFL $0X39,X13,X13
-	PSHUFL $0X39,X9,X9
-	PSHUFL $0X39,X3,X3
-	PSHUFL $0X39,X2,X2
-	XORL 48(SI),DX
-	XORL 52(SI),CX
-	XORL 56(SI),R8
-	XORL 60(SI),R9
-	MOVL DX,48(DI)
-	MOVL CX,52(DI)
-	MOVL R8,56(DI)
-	MOVL R9,60(DI)
-	MOVD X13,DX
-	MOVD X9,CX
-	MOVD X3,R8
-	MOVD X2,R9
-	PSHUFL $0X39,X13,X13
-	PSHUFL $0X39,X9,X9
-	PSHUFL $0X39,X3,X3
-	PSHUFL $0X39,X2,X2
-	XORL 112(SI),DX
-	XORL 116(SI),CX
-	XORL 120(SI),R8
-	XORL 124(SI),R9
-	MOVL DX,112(DI)
-	MOVL CX,116(DI)
-	MOVL R8,120(DI)
-	MOVL R9,124(DI)
-	MOVD X13,DX
-	MOVD X9,CX
-	MOVD X3,R8
-	MOVD X2,R9
-	PSHUFL $0X39,X13,X13
-	PSHUFL $0X39,X9,X9
-	PSHUFL $0X39,X3,X3
-	PSHUFL $0X39,X2,X2
-	XORL 176(SI),DX
-	XORL 180(SI),CX
-	XORL 184(SI),R8
-	XORL 188(SI),R9
-	MOVL DX,176(DI)
-	MOVL CX,180(DI)
-	MOVL R8,184(DI)
-	MOVL R9,188(DI)
-	MOVD X13,DX
-	MOVD X9,CX
-	MOVD X3,R8
-	MOVD X2,R9
-	XORL 240(SI),DX
-	XORL 244(SI),CX
-	XORL 248(SI),R8
-	XORL 252(SI),R9
-	MOVL DX,240(DI)
-	MOVL CX,244(DI)
-	MOVL R8,248(DI)
-	MOVL R9,252(DI)
-	MOVQ 352(R12),R9
-	SUBQ $256,R9
-	ADDQ $256,SI
-	ADDQ $256,DI
-	CMPQ R9,$256
-	JAE BYTESATLEAST256
-	CMPQ R9,$0
-	JBE DONE
-	BYTESBETWEEN1AND255:
-	CMPQ R9,$64
-	JAE NOCOPY
-	MOVQ DI,DX
-	LEAQ 360(R12),DI
-	MOVQ R9,CX
-	REP; MOVSB
-	LEAQ 360(R12),DI
-	LEAQ 360(R12),SI
-	NOCOPY:
-	MOVQ R9,352(R12)
-	MOVOA 48(R12),X0
-	MOVOA 0(R12),X1
-	MOVOA 16(R12),X2
-	MOVOA 32(R12),X3
-	MOVOA X1,X4
-	MOVQ $20,CX
-	MAINLOOP2:
-	PADDL X0,X4
-	MOVOA X0,X5
-	MOVOA X4,X6
-	PSLLL $7,X4
-	PSRLL $25,X6
-	PXOR X4,X3
-	PXOR X6,X3
-	PADDL X3,X5
-	MOVOA X3,X4
-	MOVOA X5,X6
-	PSLLL $9,X5
-	PSRLL $23,X6
-	PXOR X5,X2
-	PSHUFL $0X93,X3,X3
-	PXOR X6,X2
-	PADDL X2,X4
-	MOVOA X2,X5
-	MOVOA X4,X6
-	PSLLL $13,X4
-	PSRLL $19,X6
-	PXOR X4,X1
-	PSHUFL $0X4E,X2,X2
-	PXOR X6,X1
-	PADDL X1,X5
-	MOVOA X3,X4
-	MOVOA X5,X6
-	PSLLL $18,X5
-	PSRLL $14,X6
-	PXOR X5,X0
-	PSHUFL $0X39,X1,X1
-	PXOR X6,X0
-	PADDL X0,X4
-	MOVOA X0,X5
-	MOVOA X4,X6
-	PSLLL $7,X4
-	PSRLL $25,X6
-	PXOR X4,X1
-	PXOR X6,X1
-	PADDL X1,X5
-	MOVOA X1,X4
-	MOVOA X5,X6
-	PSLLL $9,X5
-	PSRLL $23,X6
-	PXOR X5,X2
-	PSHUFL $0X93,X1,X1
-	PXOR X6,X2
-	PADDL X2,X4
-	MOVOA X2,X5
-	MOVOA X4,X6
-	PSLLL $13,X4
-	PSRLL $19,X6
-	PXOR X4,X3
-	PSHUFL $0X4E,X2,X2
-	PXOR X6,X3
-	PADDL X3,X5
-	MOVOA X1,X4
-	MOVOA X5,X6
-	PSLLL $18,X5
-	PSRLL $14,X6
-	PXOR X5,X0
-	PSHUFL $0X39,X3,X3
-	PXOR X6,X0
-	PADDL X0,X4
-	MOVOA X0,X5
-	MOVOA X4,X6
-	PSLLL $7,X4
-	PSRLL $25,X6
-	PXOR X4,X3
-	PXOR X6,X3
-	PADDL X3,X5
-	MOVOA X3,X4
-	MOVOA X5,X6
-	PSLLL $9,X5
-	PSRLL $23,X6
-	PXOR X5,X2
-	PSHUFL $0X93,X3,X3
-	PXOR X6,X2
-	PADDL X2,X4
-	MOVOA X2,X5
-	MOVOA X4,X6
-	PSLLL $13,X4
-	PSRLL $19,X6
-	PXOR X4,X1
-	PSHUFL $0X4E,X2,X2
-	PXOR X6,X1
-	PADDL X1,X5
-	MOVOA X3,X4
-	MOVOA X5,X6
-	PSLLL $18,X5
-	PSRLL $14,X6
-	PXOR X5,X0
-	PSHUFL $0X39,X1,X1
-	PXOR X6,X0
-	PADDL X0,X4
-	MOVOA X0,X5
-	MOVOA X4,X6
-	PSLLL $7,X4
-	PSRLL $25,X6
-	PXOR X4,X1
-	PXOR X6,X1
-	PADDL X1,X5
-	MOVOA X1,X4
-	MOVOA X5,X6
-	PSLLL $9,X5
-	PSRLL $23,X6
-	PXOR X5,X2
-	PSHUFL $0X93,X1,X1
-	PXOR X6,X2
-	PADDL X2,X4
-	MOVOA X2,X5
-	MOVOA X4,X6
-	PSLLL $13,X4
-	PSRLL $19,X6
-	PXOR X4,X3
-	PSHUFL $0X4E,X2,X2
-	PXOR X6,X3
-	SUBQ $4,CX
-	PADDL X3,X5
-	MOVOA X1,X4
-	MOVOA X5,X6
-	PSLLL $18,X5
-	PXOR X7,X7
-	PSRLL $14,X6
-	PXOR X5,X0
-	PSHUFL $0X39,X3,X3
-	PXOR X6,X0
-	JA MAINLOOP2
-	PADDL 48(R12),X0
-	PADDL 0(R12),X1
-	PADDL 16(R12),X2
-	PADDL 32(R12),X3
-	MOVD X0,CX
-	MOVD X1,R8
-	MOVD X2,R9
-	MOVD X3,AX
-	PSHUFL $0X39,X0,X0
-	PSHUFL $0X39,X1,X1
-	PSHUFL $0X39,X2,X2
-	PSHUFL $0X39,X3,X3
-	XORL 0(SI),CX
-	XORL 48(SI),R8
-	XORL 32(SI),R9
-	XORL 16(SI),AX
-	MOVL CX,0(DI)
-	MOVL R8,48(DI)
-	MOVL R9,32(DI)
-	MOVL AX,16(DI)
-	MOVD X0,CX
-	MOVD X1,R8
-	MOVD X2,R9
-	MOVD X3,AX
-	PSHUFL $0X39,X0,X0
-	PSHUFL $0X39,X1,X1
-	PSHUFL $0X39,X2,X2
-	PSHUFL $0X39,X3,X3
-	XORL 20(SI),CX
-	XORL 4(SI),R8
-	XORL 52(SI),R9
-	XORL 36(SI),AX
-	MOVL CX,20(DI)
-	MOVL R8,4(DI)
-	MOVL R9,52(DI)
-	MOVL AX,36(DI)
-	MOVD X0,CX
-	MOVD X1,R8
-	MOVD X2,R9
-	MOVD X3,AX
-	PSHUFL $0X39,X0,X0
-	PSHUFL $0X39,X1,X1
-	PSHUFL $0X39,X2,X2
-	PSHUFL $0X39,X3,X3
-	XORL 40(SI),CX
-	XORL 24(SI),R8
-	XORL 8(SI),R9
-	XORL 56(SI),AX
-	MOVL CX,40(DI)
-	MOVL R8,24(DI)
-	MOVL R9,8(DI)
-	MOVL AX,56(DI)
-	MOVD X0,CX
-	MOVD X1,R8
-	MOVD X2,R9
-	MOVD X3,AX
-	XORL 60(SI),CX
-	XORL 44(SI),R8
-	XORL 28(SI),R9
-	XORL 12(SI),AX
-	MOVL CX,60(DI)
-	MOVL R8,44(DI)
-	MOVL R9,28(DI)
-	MOVL AX,12(DI)
-	MOVQ 352(R12),R9
-	MOVL 16(R12),CX
-	MOVL  36 (R12),R8
-	ADDQ $1,CX
-	SHLQ $32,R8
-	ADDQ R8,CX
-	MOVQ CX,R8
-	SHRQ $32,R8
-	MOVL CX,16(R12)
-	MOVL R8, 36 (R12)
-	CMPQ R9,$64
-	JA BYTESATLEAST65
-	JAE BYTESATLEAST64
-	MOVQ DI,SI
-	MOVQ DX,DI
-	MOVQ R9,CX
-	REP; MOVSB
-	BYTESATLEAST64:
-	DONE:
-	RET
-	BYTESATLEAST65:
-	SUBQ $64,R9
-	ADDQ $64,DI
-	ADDQ $64,SI
-	JMP BYTESBETWEEN1AND255

implant/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_noasm.go

@@ -1,15 +0,0 @@
-// Copyright 2019 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build !amd64 || purego || !gc
-// +build !amd64 purego !gc
-
-package salsa
-
-// XORKeyStream crypts bytes from in to out using the given key and counters.
-// In and out must overlap entirely or not at all. Counter
-// contains the raw salsa20 counter bytes (both nonce and block counter).
-func XORKeyStream(out, in []byte, counter *[16]byte, key *[32]byte) {
-	genericXORKeyStream(out, in, counter, key)
-}

implant/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_ref.go

@@ -1,231 +0,0 @@
-// Copyright 2012 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package salsa
-
-const rounds = 20
-
-// core applies the Salsa20 core function to 16-byte input in, 32-byte key k,
-// and 16-byte constant c, and puts the result into 64-byte array out.
-func core(out *[64]byte, in *[16]byte, k *[32]byte, c *[16]byte) {
-	j0 := uint32(c[0]) | uint32(c[1])<<8 | uint32(c[2])<<16 | uint32(c[3])<<24
-	j1 := uint32(k[0]) | uint32(k[1])<<8 | uint32(k[2])<<16 | uint32(k[3])<<24
-	j2 := uint32(k[4]) | uint32(k[5])<<8 | uint32(k[6])<<16 | uint32(k[7])<<24
-	j3 := uint32(k[8]) | uint32(k[9])<<8 | uint32(k[10])<<16 | uint32(k[11])<<24
-	j4 := uint32(k[12]) | uint32(k[13])<<8 | uint32(k[14])<<16 | uint32(k[15])<<24
-	j5 := uint32(c[4]) | uint32(c[5])<<8 | uint32(c[6])<<16 | uint32(c[7])<<24
-	j6 := uint32(in[0]) | uint32(in[1])<<8 | uint32(in[2])<<16 | uint32(in[3])<<24
-	j7 := uint32(in[4]) | uint32(in[5])<<8 | uint32(in[6])<<16 | uint32(in[7])<<24
-	j8 := uint32(in[8]) | uint32(in[9])<<8 | uint32(in[10])<<16 | uint32(in[11])<<24
-	j9 := uint32(in[12]) | uint32(in[13])<<8 | uint32(in[14])<<16 | uint32(in[15])<<24
-	j10 := uint32(c[8]) | uint32(c[9])<<8 | uint32(c[10])<<16 | uint32(c[11])<<24
-	j11 := uint32(k[16]) | uint32(k[17])<<8 | uint32(k[18])<<16 | uint32(k[19])<<24
-	j12 := uint32(k[20]) | uint32(k[21])<<8 | uint32(k[22])<<16 | uint32(k[23])<<24
-	j13 := uint32(k[24]) | uint32(k[25])<<8 | uint32(k[26])<<16 | uint32(k[27])<<24
-	j14 := uint32(k[28]) | uint32(k[29])<<8 | uint32(k[30])<<16 | uint32(k[31])<<24
-	j15 := uint32(c[12]) | uint32(c[13])<<8 | uint32(c[14])<<16 | uint32(c[15])<<24
-
-	x0, x1, x2, x3, x4, x5, x6, x7, x8 := j0, j1, j2, j3, j4, j5, j6, j7, j8
-	x9, x10, x11, x12, x13, x14, x15 := j9, j10, j11, j12, j13, j14, j15
-
-	for i := 0; i < rounds; i += 2 {
-		u := x0 + x12
-		x4 ^= u<<7 | u>>(32-7)
-		u = x4 + x0
-		x8 ^= u<<9 | u>>(32-9)
-		u = x8 + x4
-		x12 ^= u<<13 | u>>(32-13)
-		u = x12 + x8
-		x0 ^= u<<18 | u>>(32-18)
-
-		u = x5 + x1
-		x9 ^= u<<7 | u>>(32-7)
-		u = x9 + x5
-		x13 ^= u<<9 | u>>(32-9)
-		u = x13 + x9
-		x1 ^= u<<13 | u>>(32-13)
-		u = x1 + x13
-		x5 ^= u<<18 | u>>(32-18)
-
-		u = x10 + x6
-		x14 ^= u<<7 | u>>(32-7)
-		u = x14 + x10
-		x2 ^= u<<9 | u>>(32-9)
-		u = x2 + x14
-		x6 ^= u<<13 | u>>(32-13)
-		u = x6 + x2
-		x10 ^= u<<18 | u>>(32-18)
-
-		u = x15 + x11
-		x3 ^= u<<7 | u>>(32-7)
-		u = x3 + x15
-		x7 ^= u<<9 | u>>(32-9)
-		u = x7 + x3
-		x11 ^= u<<13 | u>>(32-13)
-		u = x11 + x7
-		x15 ^= u<<18 | u>>(32-18)
-
-		u = x0 + x3
-		x1 ^= u<<7 | u>>(32-7)
-		u = x1 + x0
-		x2 ^= u<<9 | u>>(32-9)
-		u = x2 + x1
-		x3 ^= u<<13 | u>>(32-13)
-		u = x3 + x2
-		x0 ^= u<<18 | u>>(32-18)
-
-		u = x5 + x4
-		x6 ^= u<<7 | u>>(32-7)
-		u = x6 + x5
-		x7 ^= u<<9 | u>>(32-9)
-		u = x7 + x6
-		x4 ^= u<<13 | u>>(32-13)
-		u = x4 + x7
-		x5 ^= u<<18 | u>>(32-18)
-
-		u = x10 + x9
-		x11 ^= u<<7 | u>>(32-7)
-		u = x11 + x10
-		x8 ^= u<<9 | u>>(32-9)
-		u = x8 + x11
-		x9 ^= u<<13 | u>>(32-13)
-		u = x9 + x8
-		x10 ^= u<<18 | u>>(32-18)
-
-		u = x15 + x14
-		x12 ^= u<<7 | u>>(32-7)
-		u = x12 + x15
-		x13 ^= u<<9 | u>>(32-9)
-		u = x13 + x12
-		x14 ^= u<<13 | u>>(32-13)
-		u = x14 + x13
-		x15 ^= u<<18 | u>>(32-18)
-	}
-	x0 += j0
-	x1 += j1
-	x2 += j2
-	x3 += j3
-	x4 += j4
-	x5 += j5
-	x6 += j6
-	x7 += j7
-	x8 += j8
-	x9 += j9
-	x10 += j10
-	x11 += j11
-	x12 += j12
-	x13 += j13
-	x14 += j14
-	x15 += j15
-
-	out[0] = byte(x0)
-	out[1] = byte(x0 >> 8)
-	out[2] = byte(x0 >> 16)
-	out[3] = byte(x0 >> 24)
-
-	out[4] = byte(x1)
-	out[5] = byte(x1 >> 8)
-	out[6] = byte(x1 >> 16)
-	out[7] = byte(x1 >> 24)
-
-	out[8] = byte(x2)
-	out[9] = byte(x2 >> 8)
-	out[10] = byte(x2 >> 16)
-	out[11] = byte(x2 >> 24)
-
-	out[12] = byte(x3)
-	out[13] = byte(x3 >> 8)
-	out[14] = byte(x3 >> 16)
-	out[15] = byte(x3 >> 24)
-
-	out[16] = byte(x4)
-	out[17] = byte(x4 >> 8)
-	out[18] = byte(x4 >> 16)
-	out[19] = byte(x4 >> 24)
-
-	out[20] = byte(x5)
-	out[21] = byte(x5 >> 8)
-	out[22] = byte(x5 >> 16)
-	out[23] = byte(x5 >> 24)
-
-	out[24] = byte(x6)
-	out[25] = byte(x6 >> 8)
-	out[26] = byte(x6 >> 16)
-	out[27] = byte(x6 >> 24)
-
-	out[28] = byte(x7)
-	out[29] = byte(x7 >> 8)
-	out[30] = byte(x7 >> 16)
-	out[31] = byte(x7 >> 24)
-
-	out[32] = byte(x8)
-	out[33] = byte(x8 >> 8)
-	out[34] = byte(x8 >> 16)
-	out[35] = byte(x8 >> 24)
-
-	out[36] = byte(x9)
-	out[37] = byte(x9 >> 8)
-	out[38] = byte(x9 >> 16)
-	out[39] = byte(x9 >> 24)
-
-	out[40] = byte(x10)
-	out[41] = byte(x10 >> 8)
-	out[42] = byte(x10 >> 16)
-	out[43] = byte(x10 >> 24)
-
-	out[44] = byte(x11)
-	out[45] = byte(x11 >> 8)
-	out[46] = byte(x11 >> 16)
-	out[47] = byte(x11 >> 24)
-
-	out[48] = byte(x12)
-	out[49] = byte(x12 >> 8)
-	out[50] = byte(x12 >> 16)
-	out[51] = byte(x12 >> 24)
-
-	out[52] = byte(x13)
-	out[53] = byte(x13 >> 8)
-	out[54] = byte(x13 >> 16)
-	out[55] = byte(x13 >> 24)
-
-	out[56] = byte(x14)
-	out[57] = byte(x14 >> 8)
-	out[58] = byte(x14 >> 16)
-	out[59] = byte(x14 >> 24)
-
-	out[60] = byte(x15)
-	out[61] = byte(x15 >> 8)
-	out[62] = byte(x15 >> 16)
-	out[63] = byte(x15 >> 24)
-}
-
-// genericXORKeyStream is the generic implementation of XORKeyStream to be used
-// when no assembly implementation is available.
-func genericXORKeyStream(out, in []byte, counter *[16]byte, key *[32]byte) {
-	var block [64]byte
-	var counterCopy [16]byte
-	copy(counterCopy[:], counter[:])
-
-	for len(in) >= 64 {
-		core(&block, &counterCopy, key, &Sigma)
-		for i, x := range block {
-			out[i] = in[i] ^ x
-		}
-		u := uint32(1)
-		for i := 8; i < 16; i++ {
-			u += uint32(counterCopy[i])
-			counterCopy[i] = byte(u)
-			u >>= 8
-		}
-		in = in[64:]
-		out = out[64:]
-	}
-
-	if len(in) > 0 {
-		core(&block, &counterCopy, key, &Sigma)
-		for i, v := range in {
-			out[i] = v ^ block[i]
-		}
-	}
-}

implant/vendor/golang.org/x/crypto/scrypt/scrypt.go

@@ -0,0 +1,212 @@
+// Copyright 2012 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package scrypt implements the scrypt key derivation function as defined in
+// Colin Percival's paper "Stronger Key Derivation via Sequential Memory-Hard
+// Functions" (https://www.tarsnap.com/scrypt/scrypt.pdf).
+package scrypt // import "golang.org/x/crypto/scrypt"
+
+import (
+	"crypto/sha256"
+	"encoding/binary"
+	"errors"
+	"math/bits"
+
+	"golang.org/x/crypto/pbkdf2"
+)
+
+const maxInt = int(^uint(0) >> 1)
+
+// blockCopy copies n numbers from src into dst.
+func blockCopy(dst, src []uint32, n int) {
+	copy(dst, src[:n])
+}
+
+// blockXOR XORs numbers from dst with n numbers from src.
+func blockXOR(dst, src []uint32, n int) {
+	for i, v := range src[:n] {
+		dst[i] ^= v
+	}
+}
+
+// salsaXOR applies Salsa20/8 to the XOR of 16 numbers from tmp and in,
+// and puts the result into both tmp and out.
+func salsaXOR(tmp *[16]uint32, in, out []uint32) {
+	w0 := tmp[0] ^ in[0]
+	w1 := tmp[1] ^ in[1]
+	w2 := tmp[2] ^ in[2]
+	w3 := tmp[3] ^ in[3]
+	w4 := tmp[4] ^ in[4]
+	w5 := tmp[5] ^ in[5]
+	w6 := tmp[6] ^ in[6]
+	w7 := tmp[7] ^ in[7]
+	w8 := tmp[8] ^ in[8]
+	w9 := tmp[9] ^ in[9]
+	w10 := tmp[10] ^ in[10]
+	w11 := tmp[11] ^ in[11]
+	w12 := tmp[12] ^ in[12]
+	w13 := tmp[13] ^ in[13]
+	w14 := tmp[14] ^ in[14]
+	w15 := tmp[15] ^ in[15]
+
+	x0, x1, x2, x3, x4, x5, x6, x7, x8 := w0, w1, w2, w3, w4, w5, w6, w7, w8
+	x9, x10, x11, x12, x13, x14, x15 := w9, w10, w11, w12, w13, w14, w15
+
+	for i := 0; i < 8; i += 2 {
+		x4 ^= bits.RotateLeft32(x0+x12, 7)
+		x8 ^= bits.RotateLeft32(x4+x0, 9)
+		x12 ^= bits.RotateLeft32(x8+x4, 13)
+		x0 ^= bits.RotateLeft32(x12+x8, 18)
+
+		x9 ^= bits.RotateLeft32(x5+x1, 7)
+		x13 ^= bits.RotateLeft32(x9+x5, 9)
+		x1 ^= bits.RotateLeft32(x13+x9, 13)
+		x5 ^= bits.RotateLeft32(x1+x13, 18)
+
+		x14 ^= bits.RotateLeft32(x10+x6, 7)
+		x2 ^= bits.RotateLeft32(x14+x10, 9)
+		x6 ^= bits.RotateLeft32(x2+x14, 13)
+		x10 ^= bits.RotateLeft32(x6+x2, 18)
+
+		x3 ^= bits.RotateLeft32(x15+x11, 7)
+		x7 ^= bits.RotateLeft32(x3+x15, 9)
+		x11 ^= bits.RotateLeft32(x7+x3, 13)
+		x15 ^= bits.RotateLeft32(x11+x7, 18)
+
+		x1 ^= bits.RotateLeft32(x0+x3, 7)
+		x2 ^= bits.RotateLeft32(x1+x0, 9)
+		x3 ^= bits.RotateLeft32(x2+x1, 13)
+		x0 ^= bits.RotateLeft32(x3+x2, 18)
+
+		x6 ^= bits.RotateLeft32(x5+x4, 7)
+		x7 ^= bits.RotateLeft32(x6+x5, 9)
+		x4 ^= bits.RotateLeft32(x7+x6, 13)
+		x5 ^= bits.RotateLeft32(x4+x7, 18)
+
+		x11 ^= bits.RotateLeft32(x10+x9, 7)
+		x8 ^= bits.RotateLeft32(x11+x10, 9)
+		x9 ^= bits.RotateLeft32(x8+x11, 13)
+		x10 ^= bits.RotateLeft32(x9+x8, 18)
+
+		x12 ^= bits.RotateLeft32(x15+x14, 7)
+		x13 ^= bits.RotateLeft32(x12+x15, 9)
+		x14 ^= bits.RotateLeft32(x13+x12, 13)
+		x15 ^= bits.RotateLeft32(x14+x13, 18)
+	}
+	x0 += w0
+	x1 += w1
+	x2 += w2
+	x3 += w3
+	x4 += w4
+	x5 += w5
+	x6 += w6
+	x7 += w7
+	x8 += w8
+	x9 += w9
+	x10 += w10
+	x11 += w11
+	x12 += w12
+	x13 += w13
+	x14 += w14
+	x15 += w15
+
+	out[0], tmp[0] = x0, x0
+	out[1], tmp[1] = x1, x1
+	out[2], tmp[2] = x2, x2
+	out[3], tmp[3] = x3, x3
+	out[4], tmp[4] = x4, x4
+	out[5], tmp[5] = x5, x5
+	out[6], tmp[6] = x6, x6
+	out[7], tmp[7] = x7, x7
+	out[8], tmp[8] = x8, x8
+	out[9], tmp[9] = x9, x9
+	out[10], tmp[10] = x10, x10
+	out[11], tmp[11] = x11, x11
+	out[12], tmp[12] = x12, x12
+	out[13], tmp[13] = x13, x13
+	out[14], tmp[14] = x14, x14
+	out[15], tmp[15] = x15, x15
+}
+
+func blockMix(tmp *[16]uint32, in, out []uint32, r int) {
+	blockCopy(tmp[:], in[(2*r-1)*16:], 16)
+	for i := 0; i < 2*r; i += 2 {
+		salsaXOR(tmp, in[i*16:], out[i*8:])
+		salsaXOR(tmp, in[i*16+16:], out[i*8+r*16:])
+	}
+}
+
+func integer(b []uint32, r int) uint64 {
+	j := (2*r - 1) * 16
+	return uint64(b[j]) | uint64(b[j+1])<<32
+}
+
+func smix(b []byte, r, N int, v, xy []uint32) {
+	var tmp [16]uint32
+	R := 32 * r
+	x := xy
+	y := xy[R:]
+
+	j := 0
+	for i := 0; i < R; i++ {
+		x[i] = binary.LittleEndian.Uint32(b[j:])
+		j += 4
+	}
+	for i := 0; i < N; i += 2 {
+		blockCopy(v[i*R:], x, R)
+		blockMix(&tmp, x, y, r)
+
+		blockCopy(v[(i+1)*R:], y, R)
+		blockMix(&tmp, y, x, r)
+	}
+	for i := 0; i < N; i += 2 {
+		j := int(integer(x, r) & uint64(N-1))
+		blockXOR(x, v[j*R:], R)
+		blockMix(&tmp, x, y, r)
+
+		j = int(integer(y, r) & uint64(N-1))
+		blockXOR(y, v[j*R:], R)
+		blockMix(&tmp, y, x, r)
+	}
+	j = 0
+	for _, v := range x[:R] {
+		binary.LittleEndian.PutUint32(b[j:], v)
+		j += 4
+	}
+}
+
+// Key derives a key from the password, salt, and cost parameters, returning
+// a byte slice of length keyLen that can be used as cryptographic key.
+//
+// N is a CPU/memory cost parameter, which must be a power of two greater than 1.
+// r and p must satisfy r * p < 2³⁰. If the parameters do not satisfy the
+// limits, the function returns a nil byte slice and an error.
+//
+// For example, you can get a derived key for e.g. AES-256 (which needs a
+// 32-byte key) by doing:
+//
+//	dk, err := scrypt.Key([]byte("some password"), salt, 32768, 8, 1, 32)
+//
+// The recommended parameters for interactive logins as of 2017 are N=32768, r=8
+// and p=1. The parameters N, r, and p should be increased as memory latency and
+// CPU parallelism increases; consider setting N to the highest power of 2 you
+// can derive within 100 milliseconds. Remember to get a good random salt.
+func Key(password, salt []byte, N, r, p, keyLen int) ([]byte, error) {
+	if N <= 1 || N&(N-1) != 0 {
+		return nil, errors.New("scrypt: N must be > 1 and a power of 2")
+	}
+	if uint64(r)*uint64(p) >= 1<<30 || r > maxInt/128/p || r > maxInt/256 || N > maxInt/128/r {
+		return nil, errors.New("scrypt: parameters are too large")
+	}
+
+	xy := make([]uint32, 64*r)
+	v := make([]uint32, 32*N*r)
+	b := pbkdf2.Key(password, salt, 1, p*128*r, sha256.New)
+
+	for i := 0; i < p; i++ {
+		smix(b[i*128*r:], r, N, v, xy)
+	}
+
+	return pbkdf2.Key(password, b, 1, keyLen, sha256.New), nil
+}

implant/vendor/golang.org/x/crypto/ssh/agent/client.go

@@ -8,7 +8,8 @@
 // ssh-agent process using the sample server.
 //
 // References:
-//  [PROTOCOL.agent]: https://tools.ietf.org/html/draft-miller-ssh-agent-00
+//
+//	[PROTOCOL.agent]: https://tools.ietf.org/html/draft-miller-ssh-agent-00
 package agent // import "golang.org/x/crypto/ssh/agent"
 
 import (
@@ -92,7 +93,7 @@ type ExtendedAgent interface {
 type ConstraintExtension struct {
 	// ExtensionName consist of a UTF-8 string suffixed by the
 	// implementation domain following the naming scheme defined
-	// in Section 4.2 of [RFC4251], e.g.  "[email protected]".
+	// in Section 4.2 of RFC 4251, e.g.  "[email protected]".
 	ExtensionName string
 	// ExtensionDetails contains the actual content of the extended
 	// constraint.
@@ -225,7 +226,9 @@ var ErrExtensionUnsupported = errors.New("agent: extension unsupported")
 
 type extensionAgentMsg struct {
 	ExtensionType string `sshtype:"27"`
-	Contents      []byte
+	// NOTE: this matches OpenSSH's PROTOCOL.agent, not the IETF draft [PROTOCOL.agent],
+	// so that it matches what OpenSSH actually implements in the wild.
+	Contents []byte `ssh:"rest"`
 }
 
 // Key represents a protocol 2 public key as defined in
@@ -728,7 +731,7 @@ func (c *client) insertCert(s interface{}, cert *ssh.Certificate, comment string
 	if err != nil {
 		return err
 	}
-	if bytes.Compare(cert.Key.Marshal(), signer.PublicKey().Marshal()) != 0 {
+	if !bytes.Equal(cert.Key.Marshal(), signer.PublicKey().Marshal()) {
 		return errors.New("agent: signer and cert have different public key")
 	}
 
@@ -771,7 +774,7 @@ func (s *agentKeyringSigner) Sign(rand io.Reader, data []byte) (*ssh.Signature,
 }
 
 func (s *agentKeyringSigner) SignWithAlgorithm(rand io.Reader, data []byte, algorithm string) (*ssh.Signature, error) {
-	if algorithm == "" || algorithm == s.pub.Type() {
+	if algorithm == "" || algorithm == underlyingAlgo(s.pub.Type()) {
 		return s.Sign(rand, data)
 	}
 
@@ -790,6 +793,33 @@ func (s *agentKeyringSigner) SignWithAlgorithm(rand io.Reader, data []byte, algo
 
 var _ ssh.AlgorithmSigner = &agentKeyringSigner{}
 
+// certKeyAlgoNames is a mapping from known certificate algorithm names to the
+// corresponding public key signature algorithm.
+//
+// This map must be kept in sync with the one in certs.go.
+var certKeyAlgoNames = map[string]string{
+	ssh.CertAlgoRSAv01:        ssh.KeyAlgoRSA,
+	ssh.CertAlgoRSASHA256v01:  ssh.KeyAlgoRSASHA256,
+	ssh.CertAlgoRSASHA512v01:  ssh.KeyAlgoRSASHA512,
+	ssh.CertAlgoDSAv01:        ssh.KeyAlgoDSA,
+	ssh.CertAlgoECDSA256v01:   ssh.KeyAlgoECDSA256,
+	ssh.CertAlgoECDSA384v01:   ssh.KeyAlgoECDSA384,
+	ssh.CertAlgoECDSA521v01:   ssh.KeyAlgoECDSA521,
+	ssh.CertAlgoSKECDSA256v01: ssh.KeyAlgoSKECDSA256,
+	ssh.CertAlgoED25519v01:    ssh.KeyAlgoED25519,
+	ssh.CertAlgoSKED25519v01:  ssh.KeyAlgoSKED25519,
+}
+
+// underlyingAlgo returns the signature algorithm associated with algo (which is
+// an advertised or negotiated public key or host key algorithm). These are
+// usually the same, except for certificate algorithms.
+func underlyingAlgo(algo string) string {
+	if a, ok := certKeyAlgoNames[algo]; ok {
+		return a
+	}
+	return algo
+}
+
 // Calls an extension method. It is up to the agent implementation as to whether or not
 // any particular extension is supported and may always return an error. Because the
 // type of the response is up to the implementation, this returns the bytes of the

implant/vendor/golang.org/x/crypto/ssh/certs.go

@@ -251,7 +251,7 @@ type algorithmOpenSSHCertSigner struct {
 // private key is held by signer. It returns an error if the public key in cert
 // doesn't match the key used by signer.
 func NewCertSigner(cert *Certificate, signer Signer) (Signer, error) {
-	if bytes.Compare(cert.Key.Marshal(), signer.PublicKey().Marshal()) != 0 {
+	if !bytes.Equal(cert.Key.Marshal(), signer.PublicKey().Marshal()) {
 		return nil, errors.New("ssh: signer and cert have different public key")
 	}
 
@@ -460,6 +460,8 @@ func (c *Certificate) SignCert(rand io.Reader, authority Signer) error {
 
 // certKeyAlgoNames is a mapping from known certificate algorithm names to the
 // corresponding public key signature algorithm.
+//
+// This map must be kept in sync with the one in agent/client.go.
 var certKeyAlgoNames = map[string]string{
 	CertAlgoRSAv01:        KeyAlgoRSA,
 	CertAlgoRSASHA256v01:  KeyAlgoRSASHA256,

implant/vendor/golang.org/x/crypto/ssh/cipher.go

@@ -15,7 +15,6 @@ import (
 	"fmt"
 	"hash"
 	"io"
-	"io/ioutil"
 
 	"golang.org/x/crypto/chacha20"
 	"golang.org/x/crypto/internal/poly1305"
@@ -97,13 +96,13 @@ func streamCipherMode(skip int, createFunc func(key, iv []byte) (cipher.Stream,
 // are not supported and will not be negotiated, even if explicitly requested in
 // ClientConfig.Crypto.Ciphers.
 var cipherModes = map[string]*cipherMode{
-	// Ciphers from RFC4344, which introduced many CTR-based ciphers. Algorithms
+	// Ciphers from RFC 4344, which introduced many CTR-based ciphers. Algorithms
 	// are defined in the order specified in the RFC.
 	"aes128-ctr": {16, aes.BlockSize, streamCipherMode(0, newAESCTR)},
 	"aes192-ctr": {24, aes.BlockSize, streamCipherMode(0, newAESCTR)},
 	"aes256-ctr": {32, aes.BlockSize, streamCipherMode(0, newAESCTR)},
 
-	// Ciphers from RFC4345, which introduces security-improved arcfour ciphers.
+	// Ciphers from RFC 4345, which introduces security-improved arcfour ciphers.
 	// They are defined in the order specified in the RFC.
 	"arcfour128": {16, 0, streamCipherMode(1536, newRC4)},
 	"arcfour256": {32, 0, streamCipherMode(1536, newRC4)},
@@ -111,7 +110,7 @@ var cipherModes = map[string]*cipherMode{
 	// Cipher defined in RFC 4253, which describes SSH Transport Layer Protocol.
 	// Note that this cipher is not safe, as stated in RFC 4253: "Arcfour (and
 	// RC4) has problems with weak keys, and should be used with caution."
-	// RFC4345 introduces improved versions of Arcfour.
+	// RFC 4345 introduces improved versions of Arcfour.
 	"arcfour": {16, 0, streamCipherMode(0, newRC4)},
 
 	// AEAD ciphers
@@ -497,7 +496,7 @@ func (c *cbcCipher) readCipherPacket(seqNum uint32, r io.Reader) ([]byte, error)
 			// data, to make distinguishing between
 			// failing MAC and failing length check more
 			// difficult.
-			io.CopyN(ioutil.Discard, r, int64(c.oracleCamouflage))
+			io.CopyN(io.Discard, r, int64(c.oracleCamouflage))
 		}
 	}
 	return p, err
@@ -640,9 +639,9 @@ const chacha20Poly1305ID = "[email protected]"
 // chacha20Poly1305Cipher implements the [email protected]
 // AEAD, which is described here:
 //
-//   https://tools.ietf.org/html/draft-josefsson-ssh-chacha20-poly1305-openssh-00
+//	https://tools.ietf.org/html/draft-josefsson-ssh-chacha20-poly1305-openssh-00
 //
-// the methods here also implement padding, which RFC4253 Section 6
+// the methods here also implement padding, which RFC 4253 Section 6
 // also requires of stream ciphers.
 type chacha20Poly1305Cipher struct {
 	lengthKey  [32]byte