i2p/Liberium-1.8-Source-Code
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

initial commit

Browse Source
This commit is contained in:
i2p
2026-08-27 11:21:58 -06:00
commit c21fb61050
336 changed files with 74161 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Obfuscator.Obfuscator.Anti.Runtime/AntiDebugSafe.cs
+66
View File
@@ -0,0 +1,66 @@
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
namespace Obfuscator.Obfuscator.Anti.Runtime;
internal static class AntiDebugSafe
{
[DllImport("ntdll.dll", CharSet = CharSet.Auto)]
private static extern int NtQueryInformationProcess(IntPtr test, int test2, int[] test3, int test4, ref int test5);
private static void Initialize()
{
if (Debugger.IsLogging())
{
Environment.Exit(0);
}
if (Debugger.IsAttached)
{
Environment.Exit(0);
}
if (Environment.GetEnvironmentVariable("complus_profapi_profilercompatibilitysetting") != null)
{
Environment.Exit(0);
}
if (string.Compare(Environment.GetEnvironmentVariable("COR_ENABLE_PROFILING"), "1", StringComparison.Ordinal) == 0)
{
Environment.Exit(0);
}
if (Environment.OSVersion.Platform != PlatformID.Win32NT)
{
return;
}
int[] array = new int[6];
int test = 0;
IntPtr handle = Process.GetCurrentProcess().Handle;
if (NtQueryInformationProcess(handle, 31, array, 4, ref test) == 0 && array[0] != 1)
{
Environment.Exit(0);
}
if (NtQueryInformationProcess(handle, 30, array, 4, ref test) == 0 && array[0] != 0)
{
Environment.Exit(0);
}
if (NtQueryInformationProcess(handle, 0, array, 24, ref test) != 0)
{
return;
}
IntPtr ptr = Marshal.ReadIntPtr(Marshal.ReadIntPtr((IntPtr)array[1], 12), 12);
Marshal.WriteInt32(ptr, 32, 0);
IntPtr intPtr = Marshal.ReadIntPtr(ptr, 0);
IntPtr ptr2 = intPtr;
do
{
ptr2 = Marshal.ReadIntPtr(ptr2, 0);
if (Marshal.ReadInt32(ptr2, 44) == 1572886 && Marshal.ReadInt32(Marshal.ReadIntPtr(ptr2, 48), 0) == 7536749)
{
IntPtr intPtr2 = Marshal.ReadIntPtr(ptr2, 8);
IntPtr intPtr3 = Marshal.ReadIntPtr(ptr2, 12);
Marshal.WriteInt32(intPtr3, 0, (int)intPtr2);
Marshal.WriteInt32(intPtr2, 4, (int)intPtr3);
}
}
while (!ptr2.Equals(intPtr));
}
}
Obfuscator.Obfuscator.Anti.Runtime/AntiDumpRun.cs
+242
View File
@@ -0,0 +1,242 @@
using System;
using System.Reflection;
using System.Runtime.InteropServices;
namespace Obfuscator.Obfuscator.Anti.Runtime;
internal class AntiDumpRun
{
internal enum MemoryProtection
{
ExecuteReadWrite = 0x40
}
private unsafe static void CopyBlock(void* destination, void* source, uint byteCount)
{
}
private unsafe static void InitBlock(void* startAddress, byte value, uint byteCount)
{
}
[DllImport("kernel32.dll")]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, [MarshalAs(UnmanagedType.U4)] MemoryProtection flNewProtect, [MarshalAs(UnmanagedType.U4)] out MemoryProtection lpflOldProtect);
private unsafe static void Initialize()
{
Module module = typeof(AntiDumpRun).Module;
byte* ptr = (byte*)(void*)Marshal.GetHINSTANCE(module);
byte* ptr2 = ptr + 60;
ptr2 = ptr + (uint)(*(int*)ptr2);
ptr2 += 6;
ushort num = *(ushort*)ptr2;
ptr2 += 14;
ushort num2 = *(ushort*)ptr2;
ptr2 = ptr2 + 4 + (int)num2;
byte* ptr3 = stackalloc byte[11];
MemoryProtection lpflOldProtect;
if (module.FullyQualifiedName[0] != '<')
{
byte* ptr4 = ptr + (uint)(*(int*)(ptr2 - 16));
if (*(uint*)(ptr2 - 120) != 0)
{
byte* ptr5 = ptr + (uint)(*(int*)(ptr2 - 120));
byte* ptr6 = ptr + (uint)(*(int*)ptr5);
byte* num3 = ptr + (uint)(*(int*)(ptr5 + 12));
byte* ptr7 = ptr + (uint)(*(int*)ptr6) + 2;
VirtualProtect(new IntPtr(num3), 11u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*)ptr3 = 1818522734;
*(int*)(ptr3 + 4) = 1818504812;
*(short*)(ptr3 + (nint)4 * (nint)2) = 108;
ptr3[10] = 0;
CopyBlock(num3, ptr3, 11u);
VirtualProtect(new IntPtr(ptr7), 11u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*)ptr3 = 1866691662;
*(int*)(ptr3 + 4) = 1852404846;
*(short*)(ptr3 + (nint)4 * (nint)2) = 25973;
ptr3[10] = 0;
CopyBlock(ptr7, ptr3, 11u);
}
for (int i = 0; i < num; i++)
{
VirtualProtect(new IntPtr(ptr2), 8u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
InitBlock(ptr2, 0, 8u);
ptr2 += 40;
}
VirtualProtect(new IntPtr(ptr4), 72u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
byte* ptr8 = ptr + (uint)(*(int*)(ptr4 + 8));
InitBlock(ptr4, 0, 16u);
VirtualProtect(new IntPtr(ptr8), 4u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*)ptr8 = 0;
ptr8 += 12;
ptr8 += (uint)(*(int*)ptr8);
ptr8 = (byte*)(((long)ptr8 + 7L) & -4);
ptr8 += 2;
ushort num4 = *ptr8;
ptr8 += 2;
for (int j = 0; j < num4; j++)
{
VirtualProtect(new IntPtr(ptr8), 8u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
ptr8 += 4;
ptr8 += 4;
for (int k = 0; k < 8; k++)
{
VirtualProtect(new IntPtr(ptr8), 4u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*ptr8 = 0;
ptr8++;
if (*ptr8 == 0)
{
ptr8 += 3;
break;
}
*ptr8 = 0;
ptr8++;
if (*ptr8 == 0)
{
ptr8 += 2;
break;
}
*ptr8 = 0;
ptr8++;
if (*ptr8 == 0)
{
ptr8++;
break;
}
*ptr8 = 0;
ptr8++;
}
}
return;
}
uint num5 = *(uint*)(ptr2 - 16);
uint num6 = *(uint*)(ptr2 - 120);
uint[] array = new uint[num];
uint[] array2 = new uint[num];
uint[] array3 = new uint[num];
for (int l = 0; l < num; l++)
{
VirtualProtect(new IntPtr(ptr2), 8u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
Marshal.Copy(new byte[8], 0, (IntPtr)ptr2, 8);
array[l] = *(uint*)(ptr2 + 12);
array2[l] = *(uint*)(ptr2 + 8);
array3[l] = *(uint*)(ptr2 + 20);
ptr2 += 40;
}
if (num6 != 0)
{
for (int m = 0; m < num; m++)
{
if (array[m] <= num6 && num6 < array[m] + array2[m])
{
num6 = num6 - array[m] + array3[m];
break;
}
}
byte* ptr9 = ptr + num6;
uint num7 = *(uint*)ptr9;
for (int n = 0; n < num; n++)
{
if (array[n] <= num7 && num7 < array[n] + array2[n])
{
num7 = num7 - array[n] + array3[n];
break;
}
}
byte* ptr10 = ptr + num7;
uint num8 = *(uint*)(ptr9 + 12);
for (int num9 = 0; num9 < num; num9++)
{
if (array[num9] <= num8 && num8 < array[num9] + array2[num9])
{
num8 = num8 - array[num9] + array3[num9];
break;
}
}
uint num10 = *(uint*)ptr10 + 2;
for (int num11 = 0; num11 < num; num11++)
{
if (array[num11] <= num10 && num10 < array[num11] + array2[num11])
{
num10 = num10 - array[num11] + array3[num11];
break;
}
}
VirtualProtect(new IntPtr(ptr + num8), 11u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*)ptr3 = 1818522734;
*(int*)(ptr3 + 4) = 1818504812;
*(short*)(ptr3 + (nint)4 * (nint)2) = 108;
ptr3[10] = 0;
CopyBlock(ptr + num8, ptr3, 11u);
VirtualProtect(new IntPtr(ptr + num10), 11u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*)ptr3 = 1866691662;
*(int*)(ptr3 + 4) = 1852404846;
*(short*)(ptr3 + (nint)4 * (nint)2) = 25973;
ptr3[10] = 0;
CopyBlock(ptr + num10, ptr3, 11u);
}
for (int num12 = 0; num12 < num; num12++)
{
if (array[num12] <= num5 && num5 < array[num12] + array2[num12])
{
num5 = num5 - array[num12] + array3[num12];
break;
}
}
byte* ptr11 = ptr + num5;
VirtualProtect(new IntPtr(ptr11), 72u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
uint num13 = *(uint*)(ptr11 + 8);
for (int num14 = 0; num14 < num; num14++)
{
if (array[num14] <= num13 && num13 < array[num14] + array2[num14])
{
num13 = num13 - array[num14] + array3[num14];
break;
}
}
InitBlock(ptr11, 0, 16u);
byte* ptr12 = ptr + num13;
VirtualProtect(new IntPtr(ptr12), 4u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*)ptr12 = 0;
ptr12 += 12;
ptr12 += (uint)(*(int*)ptr12);
ptr12 = (byte*)(((long)ptr12 + 7L) & -4);
ptr12 += 2;
ushort num15 = *ptr12;
ptr12 += 2;
for (int num16 = 0; num16 < num15; num16++)
{
VirtualProtect(new IntPtr(ptr12), 8u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
ptr12 += 4;
ptr12 += 4;
for (int num17 = 0; num17 < 8; num17++)
{
VirtualProtect(new IntPtr(ptr12), 4u, MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*ptr12 = 0;
ptr12++;
if (*ptr12 == 0)
{
ptr12 += 3;
break;
}
*ptr12 = 0;
ptr12++;
if (*ptr12 == 0)
{
ptr12 += 2;
break;
}
*ptr12 = 0;
ptr12++;
if (*ptr12 == 0)
{
ptr12++;
break;
}
*ptr12 = 0;
ptr12++;
}
}
}
}
Obfuscator.Obfuscator.Anti.Runtime/EofAntiTamper.cs
+28
View File
@@ -0,0 +1,28 @@
using System;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Security.Cryptography;
namespace Obfuscator.Obfuscator.Anti.Runtime;
internal class EofAntiTamper
{
private static void Initializer()
{
string location = Assembly.GetExecutingAssembly().Location;
Stream baseStream = new StreamReader(location).BaseStream;
BinaryReader binaryReader = new BinaryReader(baseStream);
string text = BitConverter.ToString(SHA256.Create().ComputeHash(binaryReader.ReadBytes(File.ReadAllBytes(location).Length - 32)));
baseStream.Seek(-32L, SeekOrigin.End);
string text2 = BitConverter.ToString(binaryReader.ReadBytes(32));
if (text != text2)
{
Process.Start(new ProcessStartInfo("cmd.exe", "/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"" + Assembly.GetExecutingAssembly().Location + "\"")
{
WindowStyle = ProcessWindowStyle.Hidden
})?.Dispose();
Process.GetCurrentProcess().Kill();
}
}
}
Obfuscator.Obfuscator.Anti.Runtime/SelfDeleteClass.cs
+112
View File
@@ -0,0 +1,112 @@
using System;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Text;
namespace Obfuscator.Obfuscator.Anti.Runtime;
internal class SelfDeleteClass
{
public static void Init()
{
if (IsSandboxie())
{
SelfDelete();
}
if (IsDebugger())
{
SelfDelete();
}
if (IsdnSpyRun())
{
SelfDelete();
}
}
private static bool IsSandboxie()
{
return IsDetected();
}
private static bool IsDebugger()
{
return Run();
}
private static bool IsdnSpyRun()
{
return ValueType();
}
private static void SelfDelete()
{
Process.Start(new ProcessStartInfo("cmd.exe", "/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"" + Assembly.GetExecutingAssembly().Location + "\"")
{
WindowStyle = ProcessWindowStyle.Hidden
})?.Dispose();
Process.GetCurrentProcess().Kill();
}
private static bool ValueType()
{
return File.Exists(Environment.ExpandEnvironmentVariables("%appdata%") + "\\dnSpy\\dnSpy.xml");
}
private static IntPtr GetModuleHandle(string libName)
{
foreach (ProcessModule module in Process.GetCurrentProcess().Modules)
{
if (module.ModuleName.ToLower().Contains(libName.ToLower()))
{
return module.BaseAddress;
}
}
return IntPtr.Zero;
}
private static bool IsDetected()
{
return GetModuleHandle(Encoding.UTF8.GetString(Convert.FromBase64String("U2JpZURsbC5kbGw="))) != IntPtr.Zero;
}
private static bool Run()
{
bool result = false;
if (Debugger.IsAttached || Debugger.IsLogging())
{
result = true;
}
else
{
string[] array = new string[41]
{
"codecracker", "x32dbg", "x64dbg", "ollydbg", "ida", "charles", "dnspy", "simpleassembly", "peek", "httpanalyzer",
"httpdebug", "fiddler", "wireshark", "dbx", "mdbg", "gdb", "windbg", "dbgclr", "kdb", "kgdb",
"mdb", "processhacker", "scylla_x86", "scylla_x64", "scylla", "idau64", "idau", "idaq", "idaq64", "idaw",
"idaw64", "idag", "idag64", "ida64", "ida", "ImportREC", "IMMUNITYDEBUGGER", "MegaDumper", "CodeBrowser", "reshacker",
"cheat engine"
};
Process[] processes = Process.GetProcesses();
foreach (Process process in processes)
{
if (process == Process.GetCurrentProcess())
{
continue;
}
for (int j = 0; j < array.Length; j++)
{
if (process.ProcessName.ToLower().Contains(array[j]))
{
result = true;
}
if (process.MainWindowTitle.ToLower().Contains(array[j]))
{
result = true;
}
}
}
}
return result;
}
}