From c1b026ef3ef754fad6e663a04503257932d34a12 Mon Sep 17 00:00:00 2001
From: mgeeky <mb@binary-offensive.com>
Date: Thu, 7 Oct 2021 16:32:27 +0200
Subject: [PATCH 1/2] generalised isBeaconThread condition.

---
 ShellcodeFluctuation/main.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ShellcodeFluctuation/main.cpp b/ShellcodeFluctuation/main.cpp
index eb2ae82..c9a440d 100644
--- a/ShellcodeFluctuation/main.cpp
+++ b/ShellcodeFluctuation/main.cpp
@@ -166,7 +166,8 @@ bool isShellcodeThread(LPVOID address)
         {
             const DWORD expectedProtection = (g_fluctuate == FluctuateToRW) ? PAGE_READWRITE : PAGE_NOACCESS;
 
-            return ((mbi.Protect & Shellcode_Memory_Protection)
+            return ((mbi.Protect & PAGE_EXECUTE_READ) 
+                || (mbi.Protect & PAGE_EXECUTE_READWRITE)
                 || (mbi.Protect & expectedProtection));
         }
     }

From 21a7194ca70b5a2133457047350595ee0856a284 Mon Sep 17 00:00:00 2001
From: mgeeky <mb@binary-offensive.com>
Date: Thu, 7 Oct 2021 16:49:14 +0200
Subject: [PATCH 2/2] Generalised memory protection revert to reuse protection
 originally met after locating shellcode for the first time.

---
 ShellcodeFluctuation/header.h | 1 +
 ShellcodeFluctuation/main.cpp | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/ShellcodeFluctuation/header.h b/ShellcodeFluctuation/header.h
index 2d56bf1..10637db 100644
--- a/ShellcodeFluctuation/header.h
+++ b/ShellcodeFluctuation/header.h
@@ -31,6 +31,7 @@ struct FluctuationMetadata
     SIZE_T shellcodeSize;
     bool currentlyEncrypted;
     DWORD encodeKey;
+    DWORD protect;
 };
 
 struct HookedSleep
diff --git a/ShellcodeFluctuation/main.cpp b/ShellcodeFluctuation/main.cpp
index c9a440d..4b2e620 100644
--- a/ShellcodeFluctuation/main.cpp
+++ b/ShellcodeFluctuation/main.cpp
@@ -291,7 +291,7 @@ void shellcodeEncryptDecrypt(LPVOID callerAddress)
                 g_fluctuationData.shellcodeAddr,
                 g_fluctuationData.shellcodeSize,
                 PAGE_READWRITE,
-                &oldProt
+                &g_fluctuationData.protect
             );
 
             log("[>] Flipped to RW.");
@@ -330,11 +330,11 @@ void shellcodeEncryptDecrypt(LPVOID callerAddress)
             ::VirtualProtect(
                 g_fluctuationData.shellcodeAddr,
                 g_fluctuationData.shellcodeSize,
-                Shellcode_Memory_Protection,
+                g_fluctuationData.protect,
                 &oldProt
             );
 
-            log("[<] Flipped to RX.\n");
+            log("[<] Flipped back to RX/RWX.\n");
         }
 
         g_fluctuationData.currentlyEncrypted = !g_fluctuationData.currentlyEncrypted;