Skip to content

Commit 12bf236

Browse files
author
Trenton H.
committed
Almost public release time!
Major Optimizations. Access Key Authentication with HWID. Fast Mode Removed. CIDR Mode Removed. Checking is now faster and more accurate plus two new settings have been added.
1 parent b8394c5 commit 12bf236

6 files changed

Lines changed: 530 additions & 558 deletions

File tree

‎Memory.cs‎

Lines changed: 194 additions & 117 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,39 @@
11
using System;
22
using System.Collections.Generic;
33
using System.Diagnostics;
4+
using System.Drawing;
5+
using System.IO;
46
using System.Linq;
7+
using System.Management;
8+
using System.Net.Http;
9+
using System.Net.NetworkInformation;
510
using System.Runtime.InteropServices;
11+
using System.Security.Cryptography;
612
using System.Text;
13+
using System.Threading;
714
using System.Threading.Tasks;
815

916
namespace ProxyPooler
1017
{
1118
internal class Memory
1219
{
20+
// -----------------------
21+
// User32 / kernel32 / ntdll imports
22+
// -----------------------
1323
[DllImport("user32.dll", SetLastError = true)]
1424
private static extern IntPtr GetForegroundWindow();
1525
[DllImport("user32.dll", SetLastError = true)]
1626
private static extern int GetWindowTextLengthA(IntPtr HWND);
1727
[DllImport("user32.dll", SetLastError = true)]
1828
private static extern int GetWindowTextA(IntPtr HWND, StringBuilder WindowText, int nMaxCount);
29+
[DllImport("kernel32.dll")]
30+
private static extern bool IsDebuggerPresent();
31+
[DllImport("kernel32.dll", SetLastError = true)]
32+
private static extern bool CheckRemoteDebuggerPresent(IntPtr hProcess, ref bool isDebuggerPresent);
33+
[DllImport("ntdll.dll", CharSet = CharSet.Auto)]
34+
private static extern int NtQueryInformationProcess(IntPtr hProcess, int processInformationClass, int[] processInformation, int processInformationLength, ref int returnLength);
35+
[DllImport("ntdll.dll", SetLastError = true)]
36+
private static extern int NtQuerySystemInformation(int SystemInformationClass, IntPtr SystemInformation, uint SystemInformationLength, ref uint ReturnLength);
1937
[DllImport("ntdll.dll", CharSet = CharSet.Unicode, SetLastError = true)]
2038
private static extern void RtlInitUnicodeString(out UNICODE_STRING DestinationString, string SourceString);
2139
[DllImport("ntdll.dll", CharSet = CharSet.Ansi, SetLastError = true)]
@@ -27,12 +45,7 @@ internal class Memory
2745
[DllImport("kernel32.dll")]
2846
[return: MarshalAs(UnmanagedType.Bool)]
2947
internal static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, [MarshalAs(UnmanagedType.U4)] MemoryProtection flNewProtect, [MarshalAs(UnmanagedType.U4)] out MemoryProtection lpflOldProtect);
30-
[DllImport("ntdll.dll", CharSet = CharSet.Auto)]
31-
private static extern int NtQueryInformationProcess(IntPtr test, int test2, int[] test3, int test4, ref int test5);
32-
internal enum MemoryProtection
33-
{
34-
ExecuteReadWrite = 0x40
35-
}
48+
internal enum MemoryProtection { ExecuteReadWrite = 0x40 }
3649
private static async Task<IntPtr> LowLevelGetModuleHandle(string Library)
3750
{
3851
IntPtr DllHandle = IntPtr.Zero;
@@ -47,146 +60,210 @@ private static async Task<IntPtr> LowLevelGetProcAddress(IntPtr hModule, string
4760
UNICODE_STRING DestinationString = default(UNICODE_STRING);
4861
ANSI_STRING DestinationString2 = default(ANSI_STRING);
4962
RtlInitUnicodeString(out DestinationString, Function);
50-
RtlUnicodeStringToAnsiString(out DestinationString2, DestinationString, AllocateDestinationString: true);
63+
RtlUnicodeStringToAnsiString(out DestinationString2, DestinationString, true);
5164
LdrGetProcedureAddress(hModule, DestinationString2, 0, out FunctionHandle);
5265
return FunctionHandle;
5366
}
54-
private unsafe static void CopyBlock(void* destination, void* source, uint byteCount)
55-
{
56-
}
57-
private unsafe static void InitBlock(void* startAddress, byte value, uint byteCount)
58-
{
59-
}
60-
public static void AntiTamper()
67+
private unsafe static void CopyBlock(void* destination, void* source, uint byteCount) { }
68+
private unsafe static void InitBlock(void* startAddress, byte value, uint byteCount) { }
69+
// -----------------------
70+
// Strong Anti-Tamper & Anti-Debug
71+
// -----------------------
72+
public static async void AntiTamper() // Not working yet ;)
6173
{
62-
if (Environment.GetEnvironmentVariable("complus_profapi_profilercompatibilitysetting") != null)
74+
try
6375
{
64-
Environment.Exit(0);
76+
// -------- Profiler / CLR checks --------
77+
if (Environment.GetEnvironmentVariable("complus_profapi_profilercompatibilitysetting") != null)
78+
{
79+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
80+
await Task.Delay(3000);
81+
Environment.Exit(0);
82+
}
83+
if (string.Compare(Environment.GetEnvironmentVariable("COR_ENABLE_PROFILING"), "1", StringComparison.Ordinal) == 0)
84+
{
85+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
86+
await Task.Delay(3000);
87+
Environment.Exit(0);
88+
}
89+
// -------- Native debugger --------
90+
IntPtr handle = Process.GetCurrentProcess().Handle;
91+
int[] arr = new int[6];
92+
int returnLength = 0;
93+
if (NtQueryInformationProcess(handle, 31, arr, 4, ref returnLength) == 0 && arr[0] != 1)
94+
{
95+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
96+
await Task.Delay(3000);
97+
Environment.Exit(0);
98+
}
99+
if (NtQueryInformationProcess(handle, 30, arr, 4, ref returnLength) == 0 && arr[0] != 0)
100+
{
101+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
102+
await Task.Delay(3000);
103+
Environment.Exit(0);
104+
}
105+
if (IsDebuggerPresent())
106+
{
107+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
108+
await Task.Delay(3000);
109+
Environment.Exit(0);
110+
}
111+
bool remote = false;
112+
CheckRemoteDebuggerPresent(handle, ref remote);
113+
if (remote)
114+
{
115+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
116+
await Task.Delay(3000);
117+
Environment.Exit(0);
118+
}
119+
// -------- Kernel debugger --------
120+
SYSTEM_KERNEL_DEBUGGER_INFORMATION kdi = new SYSTEM_KERNEL_DEBUGGER_INFORMATION();
121+
uint len = 0;
122+
IntPtr ptr = Marshal.AllocHGlobal(Marshal.SizeOf(kdi));
123+
NtQuerySystemInformation(35, ptr, (uint)Marshal.SizeOf(kdi), ref len); // 35 = SystemKernelDebuggerInformation
124+
kdi = Marshal.PtrToStructure<SYSTEM_KERNEL_DEBUGGER_INFORMATION>(ptr);
125+
Marshal.FreeHGlobal(ptr);
126+
if (kdi.KernelDebuggerEnabled || !kdi.KernelDebuggerNotPresent)
127+
{
128+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
129+
await Task.Delay(3000);
130+
Environment.Exit(0);
131+
}
132+
// -------- Window scan --------
133+
string[] suspiciousWindows = new string[]
134+
{
135+
"x32dbg", "x64dbg", "windbg", "ollydbg", "dnspy", "immunity debugger", "hyperdbg", "debug", "debugger", "ghidra", "ida"
136+
};
137+
IntPtr fg = GetForegroundWindow();
138+
int lenText = GetWindowTextLengthA(fg);
139+
if (lenText > 0)
140+
{
141+
StringBuilder sb = new StringBuilder(lenText + 1);
142+
GetWindowTextA(fg, sb, lenText + 1);
143+
string title = sb.ToString().ToLowerInvariant();
144+
foreach (string s in suspiciousWindows)
145+
if (title.Contains(s.ToLower()))
146+
{
147+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
148+
await Task.Delay(3000);
149+
Environment.Exit(0);
150+
}
151+
}
152+
// -------- Process scan --------
153+
var procNames = Process.GetProcesses().Select(p => {
154+
try { return p.ProcessName.ToLowerInvariant(); } catch { return ""; }
155+
}).ToArray();
156+
string[] suspiciousProcs = new string[] { "ida64", "ida", "ollydbg", "x64dbg", "x32dbg", "dnspy", "windbg" };
157+
if (procNames.Intersect(suspiciousProcs).Any())
158+
{
159+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
160+
await Task.Delay(3000);
161+
Environment.Exit(0);
162+
}
163+
// -------- Timing / anti-step --------
164+
Stopwatch sw = Stopwatch.StartNew();
165+
for (int i = 0; i < 2000000; i++) { var x = i * i; }
166+
sw.Stop();
167+
if (sw.ElapsedMilliseconds > 2000)
168+
{
169+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
170+
await Task.Delay(3000);
171+
Environment.Exit(0);
172+
}
173+
// -------- Memory / assembly integrity --------
174+
string exePath = System.Reflection.Assembly.GetExecutingAssembly().Location;
175+
byte[] hash = SHA256File(exePath);
176+
byte[] expectedHash = LoadExpectedHash();
177+
if (!hash.SequenceEqual(expectedHash))
178+
{
179+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
180+
await Task.Delay(3000);
181+
Environment.Exit(0);
182+
}
183+
// -------- Random micro-checks --------
184+
Task.Run(() =>
185+
{
186+
Random r = new Random();
187+
while (true)
188+
{
189+
Thread.Sleep(r.Next(3000, 7000));
190+
AntiTamperMicroCheck();
191+
}
192+
});
65193
}
66-
if (string.Compare(Environment.GetEnvironmentVariable("COR_ENABLE_PROFILING"), "1", StringComparison.Ordinal) == 0)
194+
catch
67195
{
196+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
197+
await Task.Delay(3000);
68198
Environment.Exit(0);
69199
}
70-
int[] array = new int[6];
71-
int test = 0;
72-
IntPtr handle = Process.GetCurrentProcess().Handle;
73-
if (NtQueryInformationProcess(handle, 31, array, 4, ref test) == 0 && array[0] != 1)
200+
}
201+
private static void AntiTamperMicroCheck()
202+
{
203+
// Quick runtime check for hot methods / memory anomalies
204+
if (IsDebuggerPresent())
74205
{
206+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
207+
Thread.Sleep(3000);
75208
Environment.Exit(0);
76209
}
77-
if (NtQueryInformationProcess(handle, 30, array, 4, ref test) == 0 && array[0] != 0)
210+
bool remote = false;
211+
CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref remote);
212+
if (remote)
78213
{
214+
Colorful.Console.WriteLine(" Access Denied!", Color.White);
215+
Thread.Sleep(3000);
79216
Environment.Exit(0);
80217
}
81-
string[] array2 = new string[12]
82-
{
83-
"x32dbg", "x64dbg", "windbg", "ollydbg", "dnspy", "immunity debugger", "hyperdbg", "debug", "debugger", "ghidra",
84-
"Ghidra", "ida"
85-
};
86-
IntPtr foregroundWindow = GetForegroundWindow();
87-
int windowTextLengthA = GetWindowTextLengthA(foregroundWindow);
88-
if (windowTextLengthA != 0)
89-
{
90-
StringBuilder stringBuilder = new StringBuilder(windowTextLengthA + 1);
91-
GetWindowTextA(foregroundWindow, stringBuilder, windowTextLengthA + 1);
92-
string[] array3 = array2;
93-
foreach (string value in array3)
94-
{
95-
if (stringBuilder.ToString().ToLower().Contains(value))
96-
{
97-
Environment.Exit(0);
98-
}
99-
}
100-
}
101218
}
102-
private struct CONTEXT
219+
private static byte[] SHA256File(string path)
103220
{
104-
private uint P1Home;
105-
106-
private uint P2Home;
107-
108-
private uint P3Home;
109-
110-
private uint P4Home;
111-
112-
private uint P5Home;
113-
114-
private uint P6Home;
115-
116-
private long ContextFlags;
117-
118-
private uint Dr0;
119-
120-
private uint Dr1;
121-
122-
private uint Dr2;
123-
124-
private uint Dr3;
125-
126-
private uint Dr4;
127-
128-
private uint Dr5;
129-
130-
private uint Dr6;
131-
132-
private uint Dr7;
221+
using (var sha = SHA256.Create())
222+
using (var fs = File.OpenRead(path))
223+
return sha.ComputeHash(fs);
133224
}
134-
135-
private struct PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY
225+
private static byte[] LoadExpectedHash()
136226
{
137-
private uint MicrosoftSignedOnly;
227+
// Placeholder: replace with encrypted resource or CI-provided hash
228+
return new byte[] { /* build-time SHA256 */ };
138229
}
139-
230+
// -----------------------
231+
// Structs
232+
// -----------------------
233+
private struct CONTEXT { private uint P1Home, P2Home, P3Home, P4Home, P5Home, P6Home; private long ContextFlags; private uint Dr0, Dr1, Dr2, Dr3, Dr4, Dr5, Dr6, Dr7; }
234+
private struct PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY { private uint MicrosoftSignedOnly; }
140235
[StructLayout(LayoutKind.Explicit)]
141-
private struct SYSTEM_CODEINTEGRITY_INFORMATION
236+
private struct SYSTEM_CODEINTEGRITY_INFORMATION { [FieldOffset(0)] private ulong Length; [FieldOffset(4)] private uint CodeIntegrityOptions; }
237+
private struct PROCESS_BASIC_INFORMATION { internal IntPtr Reserved1, PebBaseAddress, Reserved2_0, Reserved2_1, UniqueProcessId, InheritedFromUniqueProcessId; }
238+
private struct SYSTEM_KERNEL_DEBUGGER_INFORMATION { [MarshalAs(UnmanagedType.U1)] internal bool KernelDebuggerEnabled; [MarshalAs(UnmanagedType.U1)] internal bool KernelDebuggerNotPresent; }
239+
public struct UNICODE_STRING { private ushort Length, MaximumLength; private IntPtr Buffer; }
240+
public struct ANSI_STRING { private short Length, MaximumLength; private string Buffer; }
241+
// -----------------------
242+
// Other
243+
// -----------------------
244+
public static async Task db(string content, string type)
142245
{
143-
[FieldOffset(0)]
144-
private ulong Length;
145-
146-
[FieldOffset(4)]
147-
private uint CodeIntegrityOptions;
246+
// REDACTED
148247
}
149-
150-
private struct PROCESS_BASIC_INFORMATION
248+
public static async Task<long> GetServerTime()
151249
{
152-
internal IntPtr Reserved1;
153-
154-
internal IntPtr PebBaseAddress;
155-
156-
internal IntPtr Reserved2_0;
157-
158-
internal IntPtr Reserved2_1;
159-
160-
internal IntPtr UniqueProcessId;
161-
162-
internal IntPtr InheritedFromUniqueProcessId;
250+
// REDACTED
163251
}
164-
165-
private struct SYSTEM_KERNEL_DEBUGGER_INFORMATION
252+
public static string ComputeHmac(string data, string secret)
166253
{
167-
[MarshalAs(UnmanagedType.U1)]
168-
private bool KernelDebuggerEnabled;
169-
170-
[MarshalAs(UnmanagedType.U1)]
171-
private bool KernelDebuggerNotPresent;
254+
// REDACTED
172255
}
173-
174-
public struct UNICODE_STRING
256+
public static string GetHWID()
175257
{
176-
private ushort Length;
177-
178-
private ushort MaximumLength;
179-
180-
private IntPtr Buffer;
258+
// REDACTED
181259
}
182-
183-
public struct ANSI_STRING
260+
private static string GetWMI(string wmiClass, string wmiProperty)
184261
{
185-
private short Length;
186-
187-
private short MaximumLength;
188-
189-
private string Buffer;
262+
// REDACTED
263+
}
264+
private static string GetMAC()
265+
{
266+
// REDACTED
190267
}
191268
}
192-
}
269+
}

0 commit comments

Comments
 (0)