wizardy0ga

# include <Windows.h>

// --- 1. Tell compiler to include the TLS directory in the program
# pragma comment( linker, "/INCLUDE:_tls_used" )

// --- 2. Tell compiler to include TLSCallback variable
# pragma comment( linker, "/INCLUDE:TLSCallback" )

// --- 3. Define a prototype for the tls callback function. This is the function to be executed prior to main.
VOID TlsCallbackFunc( PVOID hModule, DWORD dwReason, PVOID pContext );

wizardy0ga

import win32con
import win32gui
import icoextract
import os

def extract_metadata(filepath, icon_output_path=None):
    """Extract metadata from a Windows executable file using win32api."""
    
    metadata = {}

wizardy0ga

// CRT independant printing function
# define print(msg, ...)                                                        \
    if (1) {                                                                    \
        LPSTR Buf = (LPSTR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 1024); \
        if (Buf) {                                                              \
            int len = wsprintfA(Buf, msg "\n", __func__, __VA_ARGS__);          \
            WriteConsoleA(GetStdHandle(STD_OUTPUT_HANDLE), Buf, len, 0, 0);     \
            HeapFree(GetProcessHeap(), 0x00, Buf);                              \
        }                                                                       \
    }

wizardy0ga

/*
	@brief
		Load a PE in memory and execute it in the address space of this process

	@author
		wizardy0ga

	@usage:
		LoadPe.exe <path to exe>

wizardy0ga

#pragma once
#include <windows.h>
#include <stdio.h>

#define SEED_HASH 8888
#define KERNEL32_HASH 0xA52DE12A
#define LOAD_LIBRARY_HASH 0xF4DAB6A4

typedef struct _UNICODE_STRING_
{

wizardy0ga

/*
    Description:
        Copies a payload into memory using a chunking method using NTAPI calls. This assists with breaking up memory scanning routines by EDRs.
        A reserved / readonly page will be left at the top of the allocation. Each page below this memory page will contain the payload.

        | Page 1   | 4096 bytes | Reserved | R
        | Page 2   | 4096 bytes | Commited | RX
        | Page 3   | 4096 bytes | Commited | RX
        | Page ... | 4096 bytes | Commited | RX

wizardy0ga

/*
    Description:
        Copies a payload into memory using a chunking method. This assists with breaking up memory scanning routines by EDRs.
        A reserved / readonly page will be left at the top of the allocation. Each page below this memory page will contain the payload.

        | Page 1   | 4096 bytes | Reserved | R
        | Page 2   | 4096 bytes | Commited | RX
        | Page 3   | 4096 bytes | Commited | RX
        | Page ... | 4096 bytes | Commited | RX
        

wizardy0ga

/*
	Description:
		Program is a PoC DRM implementation. The program will only execute on the windows device that it first executed
		on. If it's copied to another device, it will delete itself on execution.

		A signature is kept in the rdata section of the binary. On fisrt exection, if the signature is the default signature,
		DRM will be initialized. This process consists of hashing the BIOS's UUID, & replacing the default signature with this
		hash. When the program executes again, it will check the BIOS's UUID hash against the signature stored in the
		.rdata section. If the hash doesn't match, the program deletes itself.

wizardy0ga

#include <windows.h>
#include <winternl.h>

#define STREAM_NAME L":XanWudS"

BOOL SelfDelete()
{
	HANDLE					hFile			= INVALID_HANDLE_VALUE;
	PWSTR					szImageName		= NULL;
	FILE_DISPOSITION_INFO	                DisposalInfo	        = { .DeleteFile = TRUE };

wizardy0ga

#include "pch.h"

#include <Windows.h>
#include <stdio.h>

#define RET  0xC3
#define INT3 0xCC
#define JE   0x74
#define JNE  0x75
#define MOV  0xB8