#include <stdio.h>

#include <windows.h>

#include <psapi.h>

#include <stdlib.h>

extern "C"

{

#include <lua.h>

#include <lauxlib.h>

#include <lualib.h>

}

#include <signal.h>

#include <imagehlp.h>

#include <ctype.h>

#include <winnt.h>

#include "shackle.h"

#include "pcontrol.h"

extern "C"

{

#include "comms.h"

#include "search.h"

#include "ptrscan.h"

#include "gamestuff.h"

#include "vtable.h"

#include "wincrypt.h"

#include "lua_socket.h"

#include "magicmirror.h"

#include "comms.h"

#include "darksign.h"

#include "capstone/capstone.h"

}

#include "xedparse\src\XEDParse.h"

int validate_asm(asmBuffer *a);

extern "C" FILE _iob[];

extern "C" FILE * __cdecl __iob_func(void)

{

return _iob;

}

#define WIN32_LEAN_AND_MEAN

#define EOFMARK "<eof>"

#define marklen (sizeof(EOFMARK)/sizeof(char) - 1)

#define VERSTRING "[v0p9]"

#ifdef ARCHI_64

#define ARCHI 64

#define PC_REG Rip

#define REGISTER_LENGTH DWORD64

#define FUNCTION_PATCHLEN 14

#define FUNCTION_SHORTPATCH_HACK 5

#define INTEL_MAXINSTRLEN 15

#define FUNCTION_TAILLEN 14

#else

#define ARCHI 32

#define PC_REG Eip

#define REGISTER_LENGTH DWORD

#define FUNCTION_PATCHLEN 6

#define FUNCTION_SHORTPATCH_HACK 5

#define INTEL_MAXINSTRLEN 15

#define FUNCTION_TAILLEN 7

#endif

#define MANUAL_FUNCTION_PRELUDE 1

int init = 0;

typedef DWORD (WINAPI * _MessageBoxA) (DWORD, LPCVOID, LPCVOID, DWORD);

typedef DWORD (WINAPI * _WSASend) (SOCKET, UINT_PTR, DWORD, UINT_PTR, DWORD, UINT_PTR, UINT_PTR);

/*

BOOL CryptEncrypt(

HCRYPTKEY hKey,

HCRYPTHASH hHash,

BOOL Final,

DWORD dwFlags,

BYTE *pbData,

DWORD *pdwDataLen,

DWORD dwBufLen

);

*/

typedef DWORD (WINAPI * _CryptEncrypt) (HCRYPTKEY , HCRYPTHASH, BOOL,DWORD,BYTE *, DWORD *,DWORD);

typedef DWORD (WINAPI * _CryptDecrypt) (HCRYPTKEY , HCRYPTHASH, BOOL,DWORD,BYTE *, DWORD *,DWORD);

/*

BOOL RSAENH_CPDecrypt

(

HCRYPTPROV hProv,

HCRYPTKEY hKey,

HCRYPTHASH hHash,

BOOL Final,

DWORD dwFlags,

BYTE* pbData,

DWORD* pdwDataLen

)

*/

/*

typedef int _PyRun_SimpleString (char *);

_PyRun_SimpleString real_PyRun_SimpleString = NULL;

*/

_MessageBoxA oldMessageBox = NULL;

_CryptEncrypt oldCryptEncrypt = NULL;

_CryptDecrypt oldCryptDecrypt = NULL;

char *globalHotkeyArray[256];

int globalSleepTime = 500;

HANDLE hPacketCapture_ENCRYPT = NULL;

HANDLE hPacketCapture_DECRYPT = NULL;

/*

// okay, what's the function prelude of newmessagebox?

u $ip

shackle64!newMessageBox+0xd [c:\projects\elegurawolfe\shackle.c @ 43]:

00000001`8000100d c60061 mov byte ptr [rax],61h

00000001`80001010 ff1512360400 call qword ptr [shackle64!oldMessageBox (00000001`80044628)]

00000001`80001016 33c0 xor eax,eax

00000001`80001018 4883c428 add rsp,28h

00000001`8000101c c3 ret

// where does oldMessageBox point? this should be our function prelude

// that we control

0:000> dq 00000001`80044628

00000001`80044628 00000000`00300000 00000000`00000000

00000001`80044638 00000000`00000000 00000000`00000001

00000001`80044648 00000000`00000000 00000000`00000000

00000001`80044658 00000000`00000000 00380c33`da800000

00000001`80044668 00000001`00000000 00000000`01ce5c50

00000001`80044678 00000000`00000000 00000000`01ce5c90

00000001`80044688 00000000`00000000 00000000`00000000

00000001`80044698 00000000`00000000 00000001`80044f70

// this should be our function prelude

// but it looks broken as shit. this SHOULD be:

u 00000000`00300000

00000000`00300000 4883ec38 sub rsp,38h

00000000`00300004 4533db xor r11d,r11d

00000000`00300007 44391dea0d0200 cmp dword ptr [00000000`00320df8],r11d [ this one fucks us because it's a relative ]

00000000`0030000e ff2500000000 jmp qword ptr [00000000`00300014]

00000000`00300014 52 push rdx [ SHOULD BE QWORD READ AS DATA ]

00000000`00300015 139177000000 adc edx,dword ptr [rcx+77h]

00000000`0030001b 0000 add byte ptr [rax],al

00000000`0030001d 0000 add byte ptr [rax],al

untouched user32!MessageBoxA:

00000000`77911344 4883ec38 sub rsp,38h

00000000`77911348 4533db xor r11d,r11d

00000000`7791134b 44391dea0d0200 cmp dword ptr [USER32!gapfnScSendMessage+0x927c (00000000`7793213c)],r11d

*/

#define CL_ON_64BIT_IS_A_PIECE_OF_SHIT 1

#define LUA_MAXINPUT 512

unsigned long WINAPI newMessageBox(unsigned long hwnd,char *msg,char *title,unsigned long flags)

{

oldMessageBox(hwnd,msg,title,flags);

return 0;

}

int keyExported = 0;

#ifdef INCLUDE_NEWCRYPT

extern "C" __declspec(dllexport) BOOL __stdcall newCryptEncrypt(HCRYPTKEY key, HCRYPTHASH hash, BOOL final, DWORD flags, BYTE *buf, DWORD *buflen,DWORD dwBufLen);

extern "C" BOOL __stdcall newCryptEncrypt(HCRYPTKEY key, HCRYPTHASH hash, BOOL final, DWORD flags, BYTE *buf, DWORD *buflen,DWORD dwBufLen)

{

DWORD fuckX;

EnterCriticalSection(&packetCaptureSection);

WriteFile(hPacketCapture_ENCRYPT,buflen,4,&fuckX,NULL); // now goes over named pipe

WriteFile(hPacketCapture_ENCRYPT,buf,buflen[0],&fuckX,NULL);

if(keyExported == 0)

{

keyExported = 1;

}

LeaveCriticalSection(&packetCaptureSection);

BOOL b = oldCryptEncrypt(key,hash,final,flags,buf,buflen,dwBufLen);

return b;

}

char *keyBlob;

DWORD keyBlobLen = 1024;

extern "C" __declspec(dllexport) BOOL __stdcall newCryptDecrypt(HCRYPTKEY key, HCRYPTHASH hash, BOOL final, DWORD flags, BYTE *buf, DWORD *buflen,DWORD dwBufLen);

extern "C" BOOL __stdcall newCryptDecrypt(HCRYPTKEY key, HCRYPTHASH hash, BOOL final, DWORD flags, BYTE *buf, DWORD *buflen,DWORD dwBufLen)

{

DWORD fuckX;

BOOL b = oldCryptDecrypt(key,hash,final,flags,buf,buflen,dwBufLen);

EnterCriticalSection(&packetCaptureSection);

WriteFile(hPacketCapture_DECRYPT,buflen,4,&fuckX,NULL); // now goes over named pipe

WriteFile(hPacketCapture_DECRYPT,buf,buflen[0],&fuckX,NULL);

LeaveCriticalSection(&packetCaptureSection);

if(keyExported == 0)

{

HCRYPTPROV hProv = 0;

HCRYPTKEY hExchangeKeyPair = 0;

keyExported = 1;

keyBlob = (char *)malloc(1024);

/*

0:000:x86> dd esp

008ff0d0 67a4c46f 67c7fc08 00000000 67bf2554

008ff0e0 00000001 f0000000 68043a30 67c7c4c8

008ff0f0 00000000 00000028 77773779 07c19507

008ff100 009e0000 00000028 008ff360 00000028

008ff110 008ff368 00000150 777723b0 00000119

008ff120 00000088 02b1e6c8 fffffeb0 00000009

008ff130 fffffee7 009e04b8 00000ea0 06040002

008ff140 00000000 a90400ad 009e0270 00000003

0:000:x86> db 67bf2554

67bf2554 4d 69 63 72 6f 73 6f 66-74 20 45 6e 68 61 6e 63 Microsoft Enhanc

67bf2564 65 64 20 43 72 79 70 74-6f 67 72 61 70 68 69 63 ed Cryptographic

67bf2574 20 50 72 6f 76 69 64 65-72 20 76 31 2e 30 00 00 Provider v1.0..

67bf2584 00 00 00 00 00 00 00 00-73 23 69 3a 43 72 79 70 ........s#i:Cryp

67bf2594 74 42 69 6e 61 72 79 54-6f 53 74 72 69 6e 67 00 tBinaryToString.

67bf25a4 00 00 00 00 4e 69 69 00-73 69 3a 43 72 79 70 74 ....Nii.si:Crypt

67bf25b4 53 74 72 69 6e 67 54 6f-42 69 6e 61 72 79 00 00 StringToBinary..

67bf25c4 00 00 00 00 73 23 7c 69-00 00 00 00 43 72 79 70 ....s#|i....Cryp

*/

if(!CryptAcquireContext( &hProv, NULL, NULL, PROV_RSA_FULL, 0))

{

MessageBox(0,"Cannot acquire crypto context","fuck",MB_OK);

return b;

}

CryptGetUserKey( hProv, AT_KEYEXCHANGE, &hExchangeKeyPair);

if(CryptExportKey(key,0,7,0,(BYTE *)keyBlob,&keyBlobLen) != 0)

{

MessageBox(0,"GOT KEY!","GOT KEY!",MB_OK);

HANDLE keyDump = CreateFile("c:\\projects\\KEYBLOB.bin",GENERIC_READ|GENERIC_WRITE,0,NULL,CREATE_ALWAYS,0,NULL);

WriteFile(keyDump,keyBlob,keyBlobLen,&fuckX,NULL);

CloseHandle(keyDump);

}

else

{

MessageBox(0,"NO KEY!","NO KEY!",MB_OK);

return b;

}

}

return b;

}

#endif

// dirty hack we use to enable short patching on 64-bit

// search from the addressFromto an address with "\XC3

UINT_PTR searchForShortCave(UINT_PTR addressFrom,int minLength)

{

unsigned int maxSearchLen = 10000;

unsigned int i = 0, n = 0;

unsigned char *p = (unsigned char *)addressFrom;

UINT_PTR foundAddress = 0;

char *mbuf = (char *)malloc(1024);

// memset(mbuf,0,1024);

OutputDebugString("searching for short cave\n");

for( i = 0; i < maxSearchLen;i++)

{

/*

sprintf(mbuf,"[%02x]\00",(unsigned char )p[i]);

if( i % 16 == 0)

{

OutputDebugString("\n");

}

*/

// OutputDebugString(mbuf);

if ((unsigned char )p[i] == (unsigned char )'\xC3')

{

foundAddress = (UINT_PTR )(p + i + 1);

for(n = 1;n < minLength;n++)

{

if ( (p[i+n] != (unsigned char )'\xCC' ) && (p[i+n] != (unsigned char )'\x00') && (p[i+n] != (unsigned char )'\x90') )

{

/*

memset(mbuf,0,1024);

sprintf(mbuf," exiting search for loop at %x, [%02x]\n" , (UINT_PTR )(p + i + n), (unsigned char )(p[i+n]));

OutputDebugString(mbuf);

*/

foundAddress = 0;

}

}

if(foundAddress)

{

// OutputDebugString("\n + FOUND \n");

return (UINT_PTR )(p + i + 1);

}

}

}

return foundAddress;

}

void iathook(UINT_PTR addressFrom, UINT_PTR addressTo, UINT_PTR *saveAddress)

{

HMODULE hMods[1024];

DWORD cbNeeded = 0;

MODULEINFO modInfo;

char mbuf[1024];

UINT_PTR lpBase = 0;

HANDLE hProcess = GetCurrentProcess();

EnumProcessModules( GetCurrentProcess(), hMods, sizeof(hMods),&cbNeeded);

int i = 0;

for (; i < (cbNeeded / sizeof(HMODULE)); i++)

{

char szModName[1024];

if(GetModuleFileNameEx( hProcess,hMods[i],szModName,sizeof(szModName) / sizeof(char)) )

{

if(strstr(shortName(szModName),"exe") != NULL)

{

GetModuleInformation(hProcess,hMods[i],&modInfo,sizeof(modInfo));

lpBase = (UINT_PTR )modInfo.lpBaseOfDll;

break;

}

}

}

sprintf(mbuf," [IAT] found base at 0x%p\n",(void *)lpBase);

OutputDebugString(mbuf);

IMAGE_DOS_HEADER *imgDosHdr = (IMAGE_DOS_HEADER *)lpBase;

IMAGE_NT_HEADERS *imgNtHdrs = (IMAGE_NT_HEADERS *)(lpBase + imgDosHdr->e_lfanew);

if(imgDosHdr->e_magic != 0x5a4d)

{

OutputDebugString(" [IAT] e_magic fucked, abort, abort\n");

return;

}

if(imgNtHdrs->Signature != 0x4550)

{

OutputDebugString(" [IAT] imgNtHdrs->Signature fucked, abort, abort\n");

return;

}

OutputDebugString(" [IAT] signature checks ok, trying to find import table...\n");

IMAGE_DATA_DIRECTORY *pDataDir = ((IMAGE_DATA_DIRECTORY *)(imgNtHdrs->OptionalHeader.DataDirectory + IMAGE_DIRECTORY_ENTRY_IMPORT));

IMAGE_IMPORT_DESCRIPTOR *pImportDir = (IMAGE_IMPORT_DESCRIPTOR *)(lpBase + pDataDir->VirtualAddress);

OutputDebugString(" [IAT] got data dir + import dir\n");

IMAGE_THUNK_DATA **nameChain = (IMAGE_THUNK_DATA **)(lpBase + pImportDir->Characteristics);

UINT_PTR *funcChain = (UINT_PTR *)(lpBase + pImportDir->FirstThunk);

sprintf(mbuf," [IAT] nameChain = %p, funcChain = %p\n",nameChain,funcChain);

OutputDebugString(mbuf);

// only works with loaded functions

while(funcChain[i] != addressFrom && funcChain[i] != 0)

{

i++;

}

sprintf(mbuf," [IAT] got it - %p\n",&funcChain[i]);

OutputDebugString(mbuf);

saveAddress[0] = funcChain[i];

DWORD oldProtect;

VirtualProtect(&funcChain[i],sizeof(UINT_PTR),PAGE_READWRITE,&oldProtect);

funcChain[i] = addressTo;

VirtualProtect(&funcChain[i],sizeof(UINT_PTR),oldProtect,&oldProtect);

sprintf(mbuf," [IAT] replaced IAT pointer to %p with %p\n",(void *)saveAddress[0],(void *)addressTo);

OutputDebugString(mbuf);

return;

}

void hook(UINT_PTR addressFrom, UINT_PTR addressTo, UINT_PTR *saveAddress)

{

DWORD oldProtect = 0;

int totalSize = 0;

unsigned long long convertAddress = 0;

convertAddress = addressTo + totalSize;

int shortCutSize = 0;

shortCutSize = totalSize;

char *mbuf = (char *)VirtualAlloc(NULL,1024,MEM_RESERVE | MEM_COMMIT,PAGE_READWRITE);

int i =0;

csh capstoneHandle;

#if ARCHI == 64

cs_open(CS_ARCH_X86, CS_MODE_64, &capstoneHandle);

#else

cs_open(CS_ARCH_X86, CS_MODE_32, &capstoneHandle);

#endif

cs_insn *insn;

size_t count;

count = cs_disasm(capstoneHandle, (const uint8_t *) addressTo, FUNCTION_PATCHLEN + 15, (uint64_t)convertAddress, 0, &insn);

if(count == 0)

{

sprintf(mbuf," [HOOK] wtf (count == 0)\n");

OutputDebugString(mbuf);

return;

}

for(i = 0;i < count;i++)

{

totalSize += insn[i].size;

if(totalSize > FUNCTION_PATCHLEN)

{

break;

}

if(shortCutSize < FUNCTION_SHORTPATCH_HACK)

{

shortCutSize = totalSize;

}

}

cs_close(&capstoneHandle);

if(totalSize < FUNCTION_PATCHLEN)

{

sprintf(mbuf," [HOOK] couldn't acquire enough instructions at source address (totalSize < FUNCTION_PATCHLEN)\n");

OutputDebugString(mbuf);

return;

}

/*

DISASM *d = (DISASM *)malloc(sizeof(DISASM));

memset(d,0,sizeof(DISASM));

d->Archi = ARCHI;

d->EIP = (UIntPtr )addressFrom;

totalSize += Disasm(d);

int shortCutSize = 0;

shortCutSize = totalSize;

while(totalSize < FUNCTION_PATCHLEN)

{

d->EIP = (UIntPtr )(addressFrom + totalSize);

totalSize += Disasm(d);

if (shortCutSize < FUNCTION_SHORTPATCH_HACK)

{

shortCutSize = totalSize;

}

}

*/

//memset(mbuf,0,1024);

//sprintf(mbuf," TRYING TO PATCH %x to %x, allocating total len of %d, closest cave %x (searching for cave size %d)\n", addressFrom,addressTo,totalSize, shortCaveAddr, shortCutSize);

//OutputDebugString(mbuf);

char *codeCave = (char *)VirtualAlloc(NULL,totalSize + FUNCTION_TAILLEN,MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

DWORD unused;

VirtualProtect(codeCave,totalSize + FUNCTION_TAILLEN,PAGE_READWRITE,&oldProtect);

// what the fuck was i smoking when i wrote this shit and left it in

// let's virtualprotect right after i virtualprojtect

// fucking a you imbecile

// VirtualProtect(codeCave,totalSize + FUNCTION_TAILLEN,PAGE_READWRITE,&unused);\

UINT_PTR shortCaveAddr = searchForShortCave(addressFrom,14);

if (shortCaveAddr != 0)

{

totalSize = shortCutSize;

}

memset(codeCave,'\xCC',totalSize);

memcpy(codeCave,(LPVOID )addressFrom,totalSize);

#if ARCHI == 32

codeCave[totalSize] = '\xE9';

// codeCave[totalSize] = '\xE8'; // call, not jmp

DWORD *cp = (DWORD *)((unsigned long )codeCave + totalSize + 1);

cp[0] = (unsigned long )(addressFrom + totalSize - ((unsigned long )codeCave + totalSize + 5));

saveAddress[0] = (unsigned long )codeCave;

VirtualProtect(codeCave,totalSize + FUNCTION_TAILLEN,PAGE_EXECUTE_READ,&unused);

#else

codeCave[totalSize] = '\xFF'; // jmp [rip+0]

codeCave[totalSize + 1] = '\x25'; // or if your name is nasm

codeCave[totalSize + 2] = '\x00'; // jmp qword [rel $+0x0] then disasm / edit

codeCave[totalSize + 3] = '\x00';

codeCave[totalSize + 4] = '\x00';

codeCave[totalSize + 5] = '\x00';

UINT_PTR *cp = (UINT_PTR *)(codeCave + totalSize + 6);

cp[0] = (UINT_PTR )(addressFrom + totalSize); // no need for shitlording with relative addr here

saveAddress[0] = (UINT_PTR )codeCave;

VirtualProtect(codeCave,totalSize + FUNCTION_TAILLEN,PAGE_EXECUTE_READ,&unused);

#endif

VirtualProtect((LPVOID )addressFrom,FUNCTION_PATCHLEN,PAGE_READWRITE,&oldProtect);

memset((void *)addressFrom,'\xCC',totalSize);

char *addressFromWrite = (char *)(addressFrom);

#if ARCHI == 32

addressFromWrite[0] = '\xE9';

DWORD *p = (DWORD *)((unsigned long ) addressFromWrite + 1 );

p[0] = (DWORD )(addressTo - ((unsigned long ) addressFrom + 5));

VirtualProtect((LPVOID )addressFrom,7,oldProtect,&unused);

#else

// on 64-bit systems, search for a 14-byte cave we can jmp to within 0xFFFF

// this way, we destroy only 5 bytes of the original prelude

// greatly reducing our chances of fucking shit up.

UINT_PTR *p = 0;

if (shortCaveAddr != 0)

{

// stage 1 trampoline - E9 shortcaveaddr

// assume this is executable for now, fix this later.

addressFromWrite[0] = '\xE9';

DWORD *p1 = (DWORD *)(addressFrom + 1);

p1[0] = (DWORD )((UINT_PTR )shortCaveAddr - (UINT_PTR )addressFromWrite);

p1[0] -= 5; // offset of current 5-byte instruction =)

// stage 2 trampoline - JMP [RIP+0] DQ [absolute oldMessageBoxA]

unsigned char *shortCaveAddrWrite = (unsigned char *)shortCaveAddr;

VirtualProtect((LPVOID )shortCaveAddr,FUNCTION_PATCHLEN,PAGE_READWRITE,&unused);

shortCaveAddrWrite[0] = '\xFF';

shortCaveAddrWrite[1] = '\x25';

shortCaveAddrWrite[2] = '\x00';

shortCaveAddrWrite[3] = '\x00';

shortCaveAddrWrite[4] = '\x00';

shortCaveAddrWrite[5] = '\x00';

p = (UINT_PTR *)(shortCaveAddr + 6);

p[0] = (UINT_PTR )(addressTo);

VirtualProtect((LPVOID )shortCaveAddr,FUNCTION_PATCHLEN,PAGE_EXECUTE_READ,&unused);

VirtualProtect((LPVOID )addressFrom,FUNCTION_PATCHLEN,oldProtect,&unused);

}

else

{

addressFromWrite[0] = '\xFF';

addressFromWrite[1] = '\x25';

addressFromWrite[2] = '\x00';

addressFromWrite[3] = '\x00';

addressFromWrite[4] = '\x00';

addressFromWrite[5] = '\x00';

p = (UINT_PTR *)(addressFrom + 6);

p[0] = (UINT_PTR )(addressTo);

VirtualProtect((LPVOID )addressFrom,14,oldProtect,&unused);

}

#endif

/*

hook structure:

hookFrom: E9 addressTo

addressTo: our function

codeCave is the new function

*/

memset(mbuf,0,1024);

#if ARCHI == 32

sprintf(mbuf,"* [32-BIT] [0x%p] HOOKED %02x %02x%02x%02x%02x (0x%p)\n",(void *)(UINT_PTR )addressFrom,

(unsigned char )addressFromWrite[0],

(unsigned char )addressFromWrite[1],

(unsigned char )addressFromWrite[2],

(unsigned char )addressFromWrite[3],

(unsigned char )addressFromWrite[4],

(void *)(UINT_PTR )addressTo);

#else

if(shortCaveAddr != 0)

{

sprintf(mbuf,"* [64-BIT] [0x%p] %02x%02x%02x%02x%02x%02x %02x%02x%02x%02x%02x%02x%02x%02x (0x%p)\n",(void *)(UINT_PTR )addressFrom,

(unsigned char )addressFromWrite[0],

(unsigned char )addressFromWrite[1],

(unsigned char )addressFromWrite[2],

(unsigned char )addressFromWrite[3],

(unsigned char )addressFromWrite[4],

(unsigned char )addressFromWrite[5], // PATCH GOES HERE

(unsigned char )addressFromWrite[6],

(unsigned char )addressFromWrite[7],

(unsigned char )addressFromWrite[8],

(unsigned char )addressFromWrite[9],

(unsigned char )addressFromWrite[10],

(unsigned char )addressFromWrite[12],

(unsigned char )addressFromWrite[13],

(unsigned char )addressFromWrite[14],

(void *)(UINT_PTR )addressTo);

}

else

{

sprintf(mbuf,"* [64-BIT] [0x%p] HOOKED-SHORTCAVE %02x %02x%02x%02x%02x (0x%p)\n",(void *)(UINT_PTR )addressFrom,

(unsigned char )addressFromWrite[0],

(unsigned char )addressFromWrite[1],

(unsigned char )addressFromWrite[2],

(unsigned char )addressFromWrite[3],

(unsigned char )addressFromWrite[4],

(void *)(UINT_PTR )shortCaveAddr);

}

#endif

OutputDebugString(mbuf);

VirtualFree(mbuf,0,MEM_RELEASE);

return;

}

DWORD threadId = 0;

DWORD threadId_hotkeys = 0;

int isMyTEBFucked(){

MessageBox(0,"Teb test","hello2",MB_OK);

return 0;

}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)

{

if((fdwReason == DLL_PROCESS_ATTACH && init == 0) || fdwReason == DLL_MAGICMIRROR)

{

init = 1;

SYSTEMTIME lt = {0};

char *fnameBuf[1024];

GetLocalTime(&lt);

/*

sprintf crashes here, but other things poop themsleves too.

0:001> dd esp

01b7e9ac 01b7e9cc 01c9b474 00000013 00000026

01b7e9bc 000407e4 000c0000 00260013 02730024

01b7e9cc 00003231 c35dd2ce 01b7eaec 00f51e98

01b7e9dc 00000003 0100017c 764fc7c8 0000331c

01b7e9ec 000000ec ef5abb88 00000002 01489f50

01b7e9fc ef5ab87c 01b7ea6c 77e493ea 01b7eaec

01b7ea0c 01b7ea98 01b7ea48 01b7ea44 01b7ea34

01b7ea1c 01b7ea3c 00000000 01b7eb5c 01b7ebd4

*/

char *p = (char *)malloc(1024);

sprintf((char *)fnameBuf,"c:\\projects\\packetlog-%02d:%02d.log",lt.wHour,lt.wMinute);

/*

if(fdwReason == DLL_MAGICMIRROR)

{

__asm{

int 3

}

}

*/

OutputDebugString(" - shackle dll loaded, deploying stealth\n");

#ifdef THROWBRICKS

MODULEINFO mi;

GetModuleInformation(GetCurrentProcess(),hinstDLL,&mi,sizeof(mi));

DWORD oldProtect = 0;

IMAGE_DOS_HEADER *imgDosHdr = (IMAGE_DOS_HEADER *)mi.lpBaseOfDll;

IMAGE_NT_HEADERS *imgNtHdrs = (IMAGE_NT_HEADERS *)(imgDosHdr + imgDosHdr->e_lfanew);

OutputDebugString(" - throwing bricks at the window for a bit...\n");

VirtualProtect(mi.lpBaseOfDll,1,PAGE_READWRITE,&oldProtect);

imgDosHdr->e_magic = 0;

imgDosHdr->e_lfanew = 0;

VirtualProtect(mi.lpBaseOfDll,1,oldProtect,&oldProtect);

VirtualProtect((LPVOID )(imgNtHdrs),1,PAGE_READWRITE,&oldProtect);

imgNtHdrs->Signature = 0;

VirtualProtect((LPVOID )(imgNtHdrs),1,oldProtect,&oldProtect);

#endif

OutputDebugString(" - creating server thread\n");

HANDLE hThread = CreateThread(NULL,0,IPCServerThread,NULL,0,&threadId);

return TRUE;

}

return TRUE;

}

DWORD WINAPI IPCServerThread( LPVOID lpParam )

{

char *mbuf = (char *)malloc(1024);

char *pipeName = (char *)malloc(1024);

__registerThread(GetCurrentThreadId());

// cuz im a hipster too

for(;;)

{

BOOL fConnected = FALSE;

DWORD dwThreadId = 0;

HANDLE hPipe = INVALID_HANDLE_VALUE, hThread = NULL;

memset(pipeName,0,1024);

sprintf(pipeName,"\\\\.\\pipe\\shackle-%d",GetCurrentProcessId());

hPipe = CreateNamedPipe(pipeName,PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT, PIPE_UNLIMITED_INSTANCES, 1024,1024, 0 , NULL);

if (hPipe == INVALID_HANDLE_VALUE)

{

memset(mbuf,0,1024);

sprintf(mbuf," CreateNamedPipe failed, GLE = %d\n",GetLastError());

OutputDebugString(mbuf);

break;

}

fConnected = ConnectNamedPipe(hPipe,NULL) ? TRUE : (GetLastError() == ERROR_PIPE_CONNECTED);

if (fConnected)

{

hThread = CreateThread( NULL, 0, IPCServerInstance, (LPVOID) hPipe, 0, &dwThreadId);

if (hThread == NULL)

{

memset(mbuf,0,1024);

sprintf(mbuf," CreateThread (listener instance) failed, GLE = %d\n",GetLastError());

OutputDebugString(mbuf);

break;

}

else

{

// don't need to track this.

CloseHandle(hThread);

}

}

else

{

CloseHandle(hPipe);

}

}

free(pipeName);

free(mbuf);

__unregisterThread(GetCurrentThreadId());

return 0;

}

#define lua_saveline(L,line) { (void)L; (void)line; }

#define lua_freeline(L,b) { (void)L; (void)b; }

static int incomplete (lua_State *L, int status) {

if (status == LUA_ERRSYNTAX) {

size_t lmsg;

const char *msg = lua_tolstring(L, -1, &lmsg);

if (lmsg >= marklen && strcmp(msg + lmsg - marklen, EOFMARK) == 0) {

lua_pop(L, 1);

return 1;

}

}

return 0; /* else... */

}

static int addreturn (lua_State *L) {

const char *line = lua_tostring(L, -1); /* original line */

const char *retline = lua_pushfstring(L, "return %s;", line);

int status = luaL_loadbuffer(L, retline, strlen(retline), "=stdin");

if (status == LUA_OK) {

lua_remove(L, -2); /* remove modified line */

if (line[0] != '\0') /* non empty? */

lua_saveline(L, line); /* keep history */

}

else

lua_pop(L, 2); /* pop result from 'luaL_loadbuffer' and modified line */

return status;

}

static int pushline (lua_State *L, int firstline, HANDLE hPipe, int *exitToLoop) {

// what kind of crackhead programming is this shit

char buffer[LUA_MAXINPUT];

char *b = buffer;

size_t l;

char *prmt = "IGNORED-PUSHLINE";

int readstatus = lua_readline(L, b, prmt, hPipe, exitToLoop);

if (readstatus == 0)

return 0; /* no input (prompt will be popped by caller) */

lua_pop(L, 1); /* remove prompt */

l = strlen(b);

if (l > 0 && b[l-1] == '\n') /* line ends with newline? */

b[--l] = '\0'; /* remove it */

if (firstline && b[0] == '=') /* for compatibility with 5.2, ... */

lua_pushfstring(L, "return %s", b + 1); /* change '=' to 'return' */

else

lua_pushlstring(L, b, l);

lua_freeline(L, b);

return 1;

}

static int multiline (lua_State *L, HANDLE hPipe, int *exitToLoop) {

for (;;) { /* repeat until _s a complete statement */

size_t len;

const char *line = lua_tolstring(L, 1, &len); /* get what it has */

int status = luaL_loadbuffer(L, line, len, "=stdin"); /* try it */

if (!incomplete(L, status) || !pushline(L, 0, hPipe, exitToLoop) || *exitToLoop == 1) {

OutputDebugString("+fucked+\n");

lua_saveline(L, line); /* keep history */

return status; /* cannot or should not try to add continuation line */

}

lua_pushliteral(L, "\n"); /* add newline... */

lua_insert(L, -2); /* ...between the two lines */

lua_concat(L, 3); /* join them */

}

}

int lua_readline(lua_State *L, char *buf, char *prompt, HANDLE hPipe, int *exitIoLoop)

{

char mbuf[1024];

BOOL fSuccess = FALSE;

DWORD cbBytesRead = 0;

fSuccess = ReadFile(hPipe,buf,LUA_MAXINPUT,&cbBytesRead,NULL);

if (!fSuccess || cbBytesRead == 0)

{

memset(mbuf,0,1024);

sprintf(mbuf," [ERR] read failed, gle=%d\n",GetLastError());

OutputDebugString(mbuf);

*exitIoLoop = 1;

return 0;

}

return 1;

}

static int msghandler (lua_State *L) {

const char *msg = lua_tostring(L, 1);

if (msg == NULL) { /* is error object not a string? */

if (luaL_callmeta(L, 1, "__tostring") && /* does it have a metamethod */

lua_type(L, -1) == LUA_TSTRING) /* that produces a string? */

return 1; /* that is the message */

else

msg = lua_pushfstring(L, "(error object is a %s value)",

luaL_typename(L, 1));

}

luaL_traceback(L, L, msg, 1); /* append a standard traceback */

return 1; /* return the traceback */

}

static void lstop (lua_State *L, lua_Debug *ar) {

(void)ar; /* unused arg. */

lua_sethook(L, NULL, 0, 0); /* reset hook */

luaL_error(L, "interrupted!");

}

lua_State *globalL = NULL;

static void laction (int i) {

signal(i, SIG_DFL); /* if another SIGINT happens, terminate process */

lua_sethook(globalL, lstop, LUA_MASKCALL | LUA_MASKRET | LUA_MASKCOUNT, 1);

}

static int docall (lua_State *L, int narg, int nres) {

int status;

int base = lua_gettop(L) - narg; /* function index */

lua_pushcfunction(L, msghandler); /* push message handler */

lua_insert(L, base); /* put it under function and args */

globalL = L; /* we need to mutex this shit */

signal(SIGINT, laction); /* set C-signal handler */

status = lua_pcall(L, narg, nres, base);

signal(SIGINT, SIG_DFL); /* reset C-signal handler */

lua_remove(L, base); /* remove message handler from the stack */

return status;

}

static int loadline (lua_State *L, HANDLE hPipe, int *exitToLoop) {

int status;

lua_settop(L, 0);

if (!pushline(L, 1, hPipe, exitToLoop))

return -1; /* no input */

if ((status = addreturn(L)) != LUA_OK) /* 'return ...' did not work? */

status = multiline(L,hPipe,exitToLoop); /* try as command, maybe with continuation lines */

lua_remove(L, 1); /* remove line from the stack */

lua_assert(lua_gettop(L) == 1);

return status;

}

int filter(unsigned int code, struct _EXCEPTION_POINTERS *ep)

{

puts("in filter.");

if (code == EXCEPTION_ACCESS_VIOLATION)

{

puts("caught AV as expected.");

return EXCEPTION_EXECUTE_HANDLER;

}

else

{

puts("didn't catch AV, unexpected.");

return EXCEPTION_CONTINUE_SEARCH;

};

}

static int cs_deref(lua_State *L)

{

lua_getglobal(L,"__hpipe");

HANDLE hPipe = (HANDLE )(UINT_PTR )lua_tointeger(L,-1);

lua_pop(L,1);

if(lua_gettop(L) == 1)

{

__try{

UINT_PTR *data_addr = (UINT_PTR *)lua_tointeger(L,1);

lua_pushinteger(L,data_addr[0]);

return 1;

}

__except(filter(GetExceptionCode(), GetExceptionInformation())){

outString(hPipe," [ERR] deref failed\n");

return 0;

}

}

else

{

outString(hPipe," [ERR] deref(data_addr) takes 1 argument\n");

return 0;

}

}

// grabs the "this" pointer out of a jump.

static int cs_catchthis(lua_State *L)

{

lua_getglobal(L,"__hpipe");

HANDLE hPipe = (HANDLE )(UINT_PTR )lua_tointeger(L,-1);

lua_pop(L,1);

#ifdef ARCHI_64

outString(hPipe," [ERR] catchthis not supported in 64-bit architecture (yet!)\n");

return 0;

#endif

char mbuf[256];

if(lua_gettop(L) == 2)

{

if(lua_isinteger(L,1) && lua_isinteger(L,2))

{

UINT_PTR call_addr = (UINT_PTR )lua_tointeger(L,1);

UINT_PTR save_addr = (UINT_PTR )lua_tointeger(L,2);

char *codeCave = (char *)VirtualAlloc(NULL,12,MEM_COMMIT | MEM_RESERVE,PAGE_READWRITE);

sprintf(mbuf," [NFO] 12 bytes code cave allocated at %p\n",(void *)codeCave);

if(codeCave == NULL)

{

sprintf(mbuf," [ERR] VirtualAlloc failed\n");

outString(hPipe,mbuf);

return 0;

}

UINT_PTR old_prelude = 0;

hook(call_addr,(UINT_PTR )codeCave,&old_prelude);

int writeHead = 0;

// 89 0D 00 10 40 00

codeCave[writeHead++] = '\x89';

codeCave[writeHead++] = '\x0D';

((UINT_PTR *)((UINT_PTR )codeCave + writeHead))[0] = save_addr;

writeHead += 4;

codeCave[writeHead++] = '\x68';

((UINT_PTR *)((UINT_PTR )codeCave + writeHead))[0] = old_prelude;

writeHead += 4;

codeCave[writeHead++] = '\xC3';

sprintf(mbuf," [NFO] VirtualProtect to PAGE_EXECUTE_READ\n");

outString(hPipe,mbuf);

DWORD discard;

VirtualProtect((LPVOID )codeCave,12,PAGE_EXECUTE_READ,&discard);

return 0;

// outString(hPipe,mbuf);

}

else

{

outString(hPipe," [ERR] catchthis(func_ptr,save_loc) needs 2 integer arguments\n");

return 0;

}

}

else

{

outString(hPipe," [ERR] catchthis(func_ptr,save_loc) needs 2 integer arguments\n");

return 0;

}

return 0;

}

typedef UINT_PTR (WINAPI * _call_noargs) ();

static int cs_call(lua_State *L)

{

lua_getglobal(L,"__hpipe");

HANDLE hPipe = (HANDLE )(UINT_PTR )lua_tointeger(L,-1);

lua_pop(L,1);

char mbuf[256];

UINT_PTR ping_addr = NULL;

#ifdef ARCHI_64

sprintf(mbuf," [ERR] flexible call not supported in 64-bit architecture (yet!)\n");

outString(hPipe,mbuf);

return 0;

#endif

UINT_PTR call_addr = 0;

UINT_PTR retval;

if(lua_gettop(L) == 1)

{