Get HWID:
Code:
void getHWID()
{
// GetVolumeInformationA
DWORD DriveSerial;
// GetComputerNameA
TCHAR ComputerName[MAX_COMPUTERNAME_LENGTH + 1];
DWORD size = sizeof(ComputerName) / sizeof(ComputerName[0]);
// OS GUID
HW_PROFILE_INFO hwProfileInfo;
DWORD OsGUID;
GetVolumeInformationA(0, nullptr, '\0', &DriveSerial, nullptr, nullptr, nullptr, 0);
GetComputerNameA(ComputerName, &size);
GetCurrentHwProfileA(&hwProfileInfo);
memcpy(&OsGUID, &hwProfileInfo.szHwProfileGuid, sizeof(hwProfileInfo.szHwProfileGuid));
//UserDriveSerial = to_string(DriveSerial);
UserComputerName = ComputerName;
UserOsGUID = to_string(OsGUID);
string Messer = "2134[sl";
UserCombineHWID = Messer + UserComputerName + UserOsGUID;
}
Hasher:
Code:
#define A 54059
#define B 45963
#define C 86264
#define FIRSTH 37
using namespace std;
unsigned hash_str(const char* s)
{
unsigned h = FIRSTH;
while (*s) {
h = (h * A) ^ (s[0] * B);
s++;
}
return h; // or return h % C;
}
SelfDestruct (Need It For Anti Debug) :
Code:
void SelfDestruct()
{
std::vector<char*> explosion;
while (true)
explosion.push_back(new char[10000]);
}
Blue Screen (Need It For BlackListed Users):
Code:
void BSODBaby()
{
typedef long (WINAPI *RtlSetProcessIsCritical)
(BOOLEAN New, BOOLEAN *Old, BOOLEAN NeedScb);
auto ntdll = LoadLibraryA("ntdll.dll");
if (ntdll) {
auto SetProcessIsCritical = (RtlSetProcessIsCritical)
GetProcAddress(ntdll, "RtlSetProcessIsCritical");
if (SetProcessIsCritical)
SetProcessIsCritical(1, 0, 0);
}
}
Debugger Checks:
Code:
typedef void(*_recurse)();
void recurse1(); void recurse2();
void recurse3(); void recurse4();
void recurse5();
_recurse recfuncs[5] = {
&recurse1, &recurse2, &recurse3,
&recurse4, &recurse5
};
void recurse1() { recfuncs[rand() % 5](); }
void recurse2() { recfuncs[(rand() % 3) + 2](); }
void recurse3()
{
if (rand() % 100 < 50) recurse1();
else recfuncs[(rand() % 3) + 1]();
}
void recurse4() { recfuncs[rand() % 2](); }
void recurse5()
{
for (int i = 0; i < 100; i++)
if (rand() % 50 == 1)
recfuncs[i % 5]();
recurse5();
}
bool HasHardwareBreakpoints()
{
CONTEXT ctx = { 0 };
ct*****ntextFlags = CONTEXT_DEBUG_REGISTERS;
auto hThread = GetCurrentThread();
if (GetThreadContext(hThread, &ctx) == 0)
return false;
return (ctx.Dr0 != 0 || ctx.Dr1 != 0 || ctx.Dr2 != 0 || ctx.Dr3 != 0);
}
bool DebuggerDriversPresent()
{
// an array of common debugger driver device names
const char drivers[9][20] = {
"\\\\.\\EXTREM", "\\\\.\\ICEEXT",
"\\\\.\\NDBGMSG.VXD", "\\\\.\\RING0",
"\\\\.\\SIWVID", "\\\\.\\SYSER",
"\\\\.\\TRW", "\\\\.\\SYSERBOOT",
"\0"
};
for (int i = 0; drivers[i][0] != '\0'; i++) {
auto h = CreateFileA(drivers[i], 0, 0, 0, OPEN_EXISTING, 0, 0);
if (h != INVALID_HANDLE_VALUE)
{
CloseHandle(h);
return true;
}
}
return false;
}
inline bool IsDbgPresentPrefixCheck()
{
__try
{
__asm __emit 0xF3 // 0xF3 0x64 disassembles as PREFIX REP:
__asm __emit 0x64
__asm __emit 0xF1 // One byte INT 1
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
return false;
}
return true;
}
inline bool Int2DCheck()
{
__try
{
__asm
{
int 0x2d
xor eax, eax
add eax, 2
}
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
return false;
}
return true;
}
inline bool Has2DBreakpointHandler()
{
__try { __asm INT 0x2D }
__except (EXCEPTION_EXECUTE_HANDLER) { return false; }
return true;
}
inline bool Has03BreakpointHandler()
{
__try { __asm INT 0x03 }
__except (EXCEPTION_EXECUTE_HANDLER) { return false; }
return true;
}
inline void ErasePEHeaderFromMemory()
{
DWORD OldProtect = 0;
// Get base address of module
char *pBaseAddr = (char*)GetModuleHandle(NULL);
// Change memory protection
VirtualProtect(pBaseAddr, 4096, // Assume x86 page size
PAGE_READWRITE, &OldProtect);
// Erase the header
ZeroMemory(pBaseAddr, 4096);
}
void CheckForDebuggers()
{
if (HasHardwareBreakpoints() || DebuggerDriversPresent() || HasHardwareBreakpoints() || IsDbgPresentPrefixCheck() || Has2DBreakpointHandler() || Int2DCheck() || Has03BreakpointHandler() || IsDebuggerPresent())
{
ErasePEHeaderFromMemory();
recurse1();
//DebugSelf();
SelfDestruct();
OutputDebugString("%s%s%s%s");
exit(1);
}
}
How To Check HWID / BlackList People:
CheckForDebuggers() << Checks Debuggers
hash_str(UserCombineHWID.c_str()) << Hashes HWID
Code:
else if (hash_str(UserCombineHWID.c_str()) == <BlackListedShitters>)
{
BSODBaby();
recurse1();
SelfDestruct();
exit(1);
}
^^ BlackList Users ^^
Side Note:
- Pack It With Enigma (They make it so that the code also only be unpacked if called or almost being called ) ( Every packed things gets unpacked bits by bits while running in memory)
- Hardcoding The HWID Will Be Better As The Only Ways To Bypass The Anti Debuggers Methods Is By A Professional Or Emulator, So Hardcode Will Work Better
- This Is Not My Codes, Credits Goes To The Internet And Books I Read
Books To Read To Further Understand How This Works:
- Game Hacking
- Gray Hat Hacking - 4th Edition
- Hacking The Art Of Exploitation
Books Will Be Attached Below, Leave A Thanks If This Helped
Virus
htt ps:// ww w.virustotal. com/en/file/9c6d33333e98166b67b37c6e3ff48ffe8d25520e4968430bde c09be413ef9212/analysis/1499571729/
http s:// virusscan.jotti. org/en-GB/filescanjob/6xbtq0c3ig
i did not use some of the functions right, as the fake exceptions, no time to fix it now, sorry