wolfcod/core-win32

Reset of /hackedteam/core-win32

Hi there 👋

core-win32's Issues

IPC communication

IPC communication is designed around a shared memory used in a different context (hooks => agent, agent => asp, agent => social, social => agent).

Every channel is designed from scratch, with different logic.

demo version

Everything related to a build in DEMO version must be enabled when in "config" there is a "BUILD_DEMO_VERSION" flag enabled.

extensive use of cpu

in the core project, there are at least 16 threads running at the same time, and most of them are awakened at fixed intervals of time, check some external conditions, and go back to sleep.

• MonitorUSBThread
• MonitorVMThread
• CapturePasswordThread
• MonitorSkypePM
• FastActionsThread
• RepeatThread
• FastActionsThread
• SM_MonitorEvents
• MonitorWindowsEvent
• MonitorConnection
• MonitorProcesses
• QuotaMonitorThread
• MonitorScreenSaver
• TimerMonitorDates
• MonitorUserIdles
• MonitorNewWindowThread
• MonitorFormatStatus

FNC(x)

A typical pattern is quite common in source code.

Any function you want to "obfuscate" from the external analysis is accessed via a FNC macro, which looks into a shared list with a valid pointer associated with the string.

This MACRO needs for each function a fixed name (as a result of obfuscation), a pointer to the original function, and a resolver.
It is not available in debug (so you are forced also in debug mode to run it step by step).

assembly stub

Assembly stubs must be removed and replaced with C code which can be compiled in a properly way in 32 and 64bit.