/*
DETACH FARTHER - METHOD RICARDO - VER 0.1
AUTHOR: BENINA
Modified hipu' Script by BENINA (HTTP://REAONLINE.NET/FORUM)

Armadillo script - detach parent from client and unpack (1000 bytes method Ricardo) 

Debugging Option: Ignore custom exceptions: 0EEDFDE;C0000001..C0009898;80000004

hipu said:

MAKE SURE ALL BREAKPOINTS ARE DELETED BEFORE EXECUTING THE SCRIPT!!! 

ALSO: since im using the IsDebuggerPresent plugin, i didnt do IsDebuggerPresent patch.
do whatever is needed if u dont use the plugin...

Thanz to Ricardo,Tenketsu and hipu

*/


//////////////////////////
// To declare vars
/////////////////////////

var WaitForDebugEvent
var WriteProcessMemory
var pDebugEvent
var pBuffer
var child_ProcID
var oep_offset1
var oep_offset2
var oep_offset3
var crypto_proc
var child_OEP
var patched_line1
var imgbase
var rdata_begin
var text_begin
var text_patch
var tb_report1
var tb_report2
var tb_report3
var tb_report4
var tb_report5
var tb_report6
var addr_1000
var buffer_1000
var temp
var temp1

//////////////////////////////////////
// Find rdata_begin or (data_begin)
/////////////////////////////////////

gmi eip,MODULEBASE
mov imgbase, $RESULT 
mov rdata_begin, imgbase
find rdata_begin, #4441544100#  //find "DATA" string
cmp $RESULT,0
jne lbcontinue

find rdata_begin, #2E726461746100#  //find ".rdata" string
cmp $RESULT,0
jne lbcontinue

find rdata_begin, #2E6461746100#  //find ".data" string
cmp $RESULT,0
jne lbcontinue
jmp no_run_script
lbcontinue:
mov rdata_begin, $RESULT 
add rdata_begin, 0c
mov rdata_begin, [rdata_begin]
add rdata_begin, imgbase
log rdata_begin

/////////////////////////////////
// Find text_begin
////////////////////////////////


gmi eip,MODULEBASE
mov imgbase, $RESULT 
mov text_begin, imgbase
find text_begin, #434F444500#  //find "CODE" string
cmp $RESULT,0
jne lbcontinue2

find text_begin, #2E7465787400#  //find ".text" string
cmp $RESULT,0
jne lbcontinue2
jmp no_run_script

lbcontinue2:

mov text_begin, $RESULT 
add text_begin, 0c
mov text_begin, [text_begin]
add text_begin, imgbase
log text_begin


/////////////////////////////////////////////////////
//eob found_WaitForDebugEvent WriteProcessMemory
////////////////////////////////////////////////////

gpa "WaitForDebugEvent", "kernel32.dll" 
mov WaitForDebugEvent, $RESULT
gpa "WriteProcessMemory", "kernel32.dll" 
mov WriteProcessMemory, $RESULT


///////////////////////////////////////
//Armadillo check bp first 5 bytes so:
///////////////////////////////////////


add WriteProcessMemory,5
bp WriteProcessMemory
run
bc WriteProcessMemory
sub WriteProcessMemory,5


//////////////////////////////////////////////
//Get infomation at bp Call WaitForDebugEvent
/////////////////////////////////////////////


bp WaitForDebugEvent
run
bc WaitForDebugEvent


mov pDebugEvent, esp
add pDebugEvent, 04
mov pDebugEvent, [pDebugEvent]
log pDebugEvent

mov oep_offset1, pDebugEvent
add oep_offset1, 18
mov oep_offset2, pDebugEvent
add oep_offset2, 24
mov oep_offset3, pDebugEvent
add oep_offset3, 28

////////////////////////////////////////
// Find Child_ProcID and child_OEP
///////////////////////////////////////

bp WriteProcessMemory
run
bc WriteProcessMemory



mov child_ProcID, pDebugEvent
add child_ProcID, 4
mov child_ProcID, [child_ProcID]
mov child_OEP, [oep_offset1]

///////////////////////////////////
//Save info Table report 
///////////////////////////////////


mov tb_report1,[pDebugEvent]

mov tb_report2,pDebugEvent
add tb_report2,4
mov tb_report2,[tb_report2]

mov tb_report3,pDebugEvent
add tb_report3,8
mov tb_report3,[tb_report3]

mov tb_report4,pDebugEvent
add tb_report4,C
mov tb_report4,[tb_report4]

mov tb_report5,pDebugEvent
add tb_report5,10
mov tb_report5,[tb_report5]

mov tb_report6,pDebugEvent
add tb_report6,14
mov tb_report6,[tb_report6]

////////////////////////////////////////////////////
//Get info in stack at bp Call WriteProcessMemory
///////////////////////////////////////////////////


mov addr_1000,esp
add addr_1000,8
mov addr_1000,[addr_1000]
log addr_1000

mov buffer_1000,esp
add buffer_1000,C
mov buffer_1000,[buffer_1000]
log buffer_1000

/////////////////////////////////
//Patch OEP of Son to EBFE 
/////////////////////////////////

mov temp,child_OEP
sub temp,addr_1000
add temp,buffer_1000
mov temp1,[temp]

and temp1,FFFF
eval "Bytes patched at OEP of Son (to invert the bytes order)  : {temp1}"
msg $RESULT
log $RESULT

fill temp,1,eb
add temp,1
fill temp,1,fe



///////////////////////////
// FIND ENCRYPTOR
///////////////////////////

mov crypto_proc, esp
add crypto_proc, 128
mov crypto_proc, [crypto_proc]
add crypto_proc, 2d0
mov [crypto_proc], #9090909090#
rtr	//ctrl-f9
sto	//f8


///////////////////////
//Log info to win log
//////////////////////

log "crypto_proc was nopped..."
log "patched OEP of child process to EBFE"
log child_ProcID
log child_OEP




log "press script/resume when ready"
eval "Patched successful OEP={child_OEP} of child process (PID= {child_ProcID}) to EBFE !!!!.More Info in Window Log.Press button OK to continues!"
msg $RESULT


////////////////////////////////////////////////////////////////
//Patch jump to section .text and NOPs call WaitForDebugEvent
///////////////////////////////////////////////////////////////

bp WaitForDebugEvent
run
bc WaitForDebugEvent

mov patched_line1, [esp]
sub patched_line1, 12

fill patched_line1, 12, 90
add patched_line1,14

eval "jmp {text_begin}"
asm patched_line1,$RESULT

add patched_line1,5
eval "NOP"
asm patched_line1,$RESULT 

//////////////////////////////////////
//Patch in section .text (or CODE)
//////////////////////////////////////

mov text_patch, text_begin

eval "add dword [{oep_offset1}],1000"
asm text_patch,$RESULT

add text_patch,A
eval "add dword [{oep_offset2}],1000"
asm text_patch,$RESULT

add text_patch,A
eval "add dword [{oep_offset3}],1000"
asm text_patch,$RESULT

add text_patch,A
eval "cmp dword [{oep_offset3}],{rdata_begin}"
asm text_patch,$RESULT

add text_patch,A
eval "jnz {patched_line1}"
asm text_patch,$RESULT

add text_patch,6
eval "push {child_ProcID}"
asm text_patch,$RESULT

add text_patch,5
eval "CALL DebugActiveProcessStop"
asm text_patch,$RESULT

add text_patch,5
eval "NOP"
asm text_patch,$RESULT

//////////////////////////////
//Patch in Table report at :
//////////////////////////////

sub text_begin,1000
mov [oep_offset1], text_begin
mov [oep_offset2], text_begin
mov [oep_offset3], text_begin

//////////////////////////////////
//go [esp](New origin here)
///////////////////////////////////
mov eip, [esp]


//////////////////////////
// Set bp F2 at
/////////////////////////

bp text_patch
run
bc text_patch

msg "Successful!.Close OllyDbg, execute again and attach to your newely created process.More Info in Window Log. Have fun."
jmp theend

//////////////////////////////////
no_run_script:
msg "This srcipt don't run with this file. Plz Close Olly.Sorry!"


///////////////////////////////
theend:
ret

<?php
session_start();

if(!$db = @mysql_connect('localhost', '', '')) {
	die('Connection error');
}
if(!@mysql_select_db('netforce', $db)) {
	die('Can\'t locate database');
}

if(isset($send) && $send == 'reg' && !isset($_SESSION['Data'])) {
	if(isset($username) && isset($password)) {
		$username = htmlspecialchars($username);
		$password = htmlspecialchars($password);
	
		mysql_query("INSERT INTO challenge_406 (id, username, password, ip) VALUES (NULL, '$username', '$password','$_SERVER[REMOTE_ADDR]')") or die('Error!');
	
		$Data['username'] = $username;
		$Data['password'] = $password;
		
		session_register('Data');
	
		echo 'You are added to our database! Click <a href="index.php"><b>here</b></a> to proceed!<br /><br />';
	}
} else if(isset($submit) && $submit == 'Login' && !isset($_SESSION['Data'])) {
	if(isset($username) && isset($password)) {
		$username = addslashes($username);
		$password = addslashes($password);
		
		$checkinfo = mysql_query("SELECT * FROM challenge_406 WHERE username='$username' AND password='$password'") or die('Error!');
		$Data = mysql_fetch_array($checkinfo);

		if($Data['id'] == '') {
			die('Wrong password!');
		} else {
			session_register('Data');
			header('Location: index.php');
		}
	}
} else if(isset($action) && $action == 'register') {
	
?>
<html>
<head>
<title>Register</title>
</head>
<body>

<h3>Register now!</h3>
<form action="index.php" method="post">
<p>
Username:<br />
<input type="text" name="username" size="25" maxlength="12"><br />
Password:<br />
<input type="text" name="password" size="25" maxlength="12"><br />
<input type="hidden" name="send" value="reg">
<input type="submit" value="Register">
</p>
</form>

</body>
</html>

<?php

} else if(isset($action) && $action == 'logout') {
	session_destroy();
	header('location: index.php');
} else if(isset($_SESSION['Data'])) {
	$sesname = $_SESSION['Data']['username'];
	$sespass = $_SESSION['Data']['password'];
	
	$checkinfo = mysql_query("SELECT id FROM challenge_406 WHERE username='$sesname' AND password='$sespass'") or die('Error!');
	$checkit = mysql_fetch_array($checkinfo);
	
	if($checkit['id'] == '') {
		die('Wrong password!');
	} else {
		if($Data['level'] == '') {
			$Data['level'] = '0';
		}

		echo '<p>Welcome to our protected website!</p>';
		echo '<ul>';
		echo '<li>Username: '.$Data['username'].'</li>';
		echo '<li>Admin Level: '.$Data['level'].'</li>';
		echo '<li><a href="index.php?action=logout">Logout.</a></li>';
		echo '</ul>';
		
		if($Data['level'] == '8') {
			echo 'Well done! The solution is: [...]';
		}
  }
} else {

?>
<html>
<head>
<title>Login</title>
</head>
<body>

<h3>Login!</h3>
<p>
Not yet a member? <a href="index.php?action=register">Register a new account.</a><br />
</p>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
<p>
Username:<br />
<input type="text" name="username" size="25" maxlength="12"><br />
Password:<br />
<input type="text" name="password" size="25" maxlength="12"><br />
<input type="submit" name="submit" value="Login">
</p>
</form>

</body>
</html>

<?
}
?>

HWINEVENTHOOK ventanas = FuncionSetWinEventHook(EVENT_SYSTEM_FOREGROUND,EVENT_SYSTEM_FOREGROUND,
		NULL,FuncionHookVentanas,0,0,WINEVENT_OUTOFCONTEXT | WINEVENT_SKIPOWNPROCESS);

extern "C" __declspec(dllexport) void RegistrarCambiosDeVentana
	(HWINEVENTHOOK hWinEventHook, DWORD dwEvento, HWND ventana, LONG idObjeto, LONG idDescendiente, DWORD dwEventThread, DWORD dwMsEventTime) 
{
	if (idObjeto != OBJID_WINDOW || idDescendiente != 0) {
		return;
	}
	//if (ventana == NULL) return;
	ventana = GetForegroundWindow();
	int error = GetLastError();
	if (error == 0) {
		char strError[15] = { 0 } ;
		_itoa_s(error,strError,10);
		MessageBoxA(NULL,strError,"DLL",MB_OK);
	}
	char * strventana = (char*)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,GetWindowTextLengthA(ventana)*sizeof(char)+1);
	GetWindowTextA(ventana,strventana,strlen(strventana)+1);
	MessageBoxA(NULL,strventana,"DLL",MB_OK);
	HeapFree(GetProcessHeap(),HEAP_ZERO_MEMORY,strventana);
}

char * IPPublica()
{
	WSAData wsaData;
	SOCKET Socket = INVALID_SOCKET;
	int codigo_error = 0;
	struct addrinfo *resultado = NULL,
					*actual = NULL,
					pistas;
	char * ip = (char*)HeapAlloc(GetProcessHeap(),sizeof(char),513);
	ZeroMemory(&ip,512);
	char solicitud[512] = 
		"POST /Tracking/Tracker.php HTTP/1.1\r\n"
		"User-Agent: Mozilla/4.0\r\n"
		"Host: 127.0.0.1\r\n"
		"Accept: */*\r\n"
		"Cache-Control: no-cache\r\n"
		"Content-Type: application/x-www-form-urlencoded\r\n"
		"Content-Lenght: 4\r\n"
		"ip=1\r\n";
	codigo_error = FuncionWSAStartup(MAKEWORD(1,1),&wsaData);
	if (codigo_error != 0) {
		FuncionMessageBox(NULL,"Error al inicializar WSA1,1","prueba",MB_OK);
		FuncionWSACleanup();
		return NULL;
	}
	ZeroMemory(&pistas,sizeof(pistas));
	pistas.ai_family = AF_UNSPEC;
	pistas.ai_socktype = SOCK_STREAM;
	pistas.ai_protocol = IPPROTO_TCP;

	codigo_error = FuncionGetAddrInfo("127.0.0.1","80",&pistas,&resultado);
	if (codigo_error != 0 ) {
		FuncionMessageBox(NULL,"Error al obtener el nombre del host","prueba",MB_OK);
		FuncionWSACleanup();
		return NULL;
	}
	for (actual = resultado; actual != NULL; actual = actual->ai_next)
	{
		Socket = FuncionSocket(actual->ai_family,actual->ai_socktype,actual->ai_protocol);
		if (Socket == INVALID_SOCKET) {
			FuncionMessageBox(NULL,"Fallo el socket","prueba",MB_OK);
			FuncionWSACleanup();
			return NULL;
		}
		codigo_error = FuncionConnect(Socket,actual->ai_addr,(int)actual->ai_addrlen);
		if (codigo_error == SOCKET_ERROR)	{
			FuncionCloseSocket(Socket);
			Socket = INVALID_SOCKET;
			continue;
		}
		break;
	}
	FuncionFreeAddrInfo(resultado);
	
	codigo_error = FuncionSend(Socket,solicitud,strlen(solicitud),0);
	if (codigo_error == SOCKET_ERROR) {
		FuncionMessageBox(NULL,"Error al enviar","Prueba",MB_OK);
		FuncionCloseSocket(Socket);
		FuncionWSACleanup();
		return NULL;
	}
	codigo_error = FuncionShutdown(Socket,SD_SEND);
	do {
		codigo_error = FuncionRecv(Socket,ip,512,0);
		FuncionMessageBox(NULL,ip,"Prueba",MB_OK);
		if (codigo_error >0)
			FuncionMessageBox(NULL,"Recibiedo..","Prueba",MB_OK);
		else if (codigo_error==0)
			FuncionMessageBox(NULL,"Conexion cerrada..","Prueba",MB_OK);
		else {
			char error[10] = "";
			_itoa_s(FuncionWSAGetLastError(),error,10);
			FuncionMessageBox(NULL,error,"Prueba",MB_OK);
		}
	} while(codigo_error > 0);
	FuncionCloseSocket(Socket);
	FuncionWSACleanup();
	return ip;
}

char * IDInstalacion() 
{
	HKEY llave;
	BYTE * retornar = NULL;
	long resultado;
	resultado = FuncionRegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Cryptography",0,KEY_QUERY_VALUE,&llave);
	if (resultado != ERROR_SUCCESS) {
		FuncionMessageBox(NULL,"Error al abrir la llave de registro","Pruebas",MB_OK);
	}
	DWORD largo = 0;
	resultado = FuncionRegQueryValueEx(llave,TEXT("MachineGuid"),NULL,NULL,NULL,&largo);
	retornar = (BYTE*)HeapAlloc(GetProcessHeap(),sizeof(TCHAR),largo+1);
	resultado = FuncionRegQueryValueEx(llave,TEXT("MachineGuid"),NULL,NULL,retornar,&largo);
	char codigo_de_error[512];
	_ltoa_s(resultado,codigo_de_error,10);
	if (resultado != ERROR_SUCCESS){ 
		FuncionMessageBox(NULL,codigo_de_error,"Pruebas",MB_OK);
	}
	return (char*)retornar;
}

#include <windows.h>
#include <stdio.h>
#include <tchar.h>
#define MAXIMO_NOMBRE_LLAVE 16384 // 16383 + '\0'
#define MAXIMO_VALOR_LLAVE 256 // 255 + '\0'
void listar_software_instalado() 
{
	HKEY llave;
	TCHAR buffer[512] = "";
	DWORD largo_buffer;// = MAX_PATH;

	DWORD retcode = RegOpenKey(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",&llave);
	if (retcode != ERROR_SUCCESS) {
		printf("Error al abrir la llave\n");
		return;
	}
	DWORD cantidad_de_subclases = 0;
	retcode = RegQueryInfoKey(
					llave,
					buffer,
					&largo_buffer,
					NULL,
					&cantidad_de_subclases,
					//NULL,
					NULL,
					NULL,
					NULL,
					NULL,
					NULL,
					NULL,
					NULL
	);
	if (retcode != ERROR_SUCCESS) {
		printf("RegQueryInfoKey -> error: %d\n",retcode);
		return;
	}
	DWORD indice = 0;
	printf("Cantidad de subclases encontradas: %d\n",cantidad_de_subclases);
	/*for (indice = 0 ; indice < cantidad_de_subclases ; indice++) {
		printf("Software instalado encontrado (%d)\n",indice);				
	}*/
	RegCloseKey(llave);
}