Last active
May 22, 2025 04:29
-
-
Save stugmi/af005d6e175e0ca492a9e94bd1b0d375 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // import std.stdio : write, readln; | |
| // import std.conv; | |
| import core.stdc.stdio : printf, fgets, stdin, getchar; | |
| import core.stdc.string : strlen, memset; | |
| pragma(inline, true); | |
| int main() | |
| { | |
| removePEHeader(); | |
| changeSizeOfImage(); | |
| if (neekDetected()) | |
| { | |
| printf("neek detected.. %d\n", neekDetected()); | |
| return 1; | |
| } | |
| printf("Answer: "); | |
| char[] buff = new char[50]; | |
| fgets(buff.ptr, cast(int) buff.length, stdin); | |
| buff = buff[0 .. strlen(buff.ptr) - 1]; | |
| // Local file including the answer | |
| import answers; | |
| if (buff == answer_player92){ | |
| printf("Congrats!"); | |
| } else { | |
| printf("Wrong answer!"); | |
| } | |
| getchar(); | |
| return 0; | |
| } | |
| pragma(inline, true); | |
| int checkSizeOfImage() | |
| { | |
| int sizeOfImage=0; | |
| asm { | |
| // Grab and push PEB to stack | |
| mov EAX, FS:[0x30] ; | |
| mov EAX, [EAX + 0x0c] ; // PEB_LDR_DATA | |
| mov EAX, [EAX + 0x0c] ; // InOrderModuleList | |
| mov EAX, [EAX + 0x20] ; // sizeOfImage | |
| mov sizeOfImage, EAX ; | |
| } | |
| return sizeOfImage; | |
| } | |
| pragma(inline, true); | |
| void changeSizeOfImage() | |
| { | |
| asm { | |
| mov EAX, FS:[0x30] ; // Getting PEB | |
| mov EAX, [EAX + 0x0c] ; // PEB_LDR_DATA | |
| mov EAX, [EAX + 0x0c] ; // inOrderModuleList | |
| mov dword ptr [EAX + 0x20], 0x100000 ; // Changing sizeOfImage to newSize | |
| } | |
| } | |
| pragma(inline, true); | |
| int neekDetected() | |
| { | |
| import std.stdint : int16_t; | |
| int dongs; | |
| asm pure @nogc { | |
| // mov EAX, FS:[0x18] ; // TEB | |
| // mov EAX, [EAX+0x30] ; // PED | |
| mov EAX, FS:[0x30] ; // PED | |
| mov EAX, [EAX+0x02] ; // BeingDebugged BOOL | |
| mov dongs, EAX ; // | |
| } | |
| return cast(int16_t)dongs; | |
| } | |
| pragma(inline, true); | |
| void removePEHeader() | |
| { | |
| import core.sys.windows.windows : GetModuleHandle, VirtualProtect, DWORD, PAGE_READWRITE; | |
| DWORD loldongs = 0; | |
| char* baseAddr = cast(char*)GetModuleHandle(null); | |
| VirtualProtect(baseAddr, 4096, PAGE_READWRITE, &loldongs); | |
| memset(baseAddr, 0, baseAddr.sizeof); | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment