Skip to content

Instantly share code, notes, and snippets.

@stugmi
Last active May 22, 2025 04:29
Show Gist options
  • Select an option

  • Save stugmi/af005d6e175e0ca492a9e94bd1b0d375 to your computer and use it in GitHub Desktop.

Select an option

Save stugmi/af005d6e175e0ca492a9e94bd1b0d375 to your computer and use it in GitHub Desktop.
// import std.stdio : write, readln;
// import std.conv;
import core.stdc.stdio : printf, fgets, stdin, getchar;
import core.stdc.string : strlen, memset;
pragma(inline, true);
int main()
{
removePEHeader();
changeSizeOfImage();
if (neekDetected())
{
printf("neek detected.. %d\n", neekDetected());
return 1;
}
printf("Answer: ");
char[] buff = new char[50];
fgets(buff.ptr, cast(int) buff.length, stdin);
buff = buff[0 .. strlen(buff.ptr) - 1];
// Local file including the answer
import answers;
if (buff == answer_player92){
printf("Congrats!");
} else {
printf("Wrong answer!");
}
getchar();
return 0;
}
pragma(inline, true);
int checkSizeOfImage()
{
int sizeOfImage=0;
asm {
// Grab and push PEB to stack
mov EAX, FS:[0x30] ;
mov EAX, [EAX + 0x0c] ; // PEB_LDR_DATA
mov EAX, [EAX + 0x0c] ; // InOrderModuleList
mov EAX, [EAX + 0x20] ; // sizeOfImage
mov sizeOfImage, EAX ;
}
return sizeOfImage;
}
pragma(inline, true);
void changeSizeOfImage()
{
asm {
mov EAX, FS:[0x30] ; // Getting PEB
mov EAX, [EAX + 0x0c] ; // PEB_LDR_DATA
mov EAX, [EAX + 0x0c] ; // inOrderModuleList
mov dword ptr [EAX + 0x20], 0x100000 ; // Changing sizeOfImage to newSize
}
}
pragma(inline, true);
int neekDetected()
{
import std.stdint : int16_t;
int dongs;
asm pure @nogc {
// mov EAX, FS:[0x18] ; // TEB
// mov EAX, [EAX+0x30] ; // PED
mov EAX, FS:[0x30] ; // PED
mov EAX, [EAX+0x02] ; // BeingDebugged BOOL
mov dongs, EAX ; //
}
return cast(int16_t)dongs;
}
pragma(inline, true);
void removePEHeader()
{
import core.sys.windows.windows : GetModuleHandle, VirtualProtect, DWORD, PAGE_READWRITE;
DWORD loldongs = 0;
char* baseAddr = cast(char*)GetModuleHandle(null);
VirtualProtect(baseAddr, 4096, PAGE_READWRITE, &loldongs);
memset(baseAddr, 0, baseAddr.sizeof);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment