forked from vxunderground/MalwareSourceCode
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Showing
809 changed files
with
149,115 additions
and
1,594 deletions.
There are no files selected for viewing
Binary file not shown.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
252 changes: 252 additions & 0 deletions
252
Win32/Proof of Concepts/AtomBombingInjection/.gitignore
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,252 @@ | ||
| ## Ignore Visual Studio temporary files, build results, and | ||
| ## files generated by popular Visual Studio add-ons. | ||
|
|
||
| # User-specific files | ||
| *.suo | ||
| *.user | ||
| *.userosscache | ||
| *.sln.docstates | ||
|
|
||
| # User-specific files (MonoDevelop/Xamarin Studio) | ||
| *.userprefs | ||
|
|
||
| # Build results | ||
| [Dd]ebug/ | ||
| [Dd]ebugPublic/ | ||
| [Rr]elease/ | ||
| [Rr]eleases/ | ||
| x64/ | ||
| x86/ | ||
| bld/ | ||
| [Bb]in/ | ||
| [Oo]bj/ | ||
| [Ll]og/ | ||
|
|
||
| # Visual Studio 2015 cache/options directory | ||
| .vs/ | ||
| # Uncomment if you have tasks that create the project's static files in wwwroot | ||
| #wwwroot/ | ||
|
|
||
| # MSTest test Results | ||
| [Tt]est[Rr]esult*/ | ||
| [Bb]uild[Ll]og.* | ||
|
|
||
| # NUNIT | ||
| *.VisualState.xml | ||
| TestResult.xml | ||
|
|
||
| # Build Results of an ATL Project | ||
| [Dd]ebugPS/ | ||
| [Rr]eleasePS/ | ||
| dlldata.c | ||
|
|
||
| # DNX | ||
| project.lock.json | ||
| artifacts/ | ||
|
|
||
| *_i.c | ||
| *_p.c | ||
| *_i.h | ||
| *.ilk | ||
| *.meta | ||
| *.obj | ||
| *.pch | ||
| *.pdb | ||
| *.pgc | ||
| *.pgd | ||
| *.rsp | ||
| *.sbr | ||
| *.tlb | ||
| *.tli | ||
| *.tlh | ||
| *.tmp | ||
| *.tmp_proj | ||
| *.log | ||
| *.vspscc | ||
| *.vssscc | ||
| .builds | ||
| *.pidb | ||
| *.svclog | ||
| *.scc | ||
|
|
||
| # Chutzpah Test files | ||
| _Chutzpah* | ||
|
|
||
| # Visual C++ cache files | ||
| ipch/ | ||
| *.aps | ||
| *.ncb | ||
| *.opendb | ||
| *.opensdf | ||
| *.sdf | ||
| *.cachefile | ||
| *.VC.db | ||
| *.VC.VC.opendb | ||
|
|
||
| # Visual Studio profiler | ||
| *.psess | ||
| *.vsp | ||
| *.vspx | ||
| *.sap | ||
|
|
||
| # TFS 2012 Local Workspace | ||
| $tf/ | ||
|
|
||
| # Guidance Automation Toolkit | ||
| *.gpState | ||
|
|
||
| # ReSharper is a .NET coding add-in | ||
| _ReSharper*/ | ||
| *.[Rr]e[Ss]harper | ||
| *.DotSettings.user | ||
|
|
||
| # JustCode is a .NET coding add-in | ||
| .JustCode | ||
|
|
||
| # TeamCity is a build add-in | ||
| _TeamCity* | ||
|
|
||
| # DotCover is a Code Coverage Tool | ||
| *.dotCover | ||
|
|
||
| # NCrunch | ||
| _NCrunch_* | ||
| .*crunch*.local.xml | ||
| nCrunchTemp_* | ||
|
|
||
| # MightyMoose | ||
| *.mm.* | ||
| AutoTest.Net/ | ||
|
|
||
| # Web workbench (sass) | ||
| .sass-cache/ | ||
|
|
||
| # Installshield output folder | ||
| [Ee]xpress/ | ||
|
|
||
| # DocProject is a documentation generator add-in | ||
| DocProject/buildhelp/ | ||
| DocProject/Help/*.HxT | ||
| DocProject/Help/*.HxC | ||
| DocProject/Help/*.hhc | ||
| DocProject/Help/*.hhk | ||
| DocProject/Help/*.hhp | ||
| DocProject/Help/Html2 | ||
| DocProject/Help/html | ||
|
|
||
| # Click-Once directory | ||
| publish/ | ||
|
|
||
| # Publish Web Output | ||
| *.[Pp]ublish.xml | ||
| *.azurePubxml | ||
| # TODO: Comment the next line if you want to checkin your web deploy settings | ||
| # but database connection strings (with potential passwords) will be unencrypted | ||
| *.pubxml | ||
| *.publishproj | ||
|
|
||
| # Microsoft Azure Web App publish settings. Comment the next line if you want to | ||
| # checkin your Azure Web App publish settings, but sensitive information contained | ||
| # in these scripts will be unencrypted | ||
| PublishScripts/ | ||
|
|
||
| # NuGet Packages | ||
| *.nupkg | ||
| # The packages folder can be ignored because of Package Restore | ||
| **/packages/* | ||
| # except build/, which is used as an MSBuild target. | ||
| !**/packages/build/ | ||
| # Uncomment if necessary however generally it will be regenerated when needed | ||
| #!**/packages/repositories.config | ||
| # NuGet v3's project.json files produces more ignoreable files | ||
| *.nuget.props | ||
| *.nuget.targets | ||
|
|
||
| # Microsoft Azure Build Output | ||
| csx/ | ||
| *.build.csdef | ||
|
|
||
| # Microsoft Azure Emulator | ||
| ecf/ | ||
| rcf/ | ||
|
|
||
| # Windows Store app package directories and files | ||
| AppPackages/ | ||
| BundleArtifacts/ | ||
| Package.StoreAssociation.xml | ||
| _pkginfo.txt | ||
|
|
||
| # Visual Studio cache files | ||
| # files ending in .cache can be ignored | ||
| *.[Cc]ache | ||
| # but keep track of directories ending in .cache | ||
| !*.[Cc]ache/ | ||
|
|
||
| # Others | ||
| ClientBin/ | ||
| ~$* | ||
| *~ | ||
| *.dbmdl | ||
| *.dbproj.schemaview | ||
| *.pfx | ||
| *.publishsettings | ||
| node_modules/ | ||
| orleans.codegen.cs | ||
|
|
||
| # Since there are multiple workflows, uncomment next line to ignore bower_components | ||
| # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) | ||
| #bower_components/ | ||
|
|
||
| # RIA/Silverlight projects | ||
| Generated_Code/ | ||
|
|
||
| # Backup & report files from converting an old project file | ||
| # to a newer Visual Studio version. Backup files are not needed, | ||
| # because we have git ;-) | ||
| _UpgradeReport_Files/ | ||
| Backup*/ | ||
| UpgradeLog*.XML | ||
| UpgradeLog*.htm | ||
|
|
||
| # SQL Server files | ||
| *.mdf | ||
| *.ldf | ||
|
|
||
| # Business Intelligence projects | ||
| *.rdl.data | ||
| *.bim.layout | ||
| *.bim_*.settings | ||
|
|
||
| # Microsoft Fakes | ||
| FakesAssemblies/ | ||
|
|
||
| # GhostDoc plugin setting file | ||
| *.GhostDoc.xml | ||
|
|
||
| # Node.js Tools for Visual Studio | ||
| .ntvs_analysis.dat | ||
|
|
||
| # Visual Studio 6 build log | ||
| *.plg | ||
|
|
||
| # Visual Studio 6 workspace options file | ||
| *.opt | ||
|
|
||
| # Visual Studio LightSwitch build output | ||
| **/*.HTMLClient/GeneratedArtifacts | ||
| **/*.DesktopClient/GeneratedArtifacts | ||
| **/*.DesktopClient/ModelManifest.xml | ||
| **/*.Server/GeneratedArtifacts | ||
| **/*.Server/ModelManifest.xml | ||
| _Pvt_Extensions | ||
|
|
||
| # Paket dependency manager | ||
| .paket/paket.exe | ||
| paket-files/ | ||
|
|
||
| # FAKE - F# Make | ||
| .fake/ | ||
|
|
||
| # JetBrains Rider | ||
| .idea/ | ||
| *.sln.iml |
31 changes: 31 additions & 0 deletions
31
Win32/Proof of Concepts/AtomBombingInjection/AtomBombing.sln
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
|
|
||
| Microsoft Visual Studio Solution File, Format Version 12.00 | ||
| # Visual Studio 2013 | ||
| VisualStudioVersion = 12.0.40629.0 | ||
| MinimumVisualStudioVersion = 10.0.40219.1 | ||
| Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "AtomBombing", "AtomBombing\AtomBombing.vcxproj", "{D303FA55-CFF8-4484-888A-F06B21559014}" | ||
| ProjectSection(ProjectDependencies) = postProject | ||
| {DAD3D2B2-372F-4486-91FA-032CC0AA1133} = {DAD3D2B2-372F-4486-91FA-032CC0AA1133} | ||
| EndProjectSection | ||
| EndProject | ||
| Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "AtomBombingShellcode", "AtomBombingShellcode\AtomBombingShellcode.vcxproj", "{DAD3D2B2-372F-4486-91FA-032CC0AA1133}" | ||
| EndProject | ||
| Global | ||
| GlobalSection(SolutionConfigurationPlatforms) = preSolution | ||
| Debug|Win32 = Debug|Win32 | ||
| Release|Win32 = Release|Win32 | ||
| EndGlobalSection | ||
| GlobalSection(ProjectConfigurationPlatforms) = postSolution | ||
| {D303FA55-CFF8-4484-888A-F06B21559014}.Debug|Win32.ActiveCfg = Release|Win32 | ||
| {D303FA55-CFF8-4484-888A-F06B21559014}.Debug|Win32.Build.0 = Release|Win32 | ||
| {D303FA55-CFF8-4484-888A-F06B21559014}.Release|Win32.ActiveCfg = Release|Win32 | ||
| {D303FA55-CFF8-4484-888A-F06B21559014}.Release|Win32.Build.0 = Release|Win32 | ||
| {DAD3D2B2-372F-4486-91FA-032CC0AA1133}.Debug|Win32.ActiveCfg = Release|Win32 | ||
| {DAD3D2B2-372F-4486-91FA-032CC0AA1133}.Debug|Win32.Build.0 = Release|Win32 | ||
| {DAD3D2B2-372F-4486-91FA-032CC0AA1133}.Release|Win32.ActiveCfg = Release|Win32 | ||
| {DAD3D2B2-372F-4486-91FA-032CC0AA1133}.Release|Win32.Build.0 = Release|Win32 | ||
| EndGlobalSection | ||
| GlobalSection(SolutionProperties) = preSolution | ||
| HideSolutionNode = FALSE | ||
| EndGlobalSection | ||
| EndGlobal |
58 changes: 58 additions & 0 deletions
58
Win32/Proof of Concepts/AtomBombingInjection/AtomBombing/AtomBombing.vcxproj
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| <?xml version="1.0" encoding="utf-8"?> | ||
| <Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> | ||
| <ItemGroup Label="ProjectConfigurations"> | ||
| <ProjectConfiguration Include="Release|Win32"> | ||
| <Configuration>Release</Configuration> | ||
| <Platform>Win32</Platform> | ||
| </ProjectConfiguration> | ||
| </ItemGroup> | ||
| <PropertyGroup Label="Globals"> | ||
| <ProjectGuid>{D303FA55-CFF8-4484-888A-F06B21559014}</ProjectGuid> | ||
| <Keyword>Win32Proj</Keyword> | ||
| <RootNamespace>AtomBombing</RootNamespace> | ||
| </PropertyGroup> | ||
| <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> | ||
| <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> | ||
| <ConfigurationType>Application</ConfigurationType> | ||
| <UseDebugLibraries>false</UseDebugLibraries> | ||
| <PlatformToolset>v120</PlatformToolset> | ||
| <WholeProgramOptimization>true</WholeProgramOptimization> | ||
| <CharacterSet>Unicode</CharacterSet> | ||
| </PropertyGroup> | ||
| <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> | ||
| <ImportGroup Label="ExtensionSettings"> | ||
| </ImportGroup> | ||
| <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> | ||
| <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> | ||
| </ImportGroup> | ||
| <PropertyGroup Label="UserMacros" /> | ||
| <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> | ||
| <LinkIncremental>false</LinkIncremental> | ||
| </PropertyGroup> | ||
| <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> | ||
| <ClCompile> | ||
| <WarningLevel>Level4</WarningLevel> | ||
| <PrecompiledHeader> | ||
| </PrecompiledHeader> | ||
| <Optimization>Disabled</Optimization> | ||
| <FunctionLevelLinking>true</FunctionLevelLinking> | ||
| <IntrinsicFunctions>true</IntrinsicFunctions> | ||
| <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions> | ||
| <RuntimeLibrary>MultiThreaded</RuntimeLibrary> | ||
| <BufferSecurityCheck>false</BufferSecurityCheck> | ||
| </ClCompile> | ||
| <Link> | ||
| <SubSystem>Console</SubSystem> | ||
| <GenerateDebugInformation>true</GenerateDebugInformation> | ||
| <EnableCOMDATFolding>true</EnableCOMDATFolding> | ||
| <OptimizeReferences>true</OptimizeReferences> | ||
| <AdditionalDependencies>ntdll.lib;%(AdditionalDependencies)</AdditionalDependencies> | ||
| </Link> | ||
| </ItemDefinitionGroup> | ||
| <ItemGroup> | ||
| <ClCompile Include="main.cpp" /> | ||
| </ItemGroup> | ||
| <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> | ||
| <ImportGroup Label="ExtensionTargets"> | ||
| </ImportGroup> | ||
| </Project> |
22 changes: 22 additions & 0 deletions
22
Win32/Proof of Concepts/AtomBombingInjection/AtomBombing/AtomBombing.vcxproj.filters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| <?xml version="1.0" encoding="utf-8"?> | ||
| <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> | ||
| <ItemGroup> | ||
| <Filter Include="Source Files"> | ||
| <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier> | ||
| <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions> | ||
| </Filter> | ||
| <Filter Include="Header Files"> | ||
| <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier> | ||
| <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions> | ||
| </Filter> | ||
| <Filter Include="Resource Files"> | ||
| <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier> | ||
| <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions> | ||
| </Filter> | ||
| </ItemGroup> | ||
| <ItemGroup> | ||
| <ClCompile Include="main.cpp"> | ||
| <Filter>Source Files</Filter> | ||
| </ClCompile> | ||
| </ItemGroup> | ||
| </Project> |
Oops, something went wrong.