forked from xFGhoul/PythonProtector
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathdump.py
More file actions
71 lines (55 loc) · 1.98 KB
/
Copy pathdump.py
File metadata and controls
71 lines (55 loc) · 1.98 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
"""
____ ____ __ __
/ __ \\ __ __ / __ \\ _____ ____ / /_ ___ _____ / /_
/ /_/ // / / // /_/ // ___// __ \\ / __// _ \\ / ___// __/
/ ____// /_/ // ____// / / /_/ // /_ / __// /__ / /_
/_/ \\__, //_/ /_/ \\____/ \\__/ \\___/ \\___/ \\__/
/____/
Made With ❤️ By Ghoul & Marci
"""
import ctypes
import win32api
from ctypes import WinDLL
from ctypes import wintypes
from ..types import Event, Logger
from ..abc import Module
from ..utils.webhook import Webhook
class AntiDump(Module):
def __init__(
self, webhook: Webhook, logger: Logger, exit: bool, report: bool, event: Event
) -> None:
self.webhook: Webhook = webhook
self.logger: Logger = logger
self.exit: bool = exit
self.report: bool = report
self.event: Event = event
self.kernel32: WinDLL = ctypes.windll.kernel32
self.ntdll: WinDLL = ctypes.windll.ntdll
@property
def name(self) -> str:
return "Anti Dump"
@property
def version(self) -> float:
return 1.0
def ErasePEHeaderFromMemory(self) -> None:
"""
Erases PE Header From Memory
"""
oldProtect = wintypes.DWORD(0)
baseAddress = ctypes.c_int(win32api.GetModuleHandle(None))
self.kernel32.VirtualProtect(
ctypes.pointer(baseAddress), 4096, 0x04, ctypes.pointer(oldProtect)
)
ctypes.memset(ctypes.pointer(baseAddress), 4096, ctypes.sizeof(baseAddress))
self.event.dispatch(
["pe_header_erased"], "PE Header Erased From Memory", self.name
)
def StartChecks(self) -> None:
if self.report:
self.logger.info("Starting Anti Dump")
if self.report:
self.logger.info("Erasing PE Header From Memory")
self.ErasePEHeaderFromMemory()
if self.report:
self.logger.info("PE Header Erased From Memory")
self.logger.info("Finished Anti Dump")