|
// Simplified logic for the SendMsg Hook
signed int __stdcall Hooked_SendMsg(void* pClient, char* pData, uint32_t dwSize) {
uint16_t packetSize = *(uint16_t*)pData;
uint16_t packetType = *(uint16_t*)(pData + 2);
char* payload = pData + 4;
if (packetType == 0x0421) {
// REPLACE: Use hardcoded donor hardware ID packet
memcpy(payload, donor_0421_payload, donor_0421_size);
return Original_SendMsg(pClient, pData, donor_0421_size + 4);
}
if (packetType == 0x041B) {
// 1. Extract Key Material (Timestamp + Password Hash)
// 2. Derive AES Key: MD5(TS + Pass + TS + Magic)
// 3. Decrypt Field 6 (the 64-byte blob)
AES_128_CBC_Decrypt(field6_ptr, decrypted_blob, derived_key, iv);
// 4. SPOOF: Overwrite machine-specific bytes in the decrypted struct
memcpy(decrypted_blob + 16, "00:11:22:33:44:55", 17); // Spoof MAC
memcpy(decrypted_blob + 32, "DESKTOP-GHOST", 13); // Spoof Hostname
*(uint32_t*)(decrypted_blob + 12) = 0; // Force VM Flags to 0
// 5. Re-encrypt and replace in the buffer
AES_128_CBC_Encrypt(decrypted_blob, field6_ptr, derived_key, iv);
}
return Original_SendMsg(pClient, pData, dwSize);
}
That look right
|