local ffi = require("ffi")
ffi.cdef[[
typedef void VOID;
typedef VOID* LPVOID;
typedef uintptr_t ULONG_PTR;
typedef unsigned long DWORD;
typedef int BOOL;
BOOL MessageBoxA(void* hWnd, const char* lpText, const char* lpCaption, DWORD uType);
typedef struct _PROCESSENTRY32 {
DWORD dwSize;
DWORD cntUsage;
DWORD th32ProcessID;
ULONG_PTR th32DefaultHeapID;
DWORD th32ModuleID;
DWORD cntThreads;
DWORD th32ParentProcessID;
long pcPriClassBase;
DWORD dwFlags;
char szExeFile[260];
} PROCESSENTRY32;
]]
local MB_ICONERROR = 0x00000010
local debug_patterns = {
"wireshark","fiddler","httpdebugger","httpdebuggersvc","charles","burp","ollydbg","ida","idag","idaw","ida64","ida32",
"x32dbg","x64dbg","cheatengine","cheat engine","processhacker","process hacker","dumper_protected","scylla","scylla_x64",
"scylla_x86","hxd","pe-bear","megadumper","dbgview","debugview","reclass","resourcehacker","de4dot","ghidra","dump",
"dumper","protected","dumperr","ekrn","egui","eset_proxy_srv","ehttpSrv","ePowerShellHelper","eaProxySrv","proxy",
"hook","inject","sniffer","analyzer","reverse","decompiler","capstone","frida","npcap","winpcap","SystemInformer",
"KSystemInformer","kprocesshacker","extreme","hacker","extremeinjector","dnspy","ilspy","jetbrain"
}
local proxy_addr = client.find_signature("client.dll", "\x51\xC3") or error("Failed to find proxy signature")
local get_mod = client.find_signature("client.dll", "\xC6\x06\x00\xFF\x15\xCC\xCC\xCC\xCC\x50") or error("Failed to find GetModuleHandle signature")
local get_mod_addr = ffi.cast("void***", ffi.cast("char*", get_mod)+5)[0][0]
local get_proc = client.find_signature("client.dll", "\x50\xFF\x15\xCC\xCC\xCC\xCC\x85\xC0\x0F\x84\xCC\xCC\xCC\xCC\x6A\x00") or error("Failed to find GetProcAddress signature")
local get_proc_addr = ffi.cast("void***", ffi.cast("char*", get_proc)+3)[0][0]
local get_mod_proxy = ffi.cast("uintptr_t(__thiscall*)(void*,const char*)", proxy_addr)
local get_proc_proxy = ffi.cast("uintptr_t(__thiscall*)(void*,uintptr_t,const char*)", proxy_addr)
local kernel32 = get_mod_proxy(get_mod_addr, "kernel32.dll")
local CreateToolhelp32Snapshot = get_proc_proxy(get_proc_addr, kernel32, "CreateToolhelp32Snapshot")
local Process32First = get_proc_proxy(get_proc_addr, kernel32, "Process32First")
local Process32Next = get_proc_proxy(get_proc_addr, kernel32, "Process32Next")
local CloseHandle = get_proc_proxy(get_proc_addr, kernel32, "CloseHandle")
local snap_proxy = ffi.cast("uintptr_t(__thiscall*)(uintptr_t,DWORD,DWORD)", proxy_addr)
local first_proxy = ffi.cast("int(__thiscall*)(uintptr_t,uintptr_t,void*)", proxy_addr)
local next_proxy = ffi.cast("int(__thiscall*)(uintptr_t,uintptr_t,void*)", proxy_addr)
local close_proxy = ffi.cast("int(__thiscall*)(uintptr_t,uintptr_t)", proxy_addr)
local user32 = get_mod_proxy(get_mod_addr, "user32.dll")
local MessageBoxA = ffi.cast("int(__stdcall*)(void*,const char*,const char*,DWORD)", get_proc_proxy(get_proc_addr, user32, "MessageBoxA"))
local function instant_kill()
client.exec("quit")
for i = 1, 50 do
MessageBoxA(nil, "Unauthorized tool detected", "loader", MB_ICONERROR)
end
ffi.C.exit(1)
end
local function check_debuggers()
local snapshot = snap_proxy(CreateToolhelp32Snapshot, 0x2, 0)
if snapshot == -1 then return false end
local pe = ffi.new("PROCESSENTRY32")
pe.dwSize = ffi.sizeof(pe)
if first_proxy(Process32First, snapshot, pe) ~= 0 then
repeat
local name = ffi.string(pe.szExeFile):lower()
for _, pat in ipairs(debug_patterns) do
if name:find(pat, 1, true) then
instant_kill()
end
end
until next_proxy(Process32Next, snapshot, pe) == 0
end
close_proxy(CloseHandle, snapshot)
return false
end
client.set_event_callback("paint", function()
if globals.tickcount() % 32 == 0 then check_debuggers() end
end)
check_debuggers()
local function create_sandbox()
local old = load
return {
safe_load = function(code, name)
if check_debuggers() then os.exit() end
local env = setmetatable({}, {__index = function(_, k) if k == "_G" or k == "package" then error() end return _G[k] end, __newindex = rawset})
return old(code, name, "t", env)
end
}
end
if check_debuggers() then return end
