xusheng6

@echo off
setlocal

set "LABDIR=C:\byotc-comodo"
if not exist "%LABDIR%" mkdir "%LABDIR%"
copy /y D:\ccekrnl.dat "%LABDIR%\ccekrnl.dat" >nul
copy /y D:\ccekrnl_probe.exe "%LABDIR%\ccekrnl_probe.exe" >nul

echo === Pre-load control (device access should fail) ===
"%LABDIR%\ccekrnl_probe.exe"

xusheng6

@echo off
setlocal
del /q C:\Users\Public\byotc_huorong_result.txt 2>nul
echo Running bounded Huorong SysDiag/ActMon BYOTC probe...
D:\huorong_sysdiag_actmon_injector.exe
echo.
echo === C:\Users\Public\byotc_huorong_result.txt ===
type C:\Users\Public\byotc_huorong_result.txt 2>nul
echo.
pause

xusheng6

@echo off
setlocal
set "DRIVER=%~dp0AToolsKrnl64.sys"
set "RESULT=C:\Users\Public\atool_byotc_result.txt"

sc.exe stop AToolsKrnl >nul 2>&1
sc.exe delete AToolsKrnl >nul 2>&1
sc.exe create AToolsKrnl type= kernel start= demand binPath= "%DRIVER%"
if errorlevel 1 goto service_failed
sc.exe start AToolsKrnl

xusheng6

#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <stdio.h>

#ifndef TRUSTED_CLIENT
#define TRUSTED_CLIENT L"C:\\Program Files (x86)\\360\\Total Security\\QHSafeMain.exe"
#endif
#define PAYLOAD_PATH L"E:\\360_byotc_payload.dll"
#define RESULT_PATH L"C:\\Users\\Public\\byotc_360_result.txt"

xusheng6

@echo off
setlocal

copy /y "%~dp0hmpalert_gate_service_probe.exe" "C:\Users\Public\hmpalert_gate_service_probe.exe"
copy /y "%~dp0hmpalert_gate_service_probe.exe" "C:\Users\Public\hmpalert.exe"

del /q "C:\Users\Public\hmp_service_gate_hmpalert_gate_service_probe.exe.txt" 2>nul
del /q "C:\Users\Public\hmp_service_gate_hmpalert.exe.txt" 2>nul

sc create BYOTC-HMP-Negative type= own start= demand binPath= "C:\Users\Public\hmpalert_gate_service_probe.exe"

xusheng6

typedef unsigned char uint8_t;
typedef unsigned short uint16_t;
typedef unsigned short wchar_t;
typedef unsigned int uint32_t;
typedef unsigned long DWORD;
typedef unsigned long long uint64_t;
typedef long long int64_t;
typedef long NTSTATUS;
typedef int BOOL;
typedef void *HANDLE;

xusheng6

from dataclasses import dataclass

@dataclass
class Instr:
    startTime: str
    instrType: str
    ip: int
    addr: int
    size: int
    value: int

xusheng6

import brotli
import zipfile
import os

archive_path = 'data-63cebb7cb7e3e17ed8a87d7c7a3fd1ab551cfd73.archive'
dump_root = 'dump'

with zipfile.ZipFile(archive_path) as archive:
    for info in archive.infolist():
        if info.compress_type != 34:

xusheng6

#include <iostream>
#include <thread>
#include "lldb/API/LLDB.h"

using namespace std;
using namespace lldb;

class Debugger
{
public: