EpSiLoNPoInTIkEv2.cpp

⚠️ Project in finalization stage. NOT fully functional in its current state.

---

Description

EpSiLoNPoInTIkEv2.cpp is a C/C++ exploit prototype targeting Windows, developed around an exploitation of type double-free in ikeext.dll (Windows IKEv2 driver), referenced under research as CVE-2026-33824.

The project includes:

• A complete obfuscation layer (virtual machine, control flow obfuscation, string masking, fake binary signatures, anti-analysis inline ASM).
• A full IKEv2 exploitation engine (packet construction, SKF fragmentation, multi-threaded heap grooming, ROP chain, arbitrary read/write primitives).
• Bypass mechanisms for Windows Defender, AMSI, and ETW.
• An integrated reverse shell listener on port 4444.
• A partial GUI (ListView, ComboBox, status bar) for inspecting suspicious memory regions.

---

Code Architecture

1. Obfuscation Layer (EpSi_OBF_ENDL / inspired obfusheader)

The code uses a heavy obfuscation layer enabled at compile-time via #define EpSi_OBF_ENDL. Based on obfusheader.h, adapted and extended.

Fake Binary Signatures (FAKE_SIGNS == 1)

Custom PE sections are injected into the binary to trick scanners of known protectors:

• .vmp0, .vmp1, .vmp2 → VMProtect
• UPX0 → UPX
• .enigma1, .enigma2 → Enigma Protector
• .winlice → Themida
• .petite, .aspack, .adata, .rlp, .vlizer, .arch, .alien, .pwdprot, .dsstext, logicoma, __wibu00, __wibu01, PETETRIS, .tw, .rdata (Nuitka), .text (Screen2Exe), etc.
• Encoded strings imitating Enigma (0x45,0x6e,0x69,...), Denuvo (0x64,0x65,0x6E,...).
• Array FAKE_DONGLE[] imitating hardware dongles: skeydrv.dll, HASPDOSDRV, MARXDEV1.SYS, WIBUKEY, SNTNLUSB, RNBOspro, etc.

Arithmetic Virtual Machine (VIRT == 1)

All arithmetic and logical operations can be routed through an internal VM (Obfh_VirtualMachine):

• Opcodes (OP__ADD, OP__SUB, ..., OP__NOP) are randomly generated at compile time via __COUNTER__ and RND().
• Each opcode is encrypted: _VM_ENCRYPT_INT(value) = (value - _VM_MUTATOR_KEY) * ~SALT_CMD.
• Operands are salted, inverted (* -1), and passed with junk values.
• The VM itself is riddled with goto, fake negative case, BREAK_STACK_* (inline ASM xor; jz; .byte 0xE8; cpuid), fake JMP (.byte 0xFF, 0x25) and blocks of fake x86_64 code to trick decompilers.
• Exposed macros: VM_ADD, VM_SUB, VM_MUL, VM_DIV, VM_MOD, VM_EQU, VM_NEQ, VM_LSS, VM_GTR, VM_LEQ, VM_GEQ, VM_OBF_INT, VM_ADD_DBL, VM_MUL_DBL, etc.

Obfuscated Control Flow (NO_CFLOW != 1)

• #define if(cond) : each if injects a call to __s_rdtsc() and a dead BAD_CALL.
• #define else : injects a dead else if (0) { BAD_CALL; } before the real else.
• #define while(...) : conditioned by __s_rdtsc() != 0.1 and an absurd pointer check.
• #define for(...) : conditioned by OBFUS_CONDITION_BLOCK.
• #define switch(...) : conditioned by OBFUS_CONDITION_BLOCK.
• #define break : injects if (OBFUS_CONDITION_BLOCK) BREAK_STACK_1 before each break.

String Masking (HIDE_STRING)

• STACK_STRING(str) : pushes the string onto the stack via compound literal.
• HIDE_STRING(str) : combines obfh_process_hidden_string() + __s_rdtsc() with a dead BAD_JMP to hide the string in the binary.

API Proxies (full dynamic resolution)

All CRT and Win32 functions are redirected:

• CRT via dynamic GetProcAddress(LoadLibraryA("msvcrt"), ...) : printf, scanf, sprintf, strlen, strcmp, strcpy, strtok, memset, memcpy, strchr, strrchr, rand, realloc, calloc, fopen, fclose, fread, fwrite, exit, snprintf, vsprintf, vsnprintf, getenv, system, abort, atexit, getcwd, tolower, toupper.
• Win32 via obfh_int_proxy() wrappers on all parameters: CreateFile, ReadFile, WriteFile, CloseHandle, VirtualAlloc, VirtualFree, CreateThread, WaitForSingleObject, WaitForMultipleObjects, ExitProcess, GetModuleHandle, GetModuleFileName, HeapCreate, HeapAlloc, HeapFree, GlobalAlloc, GlobalFree, GetTempPath, SetEvent, ResetEvent, Sleep, memmove, GetParent, GetWindowRect, GetClientRect, SetWindowPos, SetConsoleTextAttribute, GetDesktopWindow, GetStockObject.
• GetProcAddress replaced by GetProcAddress_custom: manual traversal of the IMAGE_EXPORT_DIRECTORY (parses PE: e_lfanew, IMAGE_NT_HEADERS, IMAGE_DIRECTORY_ENTRY_EXPORT, AddressOfFunctions, AddressOfNames, AddressOfNameOrdinals).
• LoadLibraryA obfuscated into a chain of 6 nested wrappers (LoadLibraryA_0 to LoadLibraryA_proxy), with DLL name reconstruction character by character via volatile variables _k, _e, _r, _n, _e, _l and sprintf.

Anti-debug (ANTI_DEBUG_V2 == 1)

• Dedicated thread (ThreadCompareDRs): SuspendThread on the main thread, GetThreadContext with CONTEXT_DEBUG_REGISTERS, checks Dr0–Dr3, Dr7, zeroing via ad_ZeroDRs.
• IsDebuggerPresent_proxy: dynamically loads kernel32.dll, reconstructs the function name IsDebuggerPresent character by character via volatile variables (_I, _s, _D, _e, _b, _u, _g, _g, _e, _r, _P, _r, _e, _s, _e, _n, _t), call via GetProcAddress.
• Macro ANTI_DEBUG: double check IsDebuggerPresent() || IsDebuggerPresent_proxy(), triggers loop() (infinite loop), .byte 0xED (privileged IN), BREAK_STACK_1, ret ASM, then crash() (int $3 + .byte 0xED, 0x00).

BREAK_STACK Macros (stack anti-analysis)

9 variants of inline ASM sequences inserted in sensitive functions: xor; jz; .byte 0xE8; cpuid (variations on eax, ebx, edx), fake opcodes 0x50, 0x20, 0x00, 0xEB, 0xE1 (x86), 0xFF, 0x25, 0xF1, 0xF2, 0xF3, 0xF4 (x86_64).

---

2. IKEv2 Engine / Exploit

Dependencies

#include "runassys/ntnative.h"
#include "runassys/runassys.h"
#include "runassys/ntdll-stubs/ntdll-stubs.c"
#include "runassys/ntdll-stubs/ntdll.def.c"
#pragma comment(lib, "ws2_32.lib")
#pragma comment(lib, "iphlpapi.lib")
#pragma comment(lib, "bcrypt.lib")
#pragma comment(lib, "Version.lib")

Exploit Constants

• Target: IKEEXT_BASE_ADDRESS = 0x180000000
• Double free offset: g_IkeextDoubleFreeOffset = 0x12B960
• IKE payload handler: g_IkeextProcessIkePayload = 0x52220
• Ikeext PE directories: Export (0x1790A0), Import (0x179110), Exception (0x183000), Reloc (0x18C000), LoadConfig (0x12AE70), Debug (0x155CD0).
• Internal structure offsets: g_Offset_MMSA_SecurityRealmBlob = 0x208, g_Offset_PacketContext_Blob = 0xC8.
• IKEv2 port: 500 (UDP), shell callback: 4444.

Defined IKEv2 Structures

IKE_HEADER, IKE_SA_PAYLOAD, IKE_PROPOSAL_PAYLOAD, IKE_TRANSFORM_PAYLOAD, IKE_NONCE_PAYLOAD (32 bytes nonce), IKE_KEY_EXCHANGE_PAYLOAD (DH 256 bytes), IKE_NOTIFY_PAYLOAD, IKE_VENDOR_ID_PAYLOAD, IKE_SKF_FRAGMENT_PAYLOAD.

Configured transforms: AES-CBC-128 (12), PRF HMAC-SHA2-256 (5), INTEG HMAC-SHA2-256-128 (12), DH MODP-2048 (14).

Custom DDoS Structures

• IKE_DDOS_AMPLIFIER_PAYLOAD: amplification factor + 64 bytes trigger.
• IKE_DDOS_LOOP_PAYLOAD: loop counter + 32 bytes loop_code.
• IKE_DDOS_MEMORY_PAYLOAD: allocation size/count + 64 bytes heap spray data.

Heap grooming

• HEAP_GROOM_CONTEXT: heap handle, target address, threads, stop_flag, allocated_chunks.
• HEAP_GROOM_THREAD_PARAMS: chunk size, iterations, thread_id, SRWLOCK, use_nt_allocate.
• GROOM_CONFIG: thread_count, iterations, delay, chunk_size, min/max free %.
• Parameters: 4 threads, chunks of 0x1000, 1000 iterations, fragmentation between 30–70%.