EpSiLoNPoInTIkEv2.cpp

⚠️ Project in finalization stage. NOT fully functional in its current state.

Description

EpSiLoNPoInTIkEv2.cpp is a C/C++ exploit prototype targeting Windows, developed around an exploitation of type double-free in ikeext.dll (Windows IKEv2 driver), referenced under research as CVE-2026-33824.

The project includes:

• A complete obfuscation layer (virtual machine, control flow obfuscation, string masking, fake binary signatures, anti-analysis inline ASM).
• A full IKEv2 exploitation engine (packet construction, SKF fragmentation, multi-threaded heap grooming, ROP chain, arbitrary read/write primitives).
• Bypass mechanisms for Windows Defender, AMSI, and ETW.
• An integrated reverse shell listener on port 4444.
• A partial GUI (ListView, ComboBox, status bar) for inspecting suspicious memory regions.

Code Architecture

1. Obfuscation Layer (EpSi_OBF_ENDL / inspired obfusheader)

The code uses a heavy obfuscation layer enabled at compile-time via #define EpSi_OBF_ENDL. Based on obfusheader.h, adapted and extended.

Fake Binary Signatures (FAKE_SIGNS == 1)

Custom PE sections are injected into the binary to trick scanners of known protectors:

• .vmp0, .vmp1, .vmp2 → VMProtect
• UPX0 → UPX
• .enigma1, .enigma2 → Enigma Protector
• .winlice → Themida
• .petite, .aspack, .adata, .rlp, .vlizer, .arch, .alien, .pwdprot, .dsstext, , , , , , (Nuitka), (Screen2Exe), etc.

Arithmetic Virtual Machine (VIRT == 1)

All arithmetic and logical operations can be routed through an internal VM (Obfh_VirtualMachine):

• Opcodes (OP__ADD, OP__SUB, ..., OP__NOP) are randomly generated at compile time via __COUNTER__ and RND().
• Each opcode is encrypted: _VM_ENCRYPT_INT(value) = (value - _VM_MUTATOR_KEY) * ~SALT_CMD.
• Operands are salted, inverted (* -1), and passed with junk values.
• The VM itself is riddled with goto, fake negative case, BREAK_STACK_* (inline ASM xor; jz; .byte 0xE8; cpuid), fake JMP (.byte 0xFF, 0x25) and blocks of fake x86_64 code to trick decompilers.
• Exposed macros: VM_ADD, , , , , , , , , , , , , , etc.

Obfuscated Control Flow (NO_CFLOW != 1)

• #define if(cond) : each if injects a call to __s_rdtsc() and a dead BAD_CALL.
• #define else : injects a dead else if (0) { BAD_CALL; } before the real else.
• #define while(...) : conditioned by __s_rdtsc() != 0.1 and an absurd pointer check.
• #define for(...) : conditioned by OBFUS_CONDITION_BLOCK.
• #define switch(...) : conditioned by OBFUS_CONDITION_BLOCK.
• #define break : injects before each .

String Masking (HIDE_STRING)

• STACK_STRING(str) : pushes the string onto the stack via compound literal.
• HIDE_STRING(str) : combines obfh_process_hidden_string() + __s_rdtsc() with a dead BAD_JMP to hide the string in the binary.

API Proxies (full dynamic resolution)

All CRT and Win32 functions are redirected:

• CRT via dynamic GetProcAddress(LoadLibraryA("msvcrt"), ...) : printf, scanf, sprintf, strlen, strcmp, strcpy, strtok, memset, memcpy, strchr, strrchr, rand, realloc, calloc, , , , , , , , , , , , , , , .

Anti-debug (ANTI_DEBUG_V2 == 1)

• Dedicated thread (ThreadCompareDRs): SuspendThread on the main thread, GetThreadContext with CONTEXT_DEBUG_REGISTERS, checks Dr0–Dr3, Dr7, zeroing via ad_ZeroDRs.
• IsDebuggerPresent_proxy: dynamically loads kernel32.dll, reconstructs the function name IsDebuggerPresent character by character via volatile variables (_I, _s, _D, _e, _b, _u, _g, _g, _e, _r, _P, _r, _e, _s, _e, _n, _t), call via GetProcAddress.
• Macro ANTI_DEBUG: double check , triggers (infinite loop), (privileged IN), , ASM, then ( + ).

BREAK_STACK Macros (stack anti-analysis)

9 variants of inline ASM sequences inserted in sensitive functions: xor; jz; .byte 0xE8; cpuid (variations on eax, ebx, edx), fake opcodes 0x50, 0x20, 0x00, 0xEB, 0xE1 (x86), 0xFF, 0x25, 0xF1, 0xF2, 0xF3, 0xF4 (x86_64).

2. IKEv2 Engine / Exploit

Dependencies

#include "runassys/ntnative.h"
#include "runassys/runassys.h"
#include "runassys/ntdll-stubs/ntdll-stubs.c"
#include "runassys/ntdll-stubs/ntdll.def.c"
#pragma comment(lib, "ws2_32.lib")
#pragma comment(lib, "iphlpapi.lib")
#pragma comment(lib, "bcrypt.lib")
#pragma comment(lib, "Version.lib")

Exploit Constants

• Target: IKEEXT_BASE_ADDRESS = 0x180000000
• Double free offset: g_IkeextDoubleFreeOffset = 0x12B960
• IKE payload handler: g_IkeextProcessIkePayload = 0x52220
• Ikeext PE directories: Export (0x1790A0), Import (0x179110), Exception (0x183000), Reloc (0x18C000), LoadConfig (0x12AE70), Debug (0x155CD0).
• Internal structure offsets: g_Offset_MMSA_SecurityRealmBlob = 0x208, g_Offset_PacketContext_Blob = 0xC8.
• IKEv2 port: 500 (UDP), shell callback: 4444.

Defined IKEv2 Structures

IKE_HEADER, IKE_SA_PAYLOAD, IKE_PROPOSAL_PAYLOAD, IKE_TRANSFORM_PAYLOAD, IKE_NONCE_PAYLOAD (32 bytes nonce), IKE_KEY_EXCHANGE_PAYLOAD (DH 256 bytes), IKE_NOTIFY_PAYLOAD, IKE_VENDOR_ID_PAYLOAD, IKE_SKF_FRAGMENT_PAYLOAD.

Configured transforms: AES-CBC-128 (12), PRF HMAC-SHA2-256 (5), INTEG HMAC-SHA2-256-128 (12), DH MODP-2048 (14).

Custom DDoS Structures

• IKE_DDOS_AMPLIFIER_PAYLOAD: amplification factor + 64 bytes trigger.
• IKE_DDOS_LOOP_PAYLOAD: loop counter + 32 bytes loop_code.
• IKE_DDOS_MEMORY_PAYLOAD: allocation size/count + 64 bytes heap spray data.

Heap grooming

• HEAP_GROOM_CONTEXT: heap handle, target address, threads, stop_flag, allocated_chunks.
• HEAP_GROOM_THREAD_PARAMS: chunk size, iterations, thread_id, SRWLOCK, use_nt_allocate.
• GROOM_CONFIG: thread_count, iterations, delay, chunk_size, min/max free %.
• Parameters: 4 threads, chunks of 0x1000, 1000 iterations, fragmentation between 30–70%.

ROP Chain

Complete ROP_CHAIN structure with all required gadgets: pop_rax/rcx/rdx/r8/r9/rsp, mov_rax_rsp, mov_rcx_rsp, mov_rcx_rax, mov_rax_rcx, mov_rcx_rdx, xor_rax/rcx/rdx, jmp_rsp, call_rax, ret, virtual_protect, disable_cfg, disable_cet, add_rsp, , . Array of 512 gadgets ().

ROP Gadget Scanner

Table g_rop_patterns[] of ~50+ byte-signature patterns to locate gadgets in modules: pop rax; ret, pop rcx; ret, pop rdx; ret, ..., mov [rcx], rax; ret, mov rax, [rcx]; ret, jmp rsp, VirtualProtect prologue, mov [gs:0x60], rax; ret, jmp [rax+0x58]; ret, lea rax, [rip+0x0]; jmp rax, add rsp, 0x28; ret, cmp rdx/r8/r9, 0x0; je/jne; ret, etc.

Exploit Global Variables

uint64_t g_KernelBase, g_IkeextBase, g_SystemEprocess;
uint64_t g_IkeextDoubleFreeOffset = 0x12B960;
uint64_t g_IkeextProcessIkePayload = 0x52220;
uint64_t g_PopRax, g_PopRcx, g_PopRdx, g_PopR8, g_PopR9, g_PopRsp;
uint64_t g_MovRaxRsp, g_JmpRsp, g_VirtualProtect, g_DisableCFG, g_StackPivot;
uint64_t g_NtoskrnlBase, g_Kernel32Base, g_NtdllBase, g_HeapBase, g_ShellcodeAddr;
SOCKET g_Socket; struct sockaddr_in g_Target;
EXPLOIT_CONTEXT g_ExploitCtx; ROP_CHAIN g_RopChain;
HEAP_GROOM_CONTEXT g_GroomContext;
MODULE_DATA g_Modules; ROP_GADGET g_Gadgets;
std::vector<SUSPICIOUS_REGION> g_Regions;

Main Flow (main)

1. InitializeCriticalSection, init_debug_info.
2. is_hostile_environment() → exit if sandbox/VM detected.
3. disable_amsi(), disable_defender(), disable_etw(), patch_etw().
4. start_shell_listener() → reverse shell listener port 4444.
5. Parse argv[1] (target IP) + argv[2] (port, default 500).
6. init_udp_socket() + inet_pton + test_target_reachability().
7. Construction and sending of fragmented IKEv2 packets (SKF, up to packets).

Current Status

The project is in the finalization stage and is not fully functional.

• Some referenced functions (disable_amsi, disable_defender, disable_etw, patch_etw, is_hostile_environment, test_target_reachability, start_shell_listener, stop_shell_listener, print_usage, init_debug_info) are declared but may be incomplete or missing depending on the build state.
• The ikeext offsets are static and specific to a particular Windows build. No dynamic offset resolution mechanism has been finalized yet.
• The ROP chain is built but shellcode placement and activation are not fully integrated in the current state.
• Some GUI parts (ListView, ComboBox, region scanning) are partially integrated.
• The project may not compile without adjustments to the build system, runassys/ dependencies, and linked libraries.

Disclaimer

This repository contains an offensive security research prototype targeting a low-level network exploitation vector (IKEv2/ikeext.dll, Windows).

Use of this code is strictly limited to test, research, or lab environments where you have explicit authorization.

The author disclaims any liability for any illegal, unauthorized, or harmful use of this code. The code is provided as-is, without any warranty of functionality, stability, or absence of adverse effects.

The project is still in the finalization stage and is not fully functional in its current state.