The code uses a heavy obfuscation layer enabled at compile-time via #define EpSi_OBF_ENDL. Based on obfusheader.h, adapted and extended.

Fake Binary Signatures (FAKE_SIGNS == 1)

Custom PE sections are injected into the binary to trick scanners of known protectors:

• .vmp0, .vmp1, .vmp2 → VMProtect
• UPX0 → UPX
• .enigma1, .enigma2 → Enigma Protector
• .winlice → Themida
• .petite, .aspack, .adata, .rlp, .vlizer, .arch, .alien, .pwdprot, .dsstext, logicoma, __wibu00, __wibu01, PETETRIS, .tw, .rdata (Nuitka), .text (Screen2Exe), etc.
• Encoded strings imitating Enigma (0x45,0x6e,0x69,...), Denuvo (0x64,0x65,0x6E,...).
• Array FAKE_DONGLE[] imitating hardware dongles: skeydrv.dll, HASPDOSDRV, MARXDEV1.SYS, WIBUKEY, SNTNLUSB, RNBOspro, etc.

Arithmetic Virtual Machine (VIRT == 1)

All arithmetic and logical operations can be routed through an internal VM (Obfh_VirtualMachine):

• Opcodes (OP__ADD, OP__SUB, ..., OP__NOP) are randomly generated at compile time via __COUNTER__ and RND().
• Each opcode is encrypted: _VM_ENCRYPT_INT(value) = (value - _VM_MUTATOR_KEY) * ~SALT_CMD.
• Operands are salted, inverted (* -1), and passed with junk values.
• The VM itself is riddled with goto, fake negative case, BREAK_STACK_* (inline ASM xor; jz; .byte 0xE8; cpuid), fake JMP (.byte 0xFF, 0x25) and blocks of fake x86_64 code to trick decompilers.
• Exposed macros: VM_ADD, VM_SUB, VM_MUL, VM_DIV, VM_MOD, VM_EQU, VM_NEQ, VM_LSS, VM_GTR, VM_LEQ, VM_GEQ, VM_OBF_INT, VM_ADD_DBL, VM_MUL_DBL, etc.

Obfuscated Control Flow (NO_CFLOW != 1)

• #define if(cond) : each if injects a call to __s_rdtsc() and a dead BAD_CALL.
• #define else : injects a dead else if (0) { BAD_CALL; } before the real else.
• #define while(...) : conditioned by __s_rdtsc() != 0.1 and an absurd pointer check.
• #define for(...) : conditioned by OBFUS_CONDITION_BLOCK.
• #define switch(...) : conditioned by OBFUS_CONDITION_BLOCK.
• #define break : injects if (OBFUS_CONDITION_BLOCK) BREAK_STACK_1 before each break.

String Masking (HIDE_STRING)

• STACK_STRING(str) : pushes the string onto the stack via compound literal.
• HIDE_STRING(str) : combines obfh_process_hidden_string() + __s_rdtsc() with a dead BAD_JMP to hide the string in the binary.

API Proxies (full dynamic resolution)

All CRT and Win32 functions are redirected:

• CRT via dynamic GetProcAddress(LoadLibraryA("msvcrt"), ...) : printf, scanf, sprintf, strlen, strcmp, strcpy, strtok, memset, memcpy, strchr, strrchr, rand, realloc, calloc, fopen, fclose, fread, fwrite, exit, snprintf, vsprintf, vsnprintf, getenv, system, abort, atexit, getcwd, tolower, toupper.
• Win32 via obfh_int_proxy() wrappers on all parameters: CreateFile, ReadFile, WriteFile, CloseHandle, VirtualAlloc, VirtualFree, CreateThread, WaitForSingleObject, WaitForMultipleObjects, ExitProcess, GetModuleHandle, GetModuleFileName, HeapCreate, HeapAlloc, , , , , , , , , , , , , , , .
• GetProcAddress replaced by GetProcAddress_custom: manual traversal of the IMAGE_EXPORT_DIRECTORY (parses PE: e_lfanew, IMAGE_NT_HEADERS, IMAGE_DIRECTORY_ENTRY_EXPORT, AddressOfFunctions, AddressOfNames, AddressOfNameOrdinals).
• LoadLibraryA obfuscated into a chain of 6 nested wrappers (LoadLibraryA_0 to LoadLibraryA_proxy), with DLL name reconstruction character by character via volatile variables _k, _e, _r, _n, _e, _l and sprintf.

Anti-debug (ANTI_DEBUG_V2 == 1)

• Dedicated thread (ThreadCompareDRs): SuspendThread on the main thread, GetThreadContext with CONTEXT_DEBUG_REGISTERS, checks Dr0–Dr3, Dr7, zeroing via ad_ZeroDRs.
• IsDebuggerPresent_proxy: dynamically loads kernel32.dll, reconstructs the function name IsDebuggerPresent character by character via volatile variables (_I, _s, _D, _e, _b, _u, _g, _g, _e, _r, _P, _r, _e, _s, _e, _n, _t), call via GetProcAddress.
• Macro ANTI_DEBUG: double check IsDebuggerPresent() || IsDebuggerPresent_proxy(), triggers loop() (infinite loop), .byte 0xED (privileged IN), BREAK_STACK_1, ret ASM, then crash() (int $3 + .byte 0xED, 0x00).

BREAK_STACK Macros (stack anti-analysis)

9 variants of inline ASM sequences inserted in sensitive functions: xor; jz; .byte 0xE8; cpuid (variations on eax, ebx, edx), fake opcodes 0x50, 0x20, 0x00, 0xEB, 0xE1 (x86), 0xFF, 0x25, 0xF1, 0xF2, 0xF3, 0xF4 (x86_64).

2. IKEv2 Engine / Exploit

Dependencies

Exploit Constants

• Target: IKEEXT_BASE_ADDRESS = 0x180000000
• Double free offset: g_IkeextDoubleFreeOffset = 0x12B960
• IKE payload handler: g_IkeextProcessIkePayload = 0x52220
• Ikeext PE directories: Export (0x1790A0), Import (0x179110), Exception (0x183000), Reloc (0x18C000), LoadConfig (0x12AE70), Debug (0x155CD0).
• Internal structure offsets: g_Offset_MMSA_SecurityRealmBlob = 0x208, g_Offset_PacketContext_Blob = 0xC8.
• IKEv2 port: 500 (UDP), shell callback: 4444.

Defined IKEv2 Structures

IKE_HEADER, IKE_SA_PAYLOAD, IKE_PROPOSAL_PAYLOAD, IKE_TRANSFORM_PAYLOAD, IKE_NONCE_PAYLOAD (32 bytes nonce), IKE_KEY_EXCHANGE_PAYLOAD (DH 256 bytes), IKE_NOTIFY_PAYLOAD, IKE_VENDOR_ID_PAYLOAD, IKE_SKF_FRAGMENT_PAYLOAD.

Configured transforms: AES-CBC-128 (12), PRF HMAC-SHA2-256 (5), INTEG HMAC-SHA2-256-128 (12), DH MODP-2048 (14).

Custom DDoS Structures

• IKE_DDOS_AMPLIFIER_PAYLOAD: amplification factor + 64 bytes trigger.
• IKE_DDOS_LOOP_PAYLOAD: loop counter + 32 bytes loop_code.
• IKE_DDOS_MEMORY_PAYLOAD: allocation size/count + 64 bytes heap spray data.

Heap grooming

• HEAP_GROOM_CONTEXT: heap handle, target address, threads, stop_flag, allocated_chunks.
• HEAP_GROOM_THREAD_PARAMS: chunk size, iterations, thread_id, SRWLOCK, use_nt_allocate.
• GROOM_CONFIG: thread_count, iterations, delay, chunk_size, min/max free %.
• Parameters: 4 threads, chunks of 0x1000, 1000 iterations, fragmentation between 30–70%.

ROP Chain

Complete ROP_CHAIN structure with all required gadgets: pop_rax/rcx/rdx/r8/r9/rsp, mov_rax_rsp, mov_rcx_rsp, mov_rcx_rax, mov_rax_rcx, mov_rcx_rdx, xor_rax/rcx/rdx, jmp_rsp, call_rax, ret, virtual_protect, disable_cfg, disable_cet, add_rsp, sub_rsp, stack_pivot. Array of 512 gadgets (rop_chain[MAX_ROP_CHAIN_SIZE]).

ROP Gadget Scanner

Table g_rop_patterns[] of ~50+ byte-signature patterns to locate gadgets in modules: pop rax; ret, pop rcx; ret, pop rdx; ret, ..., mov [rcx], rax; ret, mov rax, [rcx]; ret, jmp rsp, VirtualProtect prologue, mov [gs:0x60], rax; ret, jmp [rax+0x58]; ret, lea rax, [rip+0x0]; jmp rax, add rsp, 0x28; ret, cmp rdx/r8/r9, 0x0; je/jne; ret, etc.

Exploit Global Variables

Main Flow (main)

1. InitializeCriticalSection, init_debug_info.
2. is_hostile_environment() → exit if sandbox/VM detected.
3. disable_amsi(), disable_defender(), disable_etw(), patch_etw().
4. start_shell_listener() → reverse shell listener port 4444.
5. Parse argv[1] (target IP) + argv[2] (port, default 500).
6. init_udp_socket() + inet_pton + test_target_reachability().
7. Construction and sending of fragmented IKEv2 packets (SKF, up to SKF_FRAGMENTS + 1 packets).
8. Trigger double free, heap grooming, shellcode placement, ROP chain execution.

Current Status

The project is in the finalization stage and is not fully functional.

• Some referenced functions (disable_amsi, disable_defender, disable_etw, patch_etw, is_hostile_environment, test_target_reachability, start_shell_listener, stop_shell_listener, print_usage, init_debug_info) are declared but may be incomplete or missing depending on the build state.
• The ikeext offsets are static and specific to a particular Windows build. No dynamic offset resolution mechanism has been finalized yet.
• The ROP chain is built but shellcode placement and activation are not fully integrated in the current state.
• Some GUI parts (ListView, ComboBox, region scanning) are partially integrated.
• The project may not compile without adjustments to the build system, runassys/ dependencies, and linked libraries.

Disclaimer

This repository contains an offensive security research prototype targeting a low-level network exploitation vector (IKEv2/ikeext.dll, Windows).

Use of this code is strictly limited to test, research, or lab environments where you have explicit authorization.

The author disclaims any liability for any illegal, unauthorized, or harmful use of this code. The code is provided as-is, without any warranty of functionality, stability, or absence of adverse effects.

The project is still in the finalization stage and is not fully functional in its current state.