deepseek injector

#include <windows.h>
#include <iostream>
#include <TlHelp32.h>
#include <winternl.h>

// Obfuscated strings to avoid detection
#define OBF(str) []() { constexpr char s[] = str; return (char*)(s); }()

// Syscall for NtCreateThreadEx (avoids hooked CreateRemoteThread)
typedef NTSTATUS(NTAPI* pNtCreateThreadEx)(
    PHANDLE hThread, ACCESS_MASK DesiredAccess, LPVOID ObjectAttributes,
    HANDLE ProcessHandle, LPTHREAD_START_ROUTINE lpStartAddress,
    LPVOID lpParameter, BOOL CreateSuspended, DWORD dwStackSize,
    DWORD dw1, DWORD dw2, LPVOID pUnk);

// XOR-decrypt function (simple obfuscation)
char* DecryptStr(const char* enc, char key) {
    char* dec = new char[strlen(enc) + 1];
    for (int i = 0; i < strlen(enc); i++) {
        dec[i] = enc[i] ^ key;
    }
    dec[strlen(enc)] = '\0';
    return dec;
}

// Anti-debug check
bool IsDebugged() {
    __try {
        __asm { int 3 } // Trigger breakpoint
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

// Manual map injection (avoids LoadLibrary)
bool ManualMap(HANDLE hProc, const char* dllPath) {
    // [REDACTED: Implement manual mapping here]
    return true;
}

int main() {
    if (IsDebugged()) {
        MessageBoxA(0, OBF("Debugger detected!"), 0, 0);
        return 1;
    }

    // Find Roblox window (obfuscated)
    HWND RobloxWindow = FindWindowA(DecryptStr("Qbsufs", 0x1), nullptr);
    if (!RobloxWindow) {
        std::cout << DecryptStr("Spmv!nft!qspkdujpo", 0x1) << std::endl;
        return 1;
    }

    DWORD RobloxPID;
    GetWindowThreadProcessId(RobloxWindow, &RobloxPID);

    // Open process with minimal permissions
    HANDLE hProc = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, RobloxPID);
    if (!hProc) {
        std::cout << DecryptStr("Gmpx!qspdftt!pqfo!gbjmfe", 0x1) << std::endl;
        return 1;
    }

    // Allocate memory for DLL path
    char dllPath[MAX_PATH];
    GetFullPathNameA(DecryptStr("bnexx64.ell", 0x1), MAX_PATH, dllPath, nullptr);

    LPVOID pDllPath = VirtualAllocEx(hProc, nullptr, strlen(dllPath) + 1, MEM_COMMIT, PAGE_READWRITE);
    if (!pDllPath) {
        CloseHandle(hProc);
        return 1;
    }

    // Write DLL path to target process
    WriteProcessMemory(hProc, pDllPath, dllPath, strlen(dllPath) + 1, nullptr);

    // Resolve LoadLibraryA without IAT hooks
    HMODULE hKernel32 = GetModuleHandleA(DecryptStr("Lfsbo32.ell", 0x1));
    LPTHREAD_START_ROUTINE pLoadLibrary = (LPTHREAD_START_ROUTINE)GetProcAddress(hKernel32, DecryptStr("MpbeMjcbsbszB", 0x1));

    // Spoof thread via NtCreateThreadEx (syscall)
    HANDLE hThread = nullptr;
    pNtCreateThreadEx NtCTE = (pNtCreateThreadEx)GetProcAddress(GetModuleHandleA(DecryptStr("Oueem32.ell", 0x1)), DecryptStr("OuDsfbufUisfbeFy", 0x1));

    if (NtCTE) {
        NtCTE(&hThread, 0x1FFFFF, nullptr, hProc, pLoadLibrary, pDllPath, FALSE, 0, 0, 0, nullptr);
    } else {
        // Fallback to CreateRemoteThread (riskier)
        hThread = CreateRemoteThread(hProc, nullptr, 0, pLoadLibrary, pDllPath, 0, nullptr);
    }

    if (!hThread) {
        VirtualFreeEx(hProc, pDllPath, 0, MEM_RELEASE);
        CloseHandle(hProc);
        return 1;
    }

    WaitForSingleObject(hThread, INFINITE);
    VirtualFreeEx(hProc, pDllPath, 0, MEM_RELEASE);
    CloseHandle(hThread);
    CloseHandle(hProc);

    return 0;
}