What's changed

Latest

• Replaced VirtualProtect approach with hardware execution breakpoint VEH — no code bytes written to any system DLL, invisible to memory-integrity scans
• DR0–DR3 set on every process thread targeting AmsiScanBuffer, EtwEventWrite, AmsiOpenSession, EtwEventWriteFull
• VEH intercepts EXCEPTION_SINGLE_STEP, simulates ret with desired RAX, re-arms DR7 on every hit
• Background watcher thread re-arms debug registers on new threads every 4–7 seconds
• GetProcAddress, SetThreadContext, CloseHandle, Thread32First/Next argtypes set — 64-bit HANDLE values no longer overflow c_long (32-bit on Windows LP64)
• RtlAddVectoredExceptionHandler restype/argtypes set to match 64-bit return
• Duplicate _init_trace_ctx removed — old VirtualProtect ETW code was shadowing the VEH stub and re-triggering Defender on every build with the bypass enabled

• Input processing merged into _capture_producer thread — the separate _input_proc_thread was failing SetThreadDesktop silently because Python's runtime creates implicit GUI handles before the first ctypes call
• ChildWindowFromPoint loop removed — was using screen coordinates as parent-client-relative coordinates (wrong space), causing garbage window targets
• Latest-move-wins queue drain — stale WM_MOUSEMOVE messages discarded per capture tick; only the newest move processed each frame, eliminates TCP buffer overflow at 2560×1440
• _on_move throttle reduced from 30 Hz to 15 Hz — halves bandwidth pressure on the Cloudflare tunnel without losing responsiveness
• Coordinate clamping in _scale to [0, remote_w-1] — Tkinter fires Motion events with e.x < 0 when cursor hits the canvas left edge, was sending negative screen coordinates that triggered the virtual desktop swipe zone

• DrawIconEx cross-desktop cursor removed — was fetching a cursor handle from the interactive desktop then calling DrawIconEx from a thread on the hidden desktop; undefined behaviour that silently corrupted hDcScreen GDI state, session died at frame 78
• Replaced with GDI crosshair using CreatePen / MoveToEx / LineTo — then also removed because the controller viewer already draws a software cursor overlay on the canvas; the client-side crosshair was redundant and caused hDcScreen corruption on first draw

• Builder "Both (Task + Run Key)" matching changed to exact string equality — substring match on "Run Key" was classifying "Both" as "Run Key only", silently disabling the scheduled task on every Both build
• Schtask /ru USERNAME removed from both _register_autorun and _register_autorun_path — specifying /ru with a local username requires credentials stored in Credential Manager or triggers an interactive prompt on W10/11
• /delay 00:02 removed — two-component format rejected by strict Windows builds; reconnect retry logic handles early beacon failures instead
• CreateKeyEx instead of OpenKey in _register_autorun, _register_autorun_path, and watchdog failstreak fallback — OpenKey raises FileNotFoundError if the Run key does not yet exist

• pip install check_call, PyInstaller Popen, and UPX run all given CREATE_NO_WINDOW — three separate subprocess calls were opening visible CMD windows during every build
• controller_builder.py PyInstaller Popen also fixed with CREATE_NO_WINDOW
• Version info fallback changed from (stem.title(), spoof_name) to _spoof_meta["dllhost"] — was generating FileDescription: Lala when worker spoof name wasn't a recognised Windows binary

Previous

• VirtualProtect replaced with NtProtectVirtualMemory — bypasses the kernel32.dll hook layer that most AV/EDR products intercept
• AMSI patch bytes changed from xor eax,eax; ret (most-signatured 3-byte sequence in Windows security tooling) to mov eax, 0x80070057; ret — returns E_INVALIDARG, a valid HRESULT error code
• ETW patch bytes changed from xor eax,eax; ret; nop to push 0; pop eax; ret — avoids the known xor idiom pattern
• Random 8–35ms sleep before and after each protection change — defeats timing-based behavioral detection that watches for rapid VirtualProtect+write sequences
• Idempotent patch check — skips re-patching if first byte already matches, avoids double-patching on watchdog re-runs

• Full HVNC session — hidden desktop created with CreateDesktopW, Explorer spawned, live JPEG stream over WebSocket
• Separate _recv_thread for HVNC WebSocket — concurrent send+recv on websocket-client is safe at the TCP level; recv thread handles incoming input events without blocking the frame send loop
• WebSocket timeout raised from 15s to 60s — 15s timed out on large JPEG frames (2560×1440, quality 60) through Cloudflare tunnels with any latency

• Persistence watchdog OpenKey → CreateKeyEx in all three locations — watchdog failstreak fallback was still using OpenKey after the main function was fixed
• _register_autorun_path same fixes applied — had identical /ru, CreateKeyEx, and /delay bugs as the main register function

• setup.bat written — installs all Python dependencies, MinGW-w64 (with GitHub release fallback), cloudflared (winget then direct download), adds GCC to system PATH
• controller_builder.py verified compatible — CF constant regex patterns match gui_controller.py exactly; obfuscation self-contained

Initial

• Full controller GUI — client builder, file manager, keylogger, reverse CMD shell, geolocation map
• Cloudflare Worker + tunnel C2 — no open ports, no static IP, TLS by default
• PyInstaller single-exe builds with marshal + zlib + XOR obfuscation
• Scheduled task + registry RunKey persistence with background watchdog
• DPAPI AES-256-GCM browser cookie harvesting for Chromium; moz_cookies + moz_places for Firefox
• Process spoofing with PE version info and INetCache install path
• Screen capture, webcam access, audio recording modules
• Anti-analysis: sandbox uptime check, debugger detection, VM presence detection, sleep jitter
• HVNC hidden desktop framework (mouse/keyboard passthrough added in v1.5)