使用教程和更新日志 -> Helix C++ 跨平台内存安全扩展
等稳定后，会在Github开源，MIT协议，但要求指出原出处。
插件下载和头文件。为了保证代码规范，所有结构或类定义只能放头文件里，不准备支持.cpp中的结构或类的扫描。
使用方法，把头文件放到项目里。假设你有一个Shared项目，Helix.Runtime应该和Shared文件夹在同一级。
请务必把语法改成C++ 20，如图
1. Exe
ComplexTest.h
#pragma once #include <iostream> #include <string> #include <vector> #include <stddef.h> #include <ntifs.h> #include <Windows.h> #include <TlHelp32.h> #include <Psapi.h> #include <winternl.h> #include "Helix.h" using EventCallback = void (*)(int, const char*); #pragma pack(push, 1) struct SensorData { public: short sensorId; Offset(2); union { float floatVal; int intVal; }; char status; unsigned char flagA : 1; unsigned char flagB : 3; unsigned char flagC : 4; }; class ComplexEntity { public: int entityId; Offset(4); SensorData sensor; static ComplexEntity* staticBoss; Extern void* externalResource; ComplexEntity* childNode; Extern EventCallback onEventTriggered; ComplexEntity() = default; ComplexEntity(int id) : entityId(id) { std::cout << "[Constructor] ComplexEntity ID " << entityId << " created via parameterized constructor.\n"; } ~ComplexEntity() { std::cout << "[Destructor] ComplexEntity ID " << entityId << " reclaimed.\n"; } void ProcessData(int multiplier) { sensor.intVal *= multiplier; if (onEventTriggered) { onEventTriggered(entityId, "Data Processed successfully via callback!"); } } }; struct NestedPayload { void* rawPointers[3]; ComplexEntity* entityList[2]; int matrix[4]; }; class AdvancedArrayNode { public: int nodeId; Offset(4); NestedPayload payload; AdvancedArrayNode() = default; AdvancedArrayNode(int id) : nodeId(id) { memset(&payload, 0, sizeof(payload)); std::cout << "[Constructor] AdvancedArrayNode ID " << nodeId << " created.\n"; } ~AdvancedArrayNode() { std::cout << "[Destructor] AdvancedArrayNode ID " << nodeId << " reclaimed.\n"; } void MutateArray(int multiplier) { for (int i = 0; i < 4; i++) { payload.matrix[i] *= multiplier; } } }; #pragma pack(pop) class IWorker { public: virtual ~IWorker() = default; virtual void ExecuteTask() = 0; }; class BaseWorker : public IWorker { public: int baseId; virtual void ExecuteTask() override { std::cout << "[BaseWorker] Task executed by ID " << baseId << ".\n"; } virtual void Upgrade() { baseId += 1; } }; class FinalWorker final : public BaseWorker { public: int powerLevel; void ExecuteTask() override final { std::cout << "[FinalWorker] Final task executed by ID " << baseId << " with power " << powerLevel << ".\n"; } void Upgrade() override { powerLevel += 10; } ~FinalWorker() { std::cout << "[Destructor] FinalWorker ID " << baseId << " reclaimed.\n"; } }; class NativeResourceConfig { public: DWORD targetPid; CLIENT_ID clientId; UNICODE_STRING imagePath; ~NativeResourceConfig() { std::cout << "[Destructor] NativeResourceConfig PID " << targetPid << " reclaimed.\n"; } void InitNativeData() { clientId.UniqueProcess = (HANDLE)(ULONG_PTR)targetPid; clientId.UniqueThread = (HANDLE)0x1337; imagePath.Length = 10; imagePath.MaximumLength = 12; imagePath.Buffer = (PWSTR)L"Helix"; } }; inline void AssignGlobalPointer(Extern int** outPtr) { auto newInt = New<int>(9999); *outPtr = &newInt; } Vmp inline void VmpGlobalFunction(const char* message) { std::cout << " -> [Vmp Global] Executing protected global logic...\n"; std::cout << " -> Message: " << message << "\n"; } class SecurityManager { public: int secretCode = 0; Vmp static bool VerifyLicense(const std::string& key) { std::cout << " -> [Vmp Static] Verifying license key...\n"; if (key == "SECRET-KEY") { std::cout << "[Vmp] License Verified Successfully!\n"; return true; } return false; } Vmp void ExecutePayload() { secretCode ^= 0x55; std::cout << " -> [Vmp Member] Payload executed. Secret code mutated to: " << secretCode << "\n"; } Vmp int ComplexVmpLogic(int multiplier) { int tempCode = 10; this->secretCode += (tempCode * multiplier); if (this->secretCode > 10) { tempCode = 999; } ExecutePayload(); return this->secretCode + tempCode; } }; extern ComplexEntity* g_VmpGlobalNode; class VmpAdvancedTester { public: static ComplexEntity* staticNode; Extern ComplexEntity* externDataNode; Vmp void RecursiveAllocTest(int depth, Extern ComplexEntity** outParam) { if (depth <= 0) return; for (int i = 0; i < 2; i++) { auto node = New<ComplexEntity>(depth * 100 + i); if (depth == 1 && i == 1 && outParam != nullptr) { *outParam = &node; } } RecursiveAllocTest(depth - 1, outParam); } Vmp void LoopAllocAndAssign() { for (int i = 1; i <= 5; i++) { auto node = New<ComplexEntity>(i * 1000); if (i == 2) { g_VmpGlobalNode = &node; } else if (i == 3) { staticNode = &node; } else if (i == 5) { externDataNode = &node; } } } }; // 引擎底层已实现 C++ 名称修饰自适应，无需外包 extern "C" API("ntdll.dll") unsigned long NTAPI RtlRandomEx(unsigned long* Seed); API("ws2_32.dll") int __stdcall _115(unsigned short wVersionRequested, void* lpWSAData); API("ntdll.dll") NTSTATUS NTAPI _15(void* Param1);
Main.cpp
#include <iostream>
#include <vector>
#include <string>
#include "ComplexTest.h"
ComplexEntity* ComplexEntity::staticBoss = nullptr;
void* g_PersistentWeapon = nullptr;
int* g_PersistentInt = nullptr;
ComplexEntity* g_VmpGlobalNode = nullptr;
ComplexEntity* VmpAdvancedTester::staticNode = nullptr;
void GlobalEventLogger(int id, const char* msg) {
std::cout << " -> [Callback Invoked] Entity " << id << " reported: " << msg << "\n";
}
DWORD FindProcessId(const char* processName) {
DWORD pid = 0;
HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnap != INVALID_HANDLE_VALUE) {
PROCESSENTRY32 pe;
pe.dwSize = sizeof(PROCESSENTRY32);
if (Process32First(hSnap, &pe)) {
do {
char exeName[MAX_PATH];
for (int i = 0; i < MAX_PATH && pe.szExeFile[i] != 0; i++) {
exeName[i] = (char)pe.szExeFile[i];
}
exeName[MAX_PATH - 1] = '\0';
if (_stricmp(exeName, processName) == 0) {
pid = pe.th32ProcessID;
break;
}
} while (Process32Next(hSnap, &pe));
}
CloseHandle(hSnap);
}
return pid;
}
void TestSerializationAndReflection() {
std::cout << "=== Test 1: Complex Serialization & Reflection ===\n";
auto assertTest = [](bool condition, const std::string& msg) {
if (condition) std::cout << "[PASS] " << msg << "\n";
else std::cout << "[FAIL] " << msg << "\n";
};
auto entity = New<ComplexEntity>(1024);
entity->sensor.sensorId = 7;
entity->sensor.floatVal = 3.14f;
entity->sensor.status = 'A';
entity->sensor.flagA = 1;
entity->sensor.flagB = 5;
entity->sensor.flagC = 10;
entity->onEventTriggered = GlobalEventLogger;
std::vector<uint8_t> bytes = Serialize(entity);
auto cloned = Deserialize<ComplexEntity>(bytes);
assertTest(cloned.entityId == 1024, "Deserialization restored entityId on Stack Obj");
assertTest(cloned.onEventTriggered == GlobalEventLogger, "Deserialization flawlessly restored function pointer");
auto meta = Reflec(cloned);
meta.SetValue("entityId", 2048);
assertTest(cloned.entityId == 2048, "Reflection SetValue correctly modified local Stack Obj memory");
// 深层嵌套反射漫游测试 (Nested Reflection)
std::cout << " --> Testing Deep Nested Reflection (xxxx.yyyy)...\n";
auto childEnt = New<ComplexEntity>(888);
childEnt->sensor.sensorId = 42;
childEnt->sensor.intVal = 10;
cloned.childNode = childEnt;
int childId = meta.GetValue<int>("childNode.entityId");
assertTest(childId == 888, "Nested GetValue traversed pointer 'childNode' to read 'entityId'");
short fetchedSensorId = meta.GetValue<short>("childNode.sensor.sensorId");
assertTest(fetchedSensorId == 42, "Nested GetValue penetrated multiple levels (childNode.sensor.sensorId)");
float localfloatVal = meta.GetValue<float>("sensor.floatVal");
assertTest(localfloatVal == 3.14f, "Nested GetValue read local value-type nested struct (sensor.floatVal)");
meta.SetValue("childNode.sensor.sensorId", (short)999);
assertTest(cloned.childNode->sensor.sensorId == 999, "Nested SetValue mutated deep pointer structure field");
meta.SetValue("sensor.status", 'Z');
assertTest(cloned.sensor.status == 'Z', "Nested SetValue mutated local value-type nested struct (sensor.status)");
meta.Invoke("childNode.ProcessData", 5);
assertTest(cloned.childNode->sensor.intVal == 50, "Nested Invoke dynamically resolved target and executed method with arguments");
std::cout << " --> Testing Nested Arrays (T[n], T*[n], void*[n])...\n";
AdvancedArrayNode advNode(7777);
advNode.payload.rawPointers[0] = (void*)(intptr_t)0xDEADBEEF;
advNode.payload.rawPointers[1] = (void*)(intptr_t)0xCAFEBABE;
advNode.payload.entityList[0] = (ComplexEntity*)entity;
advNode.payload.matrix[0] = 10;
advNode.payload.matrix[1] = 20;
auto advBytes = Serialize(advNode);
auto advCloned = Deserialize<AdvancedArrayNode>(advBytes);
assertTest(advCloned.nodeId == 7777, "Nested array deserialization preserved base attributes");
assertTest(advCloned.payload.rawPointers[0] == (void*)(intptr_t)0xDEADBEEF, "Nested array deserialization flawlessly restored void*[n]");
assertTest(advCloned.payload.entityList[0] == (ComplexEntity*)entity, "Nested array deserialization flawlessly restored T*[n]");
assertTest(advCloned.payload.matrix[1] == 20, "Nested array deserialization flawlessly restored T[n]");
auto advMeta = Reflec(advCloned);
advMeta.Invoke("MutateArray", 5);
assertTest(advCloned.payload.matrix[0] == 50 && advCloned.payload.matrix[1] == 100, "SFINAE Reflection dynamically executed method on Nested Array Stack Object");
int testArr[3] = { 100, 200, 300 };
auto arrBytes = Serialize<int[3]>(testArr);
auto arrCloned = Deserialize<int[3]>(arrBytes);
assertTest(arrCloned[0] == 100 && arrCloned[2] == 300, "Direct TypeTrait Deserialize<T[n]> successfully extracted HArray");
std::cout << "\n";
}
void TestGCAndPersistence() {
std::cout << "=== Test 2: GC Persistence & Extern Validation ===\n";
{
auto tempObj = New<ComplexEntity>(1);
auto bossObj = New<ComplexEntity>(999);
ComplexEntity::staticBoss = &bossObj;
auto weaponObj = New<ComplexEntity>(888);
g_PersistentWeapon = &weaponObj;
auto extObj = New<ComplexEntity>(777);
bossObj->externalResource = &extObj;
auto childObj = New<ComplexEntity>(666);
tempObj->childNode = &childObj;
}
std::cout << "--- Inner scope ended. Only ID 1 and 666 should be reclaimed! ---\n\n";
}
void TestWinApiAndExtern() {
std::cout << "=== Test 3: Windows Native Struct & Extern Pointer ===\n";
auto assertTest = [](bool condition, const std::string& msg) {
if (condition) std::cout << "[PASS] " << msg << "\n";
else std::cout << "[FAIL] " << msg << "\n";
};
auto nativeCfg = New<NativeResourceConfig>();
nativeCfg->targetPid = GetCurrentProcessId();
auto meta = Reflec(nativeCfg);
meta.Invoke("InitNativeData");
assertTest(nativeCfg->clientId.UniqueProcess == (HANDLE)(ULONG_PTR)nativeCfg->targetPid, "Reflection Invoked method updating CLIENT_ID struct natively");
AssignGlobalPointer(&g_PersistentInt);
assertTest(g_PersistentInt != nullptr && *g_PersistentInt == 9999, "Extern int** successfully exported GC pointer using & operator");
std::cout << "\n";
}
void TestPolymorphism() {
std::cout << "=== Test 4: Polymorphism & Keywords (virtual, override, final) ===\n";
auto finalObj = New<FinalWorker>();
finalObj->baseId = 100;
finalObj->powerLevel = 9000;
IWorker* interfacePtr = &finalObj;
std::cout << " ";
interfacePtr->ExecuteTask();
std::cout << "\n";
}
void TestVmpAnnotations() {
std::cout << "=== Test 5: Vmp Control Flow Flattening & Obfuscation ===\n";
VmpGlobalFunction("This is a VMP protected global function!");
auto secMgr = New<SecurityManager>();
secMgr->ExecutePayload();
std::cout << "\n";
}
void TestAdvancedVmp() {
std::cout << "=== Test 6: Advanced Vmp (Recursion, Loops, Global, Static & Extern) ===\n";
auto tester = New<VmpAdvancedTester>();
tester->LoopAllocAndAssign();
ComplexEntity* recursiveOut = nullptr;
tester->RecursiveAllocTest(3, &recursiveOut);
std::cout << "\n";
}
void TestLoopMemoryLeak() {
std::cout << "=== Test 7: Loop Memory Leak Prevention ===\n";
for (int i = 0; i < 5; i++) {
void* p = New<ComplexEntity>(8000 + i);
}
std::cout << "\n";
}
void TestHelixSystemKeywords() {
std::cout << "=== Test 8: Helix System Keywords & Multi-Dimensional Read/Write ===\n";
auto assertTest = [](bool condition, const std::string& msg) {
if (condition) std::cout << "[PASS] " << msg << "\n";
else std::cout << "[FAIL] " << msg << "\n";
};
// 1. 获取系统信息 (System Keyword)
auto sys = System();
if (sys != nullptr) {
std::cout << "[System] OS: " << sys->OSName << " v" << sys->MajorVersion << "." << sys->MinorVersion
<< " (Build " << sys->BuildNumber << ")\n";
std::cout << "[System] HWID: " << sys->SerialNumber << "\n";
}
// 2. 获取 CPU 信息 (Cpu Keyword)
auto cpu = Cpu();
if (cpu != nullptr) {
std::cout << "[Cpu] Vendor: " << cpu->Vendor << " | Brand: " << cpu->Brand << "\n";
std::cout << "[Cpu] Model: " << cpu->ModelName << " | Serial: " << cpu->SerialNumber << "\n";
}
// 3. 获取物理网卡 MAC 阵列 (Mac Keyword)
auto macs = Mac();
if (macs != nullptr && macs->size() > 0) {
std::cout << "[Mac] Found " << macs->size() << " Network Adapter(s):\n";
for (size_t i = 0; i < macs->size(); i++) {
std::cout << " -> [" << i << "] " << (*macs)[i].MacAddress
<< " (" << (*macs)[i].Description << ")\n";
}
}
// 4. 获取磁盘信息阵列 (Disk Keyword)，例如Disk("c")
auto disks = Disk();
if (disks != nullptr && disks->size() > 0) {
std::cout << "[Disk] Found " << disks->size() << " Storage Drive(s):\n";
for (size_t i = 0; i < disks->size(); i++) {
// 使用 full precision 计算，保留为双精度浮点数显示 GB
double totalGB = (double)(*disks)[i].TotalSize / (1024.0 * 1024.0 * 1024.0);
double freeGB = (double)(*disks)[i].FreeSpace / (1024.0 * 1024.0 * 1024.0);
std::cout << " -> " << (*disks)[i].DriveLetter
<< " | Model: " << (*disks)[i].Model
<< " | Serial: " << (*disks)[i].SerialNumber << "\n"
<< " Space: " << freeGB << " GB Free / " << totalGB << " GB Total\n";
}
}
std::cout << "\n";
// PID = -1 彻底绕过系统调用，实现零开销原生访问
std::cout << " --> Testing Local Bypass (PID = -1) Read/Write/Allocate...\n";
void* localMem = Allocate(-1, sizeof(int));
if (localMem) {
int payload = 7777;
Write(-1, localMem, payload);
auto pureVal = Read<int>(-1, localMem);
assertTest(pureVal == 7777, "Local Bypass (-1) flawlessly allocated, wrote, and read stack value via zero-overhead fast path");
}
DWORD notepadPid = FindProcessId("notepad.exe");
bool createdNotepad = false;
HANDLE hNotepad = NULL;
if (notepadPid == 0) {
std::cout << " --> notepad.exe not found. Launching decoy instance...\n";
STARTUPINFOA si = { sizeof(si) };
PROCESS_INFORMATION pi = { 0 };
if (CreateProcessA(nullptr, (LPSTR)"notepad.exe", nullptr, nullptr, FALSE, 0, nullptr, nullptr, &si, &pi)) {
notepadPid = pi.dwProcessId;
hNotepad = pi.hProcess;
CloseHandle(pi.hThread);
createdNotepad = true;
Sleep(500);
}
}
else {
hNotepad = OpenProcess(PROCESS_ALL_ACCESS, FALSE, notepadPid);
}
if (notepadPid != 0 && hNotepad != NULL) {
void* pRemoteMem = Allocate(notepadPid, sizeof(int));
int remoteAddrInt = (int)(intptr_t)pRemoteMem;
if (pRemoteMem) {
int payload = 1337;
Write(notepadPid, pRemoteMem, payload);
auto pureVal = Read<int>(notepadPid, pRemoteMem);
assertTest(pureVal == 1337, "Read<T> flawlessly retrieved memory directly as stack value");
}
std::cout << " --> Testing Cross-Process Nested Arrays Write/Read (T[n], T*[n], void*[n])...\n";
AdvancedArrayNode localAdvArr[2] = { AdvancedArrayNode(8888), AdvancedArrayNode(9999) };
localAdvArr[0].payload.rawPointers[0] = (void*)(intptr_t)0x11112222;
localAdvArr[0].payload.entityList[1] = (ComplexEntity*)(intptr_t)0x33334444;
localAdvArr[1].payload.matrix[3] = 777;
void* remoteAdvArray = Allocate(notepadPid, sizeof(AdvancedArrayNode) * 2);
if (remoteAdvArray != nullptr) {
int wStatus = Write<AdvancedArrayNode[2]>(notepadPid, remoteAdvArray, localAdvArr);
assertTest(wStatus == 1, "Write<T[n]> successfully injected Array of Nested Structs (AdvancedArrayNode[2])");
auto readAdvArr = Read<AdvancedArrayNode[2]>(notepadPid, remoteAdvArray);
assertTest(readAdvArr[0].nodeId == 8888 && readAdvArr[1].nodeId == 9999, "Read<T[n]> effortlessly retrieved Array Objects");
assertTest(readAdvArr[0].payload.rawPointers[0] == (void*)(intptr_t)0x11112222, "Read<T[n]> meticulously extracted nested void*[n]");
assertTest(readAdvArr[0].payload.entityList[1] == (ComplexEntity*)(intptr_t)0x33334444, "Read<T[n]> meticulously extracted nested T*[n]");
assertTest(readAdvArr[1].payload.matrix[3] == 777, "Read<T[n]> meticulously extracted nested T[n] from second element");
void* rawPointersAddr = (void*)((uintptr_t)remoteAdvArray + offsetof(AdvancedArrayNode, payload) + offsetof(NestedPayload, rawPointers));
auto remoteVoidArray = Read<void* [3]>(notepadPid, rawPointersAddr);
assertTest(remoteVoidArray[0] == (void*)(intptr_t)0x11112222, "Read<void*[n]> explicitly pinpointed and extracted subset void* array");
std::cout << " --> Simulated memory tracker recorded void* remote allocations (" << std::hex << remoteAddrInt << std::dec << ") for AST cleanup.\n";
}
if (createdNotepad) {
std::cout << " --> Terminating decoy notepad.exe instance...\n";
TerminateProcess(hNotepad, 0);
}
CloseHandle(hNotepad);
}
std::cout << "\n";
}
ComplexEntity* g_p;
Vmp void TestKeywordMemoryLeak() {
std::cout << "=== Test 9: Keyword Zero-Leak Stress Test (10 Iterations) ===\n";
PROCESS_MEMORY_COUNTERS pmcBefore;
GetProcessMemoryInfo(GetCurrentProcess(), &pmcBefore, sizeof(pmcBefore));
int dummyVar = 42;
std::cout << " --> Running 10 iterations of New, Cpu, System, Mac, Disk, Read, and Allocate (using Local Bypass -1)...\n";
for (int i = 0; i < 10; i++) {
auto cpu = Cpu();
auto sys = System();
//auto macs = Mac();//非内存泄漏
auto disks = Disk();
// 统一使用 -1 表达本进程
auto pureVal = Read<int>(-1, &dummyVar);
auto dummyObj = New<ComplexEntity>(99000 + i);
void* localMem = Allocate(-1, 256);
}
PROCESS_MEMORY_COUNTERS pmcAfter;
GetProcessMemoryInfo(GetCurrentProcess(), &pmcAfter, sizeof(pmcAfter));
long long diffKB = ((long long)pmcAfter.WorkingSetSize - (long long)pmcBefore.WorkingSetSize) / 1024;
g_p = Allocate((uint32_t)-1, sizeof(ComplexEntity));
g_p->entityId = 1038;
std::cout << "[PASS] 10 iterations completed (Including Allocate). Memory delta: " << diffKB << " KB.\n";
std::cout << "\n";
}
void TestDynamicApi() {
std::cout << "=== Test 10: Dynamic API Keyword (Ring 3) ===\n";
unsigned long seed = 0x1337;
unsigned long randomVal = RtlRandomEx(&seed);
if (randomVal != 0) {
std::cout << "[PASS] API Keyword triggered seamlessly! Random Value: " << randomVal
<< " (New Seed: " << seed << ")\n";
}
else {
std::cout << "[FAIL] API Keyword failed or returned 0.\n";
}
char wsaData[512] = { 0 };
int wsaStatus = _115(0x0202, wsaData); // 传入 MAKEWORD(2,2)
if (wsaStatus == 0) {
std::cout << "[PASS] Ring 3 Ordinal (ws2_32.dll #115 WSAStartup) Executed Successfully!\n";
}
else {
std::cout << "[FAIL] Ring 3 Ordinal failed or returned: " << wsaStatus << "\n";
}
void* funcPtr15 = (void*)_15;
if (funcPtr15 != nullptr) {
std::cout << "[PASS] Ring 3 Ordinal (ntdll.dll #15) Resolved successfully to: " << funcPtr15 << "\n";
}
else {
std::cout << "[FAIL] Ring 3 Ordinal failed to resolve.\n";
}
std::cout << "\n";
}
void TestCrossRingSDKReflection() {
auto assertTest = [](bool condition, const std::string& msg) {
if (condition) std::cout << "[PASS] " << msg << "\n";
else std::cout << "[FAIL] " << msg << "\n";
};
std::cout << "=== Test 11: Cross-Ring Native SDK Struct Reflection ===\n";
// 反射 CLIENT_ID (双端互通结构)
auto clientIdObj = New<CLIENT_ID>();
auto metaClientWrite = Reflec(clientIdObj);
metaClientWrite.SetValue("UniqueProcess", (HANDLE)(intptr_t)0x1234);
metaClientWrite.SetValue("UniqueThread", (HANDLE)(intptr_t)0x5678);
auto cidBytes = Serialize(clientIdObj);
auto cidCloned = Deserialize<CLIENT_ID>(cidBytes);
auto metaClientRead = Reflec(cidCloned);
assertTest(metaClientRead.GetValue<HANDLE>("UniqueProcess") == (HANDLE)(intptr_t)0x1234,
"Deserialize<CLIENT_ID> successfully restored Native SDK Struct (UniqueProcess)");
metaClientRead.SetValue("UniqueThread", (HANDLE)(intptr_t)0x9999);
assertTest(metaClientRead.GetValue<HANDLE>("UniqueThread") == (HANDLE)(intptr_t)0x9999,
"Reflec<CLIENT_ID> successfully modified Native SDK Struct field dynamically");
// 反射 LIST_ENTRY (双端互通结构)
auto listEntryObj = New<LIST_ENTRY>();
auto metaListWrite = Reflec(listEntryObj);
metaListWrite.SetValue("Flink", (PLIST_ENTRY)(intptr_t)0xAAAA);
metaListWrite.SetValue("Blink", (PLIST_ENTRY)(intptr_t)0xBBBB);
auto listBytes = Serialize(listEntryObj);
auto listCloned = Deserialize<LIST_ENTRY>(listBytes);
auto metaListRead = Reflec(listCloned);
assertTest(metaListRead.GetValue<PLIST_ENTRY>("Blink") == (PLIST_ENTRY)(intptr_t)0xBBBB,
"Deserialize<LIST_ENTRY> successfully restored Doubly-Linked List node");
metaListRead.SetValue("Flink", (PLIST_ENTRY)(intptr_t)0xCCCC);
assertTest(metaListRead.GetValue<PLIST_ENTRY>("Flink") == (PLIST_ENTRY)(intptr_t)0xCCCC,
"Reflec<LIST_ENTRY> successfully modified Doubly-Linked List field dynamically");
// 反射 MDL (Ring 0 纯内核态结构)
auto mdlObj = New<MDL>();
auto metaMdlWrite = Reflec(mdlObj);
metaMdlWrite.SetValue("Size", (short)1024);
metaMdlWrite.SetValue("MdlFlags", (short)0x0004);
metaMdlWrite.SetValue("ByteCount", (unsigned long)4096);
auto mdlBytes = Serialize(mdlObj);
auto mdlCloned = Deserialize<MDL>(mdlBytes);
auto metaMdlRead = Reflec(mdlCloned);
assertTest(metaMdlRead.GetValue<unsigned long>("ByteCount") == 4096,
"Deserialize<MDL> successfully restored Kernel-Only Struct (ByteCount)");
metaMdlRead.SetValue("MdlFlags", (short)0x0008);
assertTest(metaMdlRead.GetValue<short>("MdlFlags") == 0x0008,
"Reflec<MDL> successfully modified Kernel-Only Struct field dynamically");
// 反射 SYSTEMTIME (Ring 3 纯用户态结构 - 源自 Windows.h)
auto sysTimeObj = New<SYSTEMTIME>();
auto metaSysTimeWrite = Reflec(sysTimeObj);
metaSysTimeWrite.SetValue("wYear", (unsigned short)2026);
metaSysTimeWrite.SetValue("wMonth", (unsigned short)8);
auto sysTimeBytes = Serialize(sysTimeObj);
auto sysTimeCloned = Deserialize<SYSTEMTIME>(sysTimeBytes);
auto metaSysTimeRead = Reflec(sysTimeCloned);
assertTest(metaSysTimeRead.GetValue<unsigned short>("wMonth") == 8,
"Deserialize<SYSTEMTIME> successfully restored User-Only Struct (wMonth) inside Ring 3");
metaSysTimeRead.SetValue("wYear", (unsigned short)2099);
assertTest(metaSysTimeRead.GetValue<unsigned short>("wYear") == 2099,
"Reflec<SYSTEMTIME> successfully modified User-Only Struct field dynamically inside Ring 3");
std::cout << "\n";
}
int main(void** args) {
std::cout << "========================================\n";
std::cout << " HELIX USER-MODE ENGINE IGNITED! \n";
std::cout << "========================================\n\n";
if (args && args[0]) {
std::cout << "[System] Process Path : " << (const char*)args[0] << "\n\n";
}
TestSerializationAndReflection();
TestGCAndPersistence();
TestWinApiAndExtern();
TestPolymorphism();
TestVmpAnnotations();
TestAdvancedVmp();
TestLoopMemoryLeak();
TestHelixSystemKeywords();
TestKeywordMemoryLeak();
TestDynamicApi();
TestCrossRingSDKReflection();
std::cout << "Releasing ComplexEntity ID " << g_p->entityId << " reclaimed.\n";
std::cout << "[System] Process terminating. Globals and Statics will be cleaned by OS now.\n";
return 0;
}
输出
========================================
HELIX USER-MODE ENGINE IGNITED!
========================================
[System] Process Path : D:\Codes\Helix_Framework\Test\x64\Debug\Test.exe
=== Test 1: Complex Serialization & Reflection ===
[Constructor] ComplexEntity ID 1024 created via parameterized constructor.
[PASS] Deserialization restored entityId on Stack Obj
[PASS] Deserialization flawlessly restored function pointer
[PASS] Reflection SetValue correctly modified local Stack Obj memory
--> Testing Deep Nested Reflection (xxxx.yyyy)...
[Constructor] ComplexEntity ID 888 created via parameterized constructor.
[PASS] Nested GetValue traversed pointer 'childNode' to read 'entityId'
[PASS] Nested GetValue penetrated multiple levels (childNode.sensor.sensorId)
[PASS] Nested GetValue read local value-type nested struct (sensor.floatVal)
[PASS] Nested SetValue mutated deep pointer structure field
[PASS] Nested SetValue mutated local value-type nested struct (sensor.status)
[PASS] Nested Invoke dynamically resolved target and executed method with arguments
--> Testing Nested Arrays (T[n], T*[n], void*[n])...
[Constructor] AdvancedArrayNode ID 7777 created.
[PASS] Nested array deserialization preserved base attributes
[PASS] Nested array deserialization flawlessly restored void*[n]
[PASS] Nested array deserialization flawlessly restored T*[n]
[PASS] Nested array deserialization flawlessly restored T[n]
[PASS] SFINAE Reflection dynamically executed method on Nested Array Stack Object
[PASS] Direct TypeTrait Deserialize<T[n]> successfully extracted HArray
[Destructor] AdvancedArrayNode ID 7777 reclaimed.
[Destructor] AdvancedArrayNode ID 7777 reclaimed.
[Destructor] ComplexEntity ID 2048 reclaimed.
=== Test 2: GC Persistence & Extern Validation ===
[Constructor] ComplexEntity ID 1 created via parameterized constructor.
[Constructor] ComplexEntity ID 999 created via parameterized constructor.
[Constructor] ComplexEntity ID 888 created via parameterized constructor.
[Constructor] ComplexEntity ID 777 created via parameterized constructor.
[Constructor] ComplexEntity ID 666 created via parameterized constructor.
[Destructor] ComplexEntity ID 1024 reclaimed.
[Destructor] ComplexEntity ID 888 reclaimed.
--- Inner scope ended. Only ID 1 and 666 should be reclaimed! ---
=== Test 3: Windows Native Struct & Extern Pointer ===
[PASS] Reflection Invoked method updating CLIENT_ID struct natively
[Destructor] ComplexEntity ID 1 reclaimed.
[PASS] Extern int** successfully exported GC pointer using & operator
=== Test 4: Polymorphism & Keywords (virtual, override, final) ===
[FinalWorker] Final task executed by ID 100 with power 9000.
[Destructor] ComplexEntity ID 666 reclaimed.
=== Test 5: Vmp Control Flow Flattening & Obfuscation ===
-> [Vmp Global] Executing protected global logic...
-> Message: This is a VMP protected global function!
-> [Vmp Member] Payload executed. Secret code mutated to: 85
=== Test 6: Advanced Vmp (Recursion, Loops, Global, Static & Extern) ===
[Constructor] ComplexEntity ID 1000 created via parameterized constructor.
[Constructor] ComplexEntity ID 2000 created via parameterized constructor.
[Destructor] ComplexEntity ID 1000 reclaimed.
[Constructor] ComplexEntity ID 3000 created via parameterized constructor.
[Constructor] ComplexEntity ID 4000 created via parameterized constructor.
[Constructor] ComplexEntity ID 5000 created via parameterized constructor.
[Destructor] ComplexEntity ID 4000 reclaimed.
[Constructor] ComplexEntity ID 300 created via parameterized constructor.
[Destructor] NativeResourceConfig PID 19812 reclaimed.
[Constructor] ComplexEntity ID 301 created via parameterized constructor.
[Destructor] ComplexEntity ID 300 reclaimed.
[Constructor] ComplexEntity ID 200 created via parameterized constructor.
[Constructor] ComplexEntity ID 201 created via parameterized constructor.
[Destructor] ComplexEntity ID 200 reclaimed.
[Constructor] ComplexEntity ID 100 created via parameterized constructor.
[Constructor] ComplexEntity ID 101 created via parameterized constructor.
[Destructor] ComplexEntity ID 100 reclaimed.
[Destructor] ComplexEntity ID 301 reclaimed.
[Destructor] ComplexEntity ID 201 reclaimed.
=== Test 7: Loop Memory Leak Prevention ===
[Constructor] ComplexEntity ID 8000 created via parameterized constructor.
[Destructor] FinalWorker ID 100 reclaimed.
[Constructor] ComplexEntity ID 8001 created via parameterized constructor.
[Destructor] ComplexEntity ID 8000 reclaimed.
[Constructor] ComplexEntity ID 8002 created via parameterized constructor.
[Destructor] ComplexEntity ID 8001 reclaimed.
[Constructor] ComplexEntity ID 8003 created via parameterized constructor.
[Destructor] ComplexEntity ID 8002 reclaimed.
[Constructor] ComplexEntity ID 8004 created via parameterized constructor.
[Destructor] ComplexEntity ID 8003 reclaimed.
=== Test 8: Helix System Keywords & Multi-Dimensional Read/Write ===
[System] OS: Windows 11 x64 v10.0 (Build 26100)
[System] HWID: ff5a6707-285e-4286-b054-6076cb71c4cd
[Cpu] Vendor: GenuineIntel | Brand: Intel(R) Core(TM) i9-10900K CPU @ 3.70GHz
[Cpu] Model: Family 6 Model 165 Stepping 5 | Serial: 000A0655BFEBFBFF
[Mac] Found 8 Network Adapter(s):
-> [0] D4:5D:64:B0:7D:74 (Intel(R) Ethernet Controller I225-V)
-> [1] D8:3B:BF:23:09:0F (Bluetooth Device (Personal Area Network))
-> [2] 00:50:56:C0:00:01 (VMware Virtual Ethernet Adapter for VMnet1)
-> [3] 00:50:56:C0:00:08 (VMware Virtual Ethernet Adapter for VMnet8)
-> [4] 00:15:5D:2E:35:6F (Hyper-V Virtual Ethernet Adapter)
-> [5] D8:3B:BF:23:09:0B (Intel(R) Wi-Fi 6 AX201 160MHz)
-> [6] D8:3B:BF:23:09:0C (Microsoft Wi-Fi Direct Virtual Adapter)
-> [7] DA:3B:BF:23:09:0B (Microsoft Wi-Fi Direct Virtual Adapter #2)
[Disk] Found 2 Storage Drive(s):
-> C:\ | Model: Samsung SSD 850 EVO 500GB | Serial: D4780CDB
Space: 242.692 GB Free / 464.808 GB Total
-> D:\ | Model: Samsung SSD 870 EVO 4TB | Serial: D4C5FE73
Space: 1211.77 GB Free / 3726.02 GB Total
--> Testing Local Bypass (PID = -1) Read/Write/Allocate...
[PASS] Local Bypass (-1) flawlessly allocated, wrote, and read stack value via zero-overhead fast path
--> notepad.exe not found. Launching decoy instance...
[PASS] Read<T> flawlessly retrieved memory directly as stack value
--> Testing Cross-Process Nested Arrays Write/Read (T[n], T*[n], void*[n])...
[Constructor] AdvancedArrayNode ID 8888 created.
[Constructor] AdvancedArrayNode ID 9999 created.
[PASS] Write<T[n]> successfully injected Array of Nested Structs (AdvancedArrayNode[2])
[PASS] Read<T[n]> effortlessly retrieved Array Objects
[PASS] Read<T[n]> meticulously extracted nested void*[n]
[PASS] Read<T[n]> meticulously extracted nested T*[n]
[PASS] Read<T[n]> meticulously extracted nested T[n] from second element
[PASS] Read<void*[n]> explicitly pinpointed and extracted subset void* array
--> Simulated memory tracker recorded void* remote allocations (ef460000) for AST cleanup.
[Destructor] AdvancedArrayNode ID 9999 reclaimed.
[Destructor] AdvancedArrayNode ID 8888 reclaimed.
--> Terminating decoy notepad.exe instance...
[Destructor] AdvancedArrayNode ID 9999 reclaimed.
[Destructor] AdvancedArrayNode ID 8888 reclaimed.
=== Test 9: Keyword Zero-Leak Stress Test (10 Iterations) ===
--> Running 10 iterations of New, Cpu, System, Mac, Disk, Read, and Allocate (using Local Bypass -1)...
[Constructor] ComplexEntity ID 99000 created via parameterized constructor.
[Constructor] ComplexEntity ID 99001 created via parameterized constructor.
[Destructor] ComplexEntity ID 99000 reclaimed.
[Constructor] ComplexEntity ID 99002 created via parameterized constructor.
[Destructor] ComplexEntity ID 99001 reclaimed.
[Constructor] ComplexEntity ID 99003 created via parameterized constructor.
[Destructor] ComplexEntity ID 99002 reclaimed.
[Constructor] ComplexEntity ID 99004 created via parameterized constructor.
[Destructor] ComplexEntity ID 99003 reclaimed.
[Constructor] ComplexEntity ID 99005 created via parameterized constructor.
[Destructor] ComplexEntity ID 99004 reclaimed.
[Constructor] ComplexEntity ID 99006 created via parameterized constructor.
[Destructor] ComplexEntity ID 99005 reclaimed.
[Constructor] ComplexEntity ID 99007 created via parameterized constructor.
[Destructor] ComplexEntity ID 99006 reclaimed.
[Constructor] ComplexEntity ID 99008 created via parameterized constructor.
[Destructor] ComplexEntity ID 99007 reclaimed.
[Constructor] ComplexEntity ID 99009 created via parameterized constructor.
[Destructor] ComplexEntity ID 99008 reclaimed.
[PASS] 10 iterations completed (Including Allocate). Memory delta: 0 KB.
=== Test 10: Dynamic API Keyword (Ring 3) ===
[PASS] API Keyword triggered seamlessly! Random Value: 2094848930 (New Seed: 2147395045)
[PASS] Ring 3 Ordinal (ws2_32.dll #115 WSAStartup) Executed Successfully!
[PASS] Ring 3 Ordinal (ntdll.dll #15) Resolved successfully to: 00007FF7C3DBC030
=== Test 11: Cross-Ring Native SDK Struct Reflection ===
[PASS] Deserialize<CLIENT_ID> successfully restored Native SDK Struct (UniqueProcess)
[PASS] Reflec<CLIENT_ID> successfully modified Native SDK Struct field dynamically
[PASS] Deserialize<LIST_ENTRY> successfully restored Doubly-Linked List node
[PASS] Reflec<LIST_ENTRY> successfully modified Doubly-Linked List field dynamically
[PASS] Deserialize<MDL> successfully restored Kernel-Only Struct (ByteCount)
[PASS] Reflec<MDL> successfully modified Kernel-Only Struct field dynamically
[PASS] Deserialize<SYSTEMTIME> successfully restored User-Only Struct (wMonth) inside Ring 3
[PASS] Reflec<SYSTEMTIME> successfully modified User-Only Struct field dynamically inside Ring 3
[Destructor] ComplexEntity ID 5000 reclaimed.
[Destructor] ComplexEntity ID 8004 reclaimed.
[Destructor] ComplexEntity ID 99009 reclaimed.
Releasing ComplexEntity ID 1038 reclaimed.
[System] Process terminating. Globals and Statics will be cleaned by OS now.
[Destructor] ComplexEntity ID 999 reclaimed.
[Destructor] ComplexEntity ID 888 reclaimed.
[Destructor] ComplexEntity ID 777 reclaimed.
[Destructor] ComplexEntity ID 2000 reclaimed.
[Destructor] ComplexEntity ID 3000 reclaimed.
[Destructor] ComplexEntity ID 101 reclaimed.
D:\Codes\Helix_Framework\Test\x64\Debug\Test.exe (进程 19812)已退出，代码为 0 (0x0)。
按任意键关闭此窗口. . .
2. Dll，为了方便大家测试，专门给大家写了一个Dll输出调试。点我下载
DllExample.h
#pragma once #include <iostream> #include <string> #include <vector> #include <stddef.h> #include <ntifs.h> #include <Windows.h> #include <TlHelp32.h> #include <Psapi.h> #include <winternl.h> #include "Helix.h" API() void __stdcall HelixExportedTask(int secretCode); API() int __cdecl CalculateData(const char* payload); using EventCallback = void (*)(int, const char*); #pragma pack(push, 1) struct SensorData { public: short sensorId; Offset(2); union { float floatVal; int intVal; }; char status; unsigned char flagA : 1; unsigned char flagB : 3; unsigned char flagC : 4; }; class ComplexEntity { public: int entityId; Offset(4); SensorData sensor; static ComplexEntity* staticBoss; Extern void* externalResource; ComplexEntity* childNode; Extern EventCallback onEventTriggered; ComplexEntity() = default; ComplexEntity(int id) : entityId(id) { std::cout << "[Constructor] ComplexEntity ID " << entityId << " created via parameterized constructor.\n"; } ~ComplexEntity() { std::cout << "[Destructor] ComplexEntity ID " << entityId << " reclaimed.\n"; } void ProcessData(int multiplier) { sensor.intVal *= multiplier; if (onEventTriggered) { onEventTriggered(entityId, "Data Processed successfully via callback!"); } } }; struct NestedPayload { void* rawPointers[3]; ComplexEntity* entityList[2]; int matrix[4]; }; class AdvancedArrayNode { public: int nodeId; Offset(4); NestedPayload payload; AdvancedArrayNode() = default; AdvancedArrayNode(int id) : nodeId(id) { memset(&payload, 0, sizeof(payload)); std::cout << "[Constructor] AdvancedArrayNode ID " << nodeId << " created.\n"; } ~AdvancedArrayNode() { std::cout << "[Destructor] AdvancedArrayNode ID " << nodeId << " reclaimed.\n"; } void MutateArray(int multiplier) { for (int i = 0; i < 4; i++) { payload.matrix[i] *= multiplier; } } }; #pragma pack(pop) class IWorker { public: virtual ~IWorker() = default; virtual void ExecuteTask() = 0; }; class BaseWorker : public IWorker { public: int baseId; virtual void ExecuteTask() override { std::cout << "[BaseWorker] Task executed by ID " << baseId << ".\n"; } virtual void Upgrade() { baseId += 1; } }; class FinalWorker final : public BaseWorker { public: int powerLevel; void ExecuteTask() override final { std::cout << "[FinalWorker] Final task executed by ID " << baseId << " with power " << powerLevel << ".\n"; } void Upgrade() override { powerLevel += 10; } ~FinalWorker() { std::cout << "[Destructor] FinalWorker ID " << baseId << " reclaimed.\n"; } }; class NativeResourceConfig { public: DWORD targetPid; CLIENT_ID clientId; UNICODE_STRING imagePath; ~NativeResourceConfig() { std::cout << "[Destructor] NativeResourceConfig PID " << targetPid << " reclaimed.\n"; } void InitNativeData() { clientId.UniqueProcess = (HANDLE)(ULONG_PTR)targetPid; clientId.UniqueThread = (HANDLE)0x1337; imagePath.Length = 10; imagePath.MaximumLength = 12; imagePath.Buffer = (PWSTR)L"Helix"; } }; inline void AssignGlobalPointer(Extern int** outPtr) { auto newInt = New<int>(9999); *outPtr = &newInt; } Vmp inline void VmpGlobalFunction(const char* message) { std::cout << " -> [Vmp Global] Executing protected global logic...\n"; std::cout << " -> Message: " << message << "\n"; } class SecurityManager { public: int secretCode = 0; Vmp static bool VerifyLicense(const std::string& key) { std::cout << " -> [Vmp Static] Verifying license key...\n"; if (key == "SECRET-KEY") { std::cout << "[Vmp] License Verified Successfully!\n"; return true; } return false; } Vmp void ExecutePayload() { secretCode ^= 0x55; std::cout << " -> [Vmp Member] Payload executed. Secret code mutated to: " << secretCode << "\n"; } Vmp int ComplexVmpLogic(int multiplier) { int tempCode = 10; this->secretCode += (tempCode * multiplier); if (this->secretCode > 10) { tempCode = 999; } ExecutePayload(); return this->secretCode + tempCode; } }; extern ComplexEntity* g_VmpGlobalNode; class VmpAdvancedTester { public: static ComplexEntity* staticNode; Extern ComplexEntity* externDataNode; Vmp void RecursiveAllocTest(int depth, Extern ComplexEntity** outParam) { if (depth <= 0) return; for (int i = 0; i < 2; i++) { auto node = New<ComplexEntity>(depth * 100 + i); if (depth == 1 && i == 1 && outParam != nullptr) { *outParam = &node; } } RecursiveAllocTest(depth - 1, outParam); } Vmp void LoopAllocAndAssign() { for (int i = 1; i <= 5; i++) { auto node = New<ComplexEntity>(i * 1000); if (i == 2) { g_VmpGlobalNode = &node; } else if (i == 3) { staticNode = &node; } else if (i == 5) { externDataNode = &node; } } } }; // 引擎底层已实现 C++ 名称修饰自适应，无需外包 extern "C" API("ntdll.dll") unsigned long NTAPI RtlRandomEx(unsigned long* Seed); API("ws2_32.dll") int __stdcall _115(unsigned short wVersionRequested, void* lpWSAData); API("ntdll.dll") NTSTATUS NTAPI _15(void* Param1);
dllmain.cpp
#include <iostream> #include <vector> #include <string> #include "DllExample.h" // [API 导出实现] 引擎会自动将这两个函数作为标准 C 符号导出到 DLL 中 // 供外部 EXE 或其他项目完美调用 void __stdcall HelixExportedTask(int secretCode) { std::cout << "\n[Export] HelixExportedTask triggered with SecretCode: " << secretCode << "\n"; } int __cdecl CalculateData(const char* payload) { std::cout << "\n[Export] CalculateData triggered with Payload: " << (payload ? payload : "NULL") << "\n"; if (payload == nullptr) return 0; return 1337; } ComplexEntity* ComplexEntity::staticBoss = nullptr; void* g_PersistentWeapon = nullptr; int* g_PersistentInt = nullptr; ComplexEntity* g_VmpGlobalNode = nullptr; ComplexEntity* VmpAdvancedTester::staticNode = nullptr; void GlobalEventLogger(int id, const char* msg) { std::cout << " -> [Callback Invoked] Entity " << id << " reported: " << msg << "\n"; } DWORD FindProcessId(const char* processName) { DWORD pid = 0; HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hSnap != INVALID_HANDLE_VALUE) { PROCESSENTRY32 pe; pe.dwSize = sizeof(PROCESSENTRY32); if (Process32First(hSnap, &pe)) { do { char exeName[MAX_PATH]; for (int i = 0; i < MAX_PATH && pe.szExeFile[i] != 0; i++) { exeName[i] = (char)pe.szExeFile[i]; } exeName[MAX_PATH - 1] = '\0'; if (_stricmp(exeName, processName) == 0) { pid = pe.th32ProcessID; break; } } while (Process32Next(hSnap, &pe)); } CloseHandle(hSnap); } return pid; } void TestSerializationAndReflection() { std::cout << "=== Test 1: Complex Serialization & Reflection ===\n"; auto assertTest = [](bool condition, const std::string& msg) { if (condition) std::cout << "[PASS] " << msg << "\n"; else std::cout << "[FAIL] " << msg << "\n"; }; auto entity = New<ComplexEntity>(1024); entity->sensor.sensorId = 7; entity->sensor.floatVal = 3.14f; entity->sensor.status = 'A'; entity->sensor.flagA = 1; entity->sensor.flagB = 5; entity->sensor.flagC = 10; entity->onEventTriggered = GlobalEventLogger; std::vector<uint8_t> bytes = Serialize(entity); auto cloned = Deserialize<ComplexEntity>(bytes); assertTest(cloned.entityId == 1024, "Deserialization restored entityId on Stack Obj"); assertTest(cloned.onEventTriggered == GlobalEventLogger, "Deserialization flawlessly restored function pointer"); auto meta = Reflec(cloned); meta.SetValue("entityId", 2048); assertTest(cloned.entityId == 2048, "Reflection SetValue correctly modified local Stack Obj memory"); // 深层嵌套反射漫游测试 (Nested Reflection) std::cout << " --> Testing Deep Nested Reflection (xxxx.yyyy)...\n"; auto childEnt = New<ComplexEntity>(888); childEnt->sensor.sensorId = 42; childEnt->sensor.intVal = 10; cloned.childNode = childEnt; int childId = meta.GetValue<int>("childNode.entityId"); assertTest(childId == 888, "Nested GetValue traversed pointer 'childNode' to read 'entityId'"); short fetchedSensorId = meta.GetValue<short>("childNode.sensor.sensorId"); assertTest(fetchedSensorId == 42, "Nested GetValue penetrated multiple levels (childNode.sensor.sensorId)"); float localfloatVal = meta.GetValue<float>("sensor.floatVal"); assertTest(localfloatVal == 3.14f, "Nested GetValue read local value-type nested struct (sensor.floatVal)"); meta.SetValue("childNode.sensor.sensorId", (short)999); assertTest(cloned.childNode->sensor.sensorId == 999, "Nested SetValue mutated deep pointer structure field"); meta.SetValue("sensor.status", 'Z'); assertTest(cloned.sensor.status == 'Z', "Nested SetValue mutated local value-type nested struct (sensor.status)"); meta.Invoke("childNode.ProcessData", 5); assertTest(cloned.childNode->sensor.intVal == 50, "Nested Invoke dynamically resolved target and executed method with arguments"); std::cout << " --> Testing Nested Arrays (T[n], T*[n], void*[n])...\n"; AdvancedArrayNode advNode(7777); advNode.payload.rawPointers[0] = (void*)(intptr_t)0xDEADBEEF; advNode.payload.rawPointers[1] = (void*)(intptr_t)0xCAFEBABE; advNode.payload.entityList[0] = (ComplexEntity*)entity; advNode.payload.matrix[0] = 10; advNode.payload.matrix[1] = 20; auto advBytes = Serialize(advNode); auto advCloned = Deserialize<AdvancedArrayNode>(advBytes); assertTest(advCloned.nodeId == 7777, "Nested array deserialization preserved base attributes"); assertTest(advCloned.payload.rawPointers[0] == (void*)(intptr_t)0xDEADBEEF, "Nested array deserialization flawlessly restored void*[n]"); assertTest(advCloned.payload.entityList[0] == (ComplexEntity*)entity, "Nested array deserialization flawlessly restored T*[n]"); assertTest(advCloned.payload.matrix[1] == 20, "Nested array deserialization flawlessly restored T[n]"); auto advMeta = Reflec(advCloned); advMeta.Invoke("MutateArray", 5); assertTest(advCloned.payload.matrix[0] == 50 && advCloned.payload.matrix[1] == 100, "SFINAE Reflection dynamically executed method on Nested Array Stack Object"); int testArr[3] = { 100, 200, 300 }; auto arrBytes = Serialize<int[3]>(testArr); auto arrCloned = Deserialize<int[3]>(arrBytes); assertTest(arrCloned[0] == 100 && arrCloned[2] == 300, "Direct TypeTrait Deserialize<T[n]> successfully extracted HArray"); std::cout << "\n"; } void TestGCAndPersistence() { std::cout << "=== Test 2: GC Persistence & Extern Validation ===\n"; { auto tempObj = New<ComplexEntity>(1); auto bossObj = New<ComplexEntity>(999); ComplexEntity::staticBoss = &bossObj; auto weaponObj = New<ComplexEntity>(888); g_PersistentWeapon = &weaponObj; auto extObj = New<ComplexEntity>(777); bossObj->externalResource = &extObj; auto childObj = New<ComplexEntity>(666); tempObj->childNode = &childObj; } std::cout << "--- Inner scope ended. Only ID 1 and 666 should be reclaimed! ---\n\n"; } void TestWinApiAndExtern() { std::cout << "=== Test 3: Windows Native Struct & Extern Pointer ===\n"; auto assertTest = [](bool condition, const std::string& msg) { if (condition) std::cout << "[PASS] " << msg << "\n"; else std::cout << "[FAIL] " << msg << "\n"; }; auto nativeCfg = New<NativeResourceConfig>(); nativeCfg->targetPid = GetCurrentProcessId(); auto meta = Reflec(nativeCfg); meta.Invoke("InitNativeData"); assertTest(nativeCfg->clientId.UniqueProcess == (HANDLE)(ULONG_PTR)nativeCfg->targetPid, "Reflection Invoked method updating CLIENT_ID struct natively"); AssignGlobalPointer(&g_PersistentInt); assertTest(g_PersistentInt != nullptr && *g_PersistentInt == 9999, "Extern int** successfully exported GC pointer using & operator"); std::cout << "\n"; } void TestPolymorphism() { std::cout << "=== Test 4: Polymorphism & Keywords (virtual, override, final) ===\n"; auto finalObj = New<FinalWorker>(); finalObj->baseId = 100; finalObj->powerLevel = 9000; IWorker* interfacePtr = &finalObj; std::cout << " "; interfacePtr->ExecuteTask(); std::cout << "\n"; } void TestVmpAnnotations() { std::cout << "=== Test 5: Vmp Control Flow Flattening & Obfuscation ===\n"; VmpGlobalFunction("This is a VMP protected global function!"); auto secMgr = New<SecurityManager>(); secMgr->ExecutePayload(); std::cout << "\n"; } void TestAdvancedVmp() { std::cout << "=== Test 6: Advanced Vmp (Recursion, Loops, Global, Static & Extern) ===\n"; auto tester = New<VmpAdvancedTester>(); tester->LoopAllocAndAssign(); ComplexEntity* recursiveOut = nullptr; tester->RecursiveAllocTest(3, &recursiveOut); std::cout << "\n"; } void TestLoopMemoryLeak() { std::cout << "=== Test 7: Loop Memory Leak Prevention ===\n"; for (int i = 0; i < 5; i++) { void* p = New<ComplexEntity>(8000 + i); } std::cout << "\n"; } void TestHelixSystemKeywords() { std::cout << "=== Test 8: Helix System Keywords & Multi-Dimensional Read/Write ===\n"; auto assertTest = [](bool condition, const std::string& msg) { if (condition) std::cout << "[PASS] " << msg << "\n"; else std::cout << "[FAIL] " << msg << "\n"; }; // 1. 获取系统信息 (System Keyword) auto sys = System(); if (sys != nullptr) { std::cout << "[System] OS: " << sys->OSName << " v" << sys->MajorVersion << "." << sys->MinorVersion << " (Build " << sys->BuildNumber << ")\n"; std::cout << "[System] HWID: " << sys->SerialNumber << "\n"; } // 2. 获取 CPU 信息 (Cpu Keyword) auto cpu = Cpu(); if (cpu != nullptr) { std::cout << "[Cpu] Vendor: " << cpu->Vendor << " | Brand: " << cpu->Brand << "\n"; std::cout << "[Cpu] Model: " << cpu->ModelName << " | Serial: " << cpu->SerialNumber << "\n"; } // 3. 获取物理网卡 MAC 阵列 (Mac Keyword) auto macs = Mac(); if (macs != nullptr && macs->size() > 0) { std::cout << "[Mac] Found " << macs->size() << " Network Adapter(s):\n"; for (size_t i = 0; i < macs->size(); i++) { std::cout << " -> [" << i << "] " << (*macs)[i].MacAddress << " (" << (*macs)[i].Description << ")\n"; } } // 4. 获取磁盘信息阵列 (Disk Keyword)，例如Disk("c") auto disks = Disk(); if (disks != nullptr && disks->size() > 0) { std::cout << "[Disk] Found " << disks->size() << " Storage Drive(s):\n"; for (size_t i = 0; i < disks->size(); i++) { // 使用 full precision 计算，保留为双精度浮点数显示 GB double totalGB = (double)(*disks)[i].TotalSize / (1024.0 * 1024.0 * 1024.0); double freeGB = (double)(*disks)[i].FreeSpace / (1024.0 * 1024.0 * 1024.0); std::cout << " -> " << (*disks)[i].DriveLetter << " | Model: " << (*disks)[i].Model << " | Serial: " << (*disks)[i].SerialNumber << "\n" << " Space: " << freeGB << " GB Free / " << totalGB << " GB Total\n"; } } std::cout << "\n"; // PID = -1 彻底绕过系统调用，实现零开销原生访问 std::cout << " --> Testing Local Bypass (PID = -1) Read/Write/Allocate...\n"; void* localMem = Allocate(-1, sizeof(int)); if (localMem) { int payload = 7777; Write(-1, localMem, payload); auto pureVal = Read<int>(-1, localMem); assertTest(pureVal == 7777, "Local Bypass (-1) flawlessly allocated, wrote, and read stack value via zero-overhead fast path"); } DWORD notepadPid = FindProcessId("notepad.exe"); bool createdNotepad = false; HANDLE hNotepad = NULL; if (notepadPid == 0) { std::cout << " --> notepad.exe not found. Launching decoy instance...\n"; STARTUPINFOA si = { sizeof(si) }; PROCESS_INFORMATION pi = { 0 }; if (CreateProcessA(nullptr, (LPSTR)"notepad.exe", nullptr, nullptr, FALSE, 0, nullptr, nullptr, &si, &pi)) { notepadPid = pi.dwProcessId; hNotepad = pi.hProcess; CloseHandle(pi.hThread); createdNotepad = true; Sleep(500); } } else { hNotepad = OpenProcess(PROCESS_ALL_ACCESS, FALSE, notepadPid); } if (notepadPid != 0 && hNotepad != NULL) { void* pRemoteMem = Allocate(notepadPid, sizeof(int)); int remoteAddrInt = (int)(intptr_t)pRemoteMem; if (pRemoteMem) { int payload = 1337; Write(notepadPid, pRemoteMem, payload); auto pureVal = Read<int>(notepadPid, pRemoteMem); assertTest(pureVal == 1337, "Read<T> flawlessly retrieved memory directly as stack value"); } std::cout << " --> Testing Cross-Process Nested Arrays Write/Read (T[n], T*[n], void*[n])...\n"; AdvancedArrayNode localAdvArr[2] = { AdvancedArrayNode(8888), AdvancedArrayNode(9999) }; localAdvArr[0].payload.rawPointers[0] = (void*)(intptr_t)0x11112222; localAdvArr[0].payload.entityList[1] = (ComplexEntity*)(intptr_t)0x33334444; localAdvArr[1].payload.matrix[3] = 777; void* remoteAdvArray = Allocate(notepadPid, sizeof(AdvancedArrayNode) * 2); if (remoteAdvArray != nullptr) { int wStatus = Write<AdvancedArrayNode[2]>(notepadPid, remoteAdvArray, localAdvArr); assertTest(wStatus == 1, "Write<T[n]> successfully injected Array of Nested Structs (AdvancedArrayNode[2])"); auto readAdvArr = Read<AdvancedArrayNode[2]>(notepadPid, remoteAdvArray); assertTest(readAdvArr[0].nodeId == 8888 && readAdvArr[1].nodeId == 9999, "Read<T[n]> effortlessly retrieved Array Objects"); assertTest(readAdvArr[0].payload.rawPointers[0] == (void*)(intptr_t)0x11112222, "Read<T[n]> meticulously extracted nested void*[n]"); assertTest(readAdvArr[0].payload.entityList[1] == (ComplexEntity*)(intptr_t)0x33334444, "Read<T[n]> meticulously extracted nested T*[n]"); assertTest(readAdvArr[1].payload.matrix[3] == 777, "Read<T[n]> meticulously extracted nested T[n] from second element"); void* rawPointersAddr = (void*)((uintptr_t)remoteAdvArray + offsetof(AdvancedArrayNode, payload) + offsetof(NestedPayload, rawPointers)); auto remoteVoidArray = Read<void* [3]>(notepadPid, rawPointersAddr); assertTest(remoteVoidArray[0] == (void*)(intptr_t)0x11112222, "Read<void*[n]> explicitly pinpointed and extracted subset void* array"); std::cout << " --> Simulated memory tracker recorded void* remote allocations (" << std::hex << remoteAddrInt << std::dec << ") for AST cleanup.\n"; } if (createdNotepad) { std::cout << " --> Terminating decoy notepad.exe instance...\n"; TerminateProcess(hNotepad, 0); } CloseHandle(hNotepad); } std::cout << "\n"; } Extern ComplexEntity* g_p; Vmp void TestKeywordMemoryLeak() { std::cout << "=== Test 9: Keyword Zero-Leak Stress Test (10 Iterations) ===\n"; PROCESS_MEMORY_COUNTERS pmcBefore; GetProcessMemoryInfo(GetCurrentProcess(), &pmcBefore, sizeof(pmcBefore)); int dummyVar = 42; std::cout << " --> Running 10 iterations of New, Cpu, System, Mac, Disk, Read, and Allocate (using Local Bypass -1)...\n"; for (int i = 0; i < 10; i++) { auto cpu = Cpu(); auto sys = System(); //auto macs = Mac(); auto disks = Disk(); // 使用 -1 实现本进程内存无系统调用开销的极速操作 auto pureVal = Read<int>(-1, &dummyVar); auto dummyObj = New<ComplexEntity>(99000 + i); void* localMem = Allocate(-1, 256); } PROCESS_MEMORY_COUNTERS pmcAfter; GetProcessMemoryInfo(GetCurrentProcess(), &pmcAfter, sizeof(pmcAfter)); long long diffKB = ((long long)pmcAfter.WorkingSetSize - (long long)pmcBefore.WorkingSetSize) / 1024; g_p = Allocate((uint32_t)-1, sizeof(ComplexEntity)); g_p->entityId = 1038; std::cout << "[PASS] 10 iterations completed (Including Allocate). Memory delta: " << diffKB << " KB.\n"; std::cout << "\n"; } void TestDynamicApi() { std::cout << "=== Test 10: Dynamic API Keyword (Ring 3) ===\n"; unsigned long seed = 0x1337; unsigned long randomVal = RtlRandomEx(&seed); if (randomVal != 0) { std::cout << "[PASS] API Keyword triggered seamlessly! Random Value: " << randomVal << " (New Seed: " << seed << ")\n"; } else { std::cout << "[FAIL] API Keyword failed or returned 0.\n"; } char wsaData[512] = { 0 }; int wsaStatus = _115(0x0202, wsaData); // 传入 MAKEWORD(2,2) if (wsaStatus == 0) { std::cout << "[PASS] Ring 3 Ordinal (ws2_32.dll #115 WSAStartup) Executed Successfully!\n"; } else { std::cout << "[FAIL] Ring 3 Ordinal failed or returned: " << wsaStatus << "\n"; } void* funcPtr15 = (void*)_15; if (funcPtr15 != nullptr) { std::cout << "[PASS] Ring 3 Ordinal (ntdll.dll #15) Resolved successfully to: " << funcPtr15 << "\n"; } else { std::cout << "[FAIL] Ring 3 Ordinal failed to resolve.\n"; } std::cout << "\n"; } void TestCrossRingSDKReflection() { auto assertTest = [](bool condition, const std::string& msg) { if (condition) std::cout << "[PASS] " << msg << "\n"; else std::cout << "[FAIL] " << msg << "\n"; }; std::cout << "=== Test 11: Cross-Ring Native SDK Struct Reflection ===\n"; auto clientIdObj = New<CLIENT_ID>(); auto metaClientWrite = Reflec(clientIdObj); metaClientWrite.SetValue("UniqueProcess", (HANDLE)(intptr_t)0x1234); metaClientWrite.SetValue("UniqueThread", (HANDLE)(intptr_t)0x5678); auto cidBytes = Serialize(clientIdObj); auto cidCloned = Deserialize<CLIENT_ID>(cidBytes); auto metaClientRead = Reflec(cidCloned); assertTest(metaClientRead.GetValue<HANDLE>("UniqueProcess") == (HANDLE)(intptr_t)0x1234, "Deserialize<CLIENT_ID> successfully restored Native SDK Struct (UniqueProcess)"); metaClientRead.SetValue("UniqueThread", (HANDLE)(intptr_t)0x9999); assertTest(metaClientRead.GetValue<HANDLE>("UniqueThread") == (HANDLE)(intptr_t)0x9999, "Reflec<CLIENT_ID> successfully modified Native SDK Struct field dynamically"); auto listEntryObj = New<LIST_ENTRY>(); auto metaListWrite = Reflec(listEntryObj); metaListWrite.SetValue("Flink", (PLIST_ENTRY)(intptr_t)0xAAAA); metaListWrite.SetValue("Blink", (PLIST_ENTRY)(intptr_t)0xBBBB); auto listBytes = Serialize(listEntryObj); auto listCloned = Deserialize<LIST_ENTRY>(listBytes); auto metaListRead = Reflec(listCloned); assertTest(metaListRead.GetValue<PLIST_ENTRY>("Blink") == (PLIST_ENTRY)(intptr_t)0xBBBB, "Deserialize<LIST_ENTRY> successfully restored Doubly-Linked List node"); metaListRead.SetValue("Flink", (PLIST_ENTRY)(intptr_t)0xCCCC); assertTest(metaListRead.GetValue<PLIST_ENTRY>("Flink") == (PLIST_ENTRY)(intptr_t)0xCCCC, "Reflec<LIST_ENTRY> successfully modified Doubly-Linked List field dynamically"); auto mdlObj = New<MDL>(); auto metaMdlWrite = Reflec(mdlObj); metaMdlWrite.SetValue("Size", (short)1024); metaMdlWrite.SetValue("MdlFlags", (short)0x0004); metaMdlWrite.SetValue("ByteCount", (unsigned long)4096); auto mdlBytes = Serialize(mdlObj); auto mdlCloned = Deserialize<MDL>(mdlBytes); auto metaMdlRead = Reflec(mdlCloned); assertTest(metaMdlRead.GetValue<unsigned long>("ByteCount") == 4096, "Deserialize<MDL> successfully restored Kernel-Only Struct (ByteCount)"); metaMdlRead.SetValue("MdlFlags", (short)0x0008); assertTest(metaMdlRead.GetValue<short>("MdlFlags") == 0x0008, "Reflec<MDL> successfully modified Kernel-Only Struct field dynamically"); auto sysTimeObj = New<SYSTEMTIME>(); auto metaSysTimeWrite = Reflec(sysTimeObj); metaSysTimeWrite.SetValue("wYear", (unsigned short)2026); metaSysTimeWrite.SetValue("wMonth", (unsigned short)8); auto sysTimeBytes = Serialize(sysTimeObj); auto sysTimeCloned = Deserialize<SYSTEMTIME>(sysTimeBytes); auto metaSysTimeRead = Reflec(sysTimeCloned); assertTest(metaSysTimeRead.GetValue<unsigned short>("wMonth") == 8, "Deserialize<SYSTEMTIME> successfully restored User-Only Struct (wMonth) inside Ring 3"); metaSysTimeRead.SetValue("wYear", (unsigned short)2099); assertTest(metaSysTimeRead.GetValue<unsigned short>("wYear") == 2099, "Reflec<SYSTEMTIME> successfully modified User-Only Struct field dynamically inside Ring 3"); std::cout << "\n"; } int main(void** args) { if (!args) return 0; DWORD loadReason = (DWORD)(unsigned long long)args[2]; void* lpvReserved = args[3]; switch (loadReason) { case DLL_PROCESS_ATTACH: { CreateThread(nullptr, 0, [](LPVOID lpParam) -> DWORD { void** args = (void**)lpParam; std::cout << "========================================\n"; std::cout << " HELIX DLL ENGINE IGNITED! \n"; std::cout << "========================================\n\n"; std::cout << "[System] DLL Full Path : " << (char*)args[0] << "\n"; std::cout << "[System] Module Base : " << args[1] << "\n"; std::cout << "[System] Load Reason : DLL_PROCESS_ATTACH\n\n"; TestSerializationAndReflection(); TestGCAndPersistence(); TestWinApiAndExtern(); TestPolymorphism(); TestVmpAnnotations(); TestAdvancedVmp(); TestLoopMemoryLeak(); TestHelixSystemKeywords(); TestKeywordMemoryLeak(); TestDynamicApi(); TestCrossRingSDKReflection(); return 0; }, args, 0, nullptr); } break; case DLL_THREAD_ATTACH: break; case DLL_THREAD_DETACH: break; case DLL_PROCESS_DETACH: std::cout << "Releasing ComplexEntity ID " << g_p->entityId << " reclaimed.\n"; std::cout << "\n[System] Load Reason : DLL_PROCESS_DETACH\n"; std::cout << "[System] Helix DLL is safely shutting down...\n"; break; } return 0; }
输出（来自我们DllLoader.exe）
[系统] 控制台子系统初始化完成。
[系统] 准备加载动态链接库...
[成功] 模块加载成功 -> D:\Codes\Helix_Framework\TestDll\x64\Debug\TestDll.dll
[主机] 发起模块注入测试...
========================================
HELIX DLL ENGINE IGNITED!
========================================
[System] DLL Full Path : D:\Codes\Helix_Framework\TestDll\x64\Debug\TestDll.dll
[System] Module Base : 00007FFB0E140000
[System] Load Reason : DLL_PROCESS_ATTACH
=== Test 1: Complex Serialization & Reflection ===
[Constructor] ComplexEntity ID 1024 created via parameterized constructor.
[PASS] Deserialization restored entityId on Stack Obj
[PASS] Deserialization flawlessly restored function pointer
[PASS] Reflection SetValue correctly modified local Stack Obj memory
--> Testing Deep Nested Reflection (xxxx.yyyy)...
[Constructor] ComplexEntity ID 888 created via parameterized constructor.
[PASS] Nested GetValue traversed pointer 'childNode' to read 'entityId'
[PASS] Nested GetValue penetrated multiple levels (childNode.sensor.sensorId)
[PASS] Nested GetValue read local value-type nested struct (sensor.floatVal)
[PASS] Nested SetValue mutated deep pointer structure field
[PASS] Nested SetValue mutated local value-type nested struct (sensor.status)
[PASS] Nested Invoke dynamically resolved target and executed method with arguments
--> Testing Nested Arrays (T[n], T*[n], void*[n])...
[Constructor] AdvancedArrayNode ID 7777 created.
[PASS] Nested array deserialization preserved base attributes
[PASS] Nested array deserialization flawlessly restored void*[n]
[PASS] Nested array deserialization flawlessly restored T*[n]
[PASS] Nested array deserialization flawlessly restored T[n]
[PASS] SFINAE Reflection dynamically executed method on Nested Array Stack Object
[PASS] Direct TypeTrait Deserialize<T[n]> successfully extracted HArray
[Destructor] AdvancedArrayNode ID 7777 reclaimed.
[Destructor] AdvancedArrayNode ID 7777 reclaimed.
[Destructor] ComplexEntity ID 2048 reclaimed.
=== Test 2: GC Persistence & Extern Validation ===
[Constructor] ComplexEntity ID 1 created via parameterized constructor.
[Constructor] ComplexEntity ID 999 created via parameterized constructor.
[Constructor] ComplexEntity ID 888 created via parameterized constructor.
[Constructor] ComplexEntity ID 777 created via parameterized constructor.
[Constructor] ComplexEntity ID 666 created via parameterized constructor.
[Destructor] ComplexEntity ID 1024 reclaimed.
[Destructor] ComplexEntity ID 888 reclaimed.
--- Inner scope ended. Only ID 1 and 666 should be reclaimed! ---
=== Test 3: Windows Native Struct & Extern Pointer ===
[PASS] Reflection Invoked method updating CLIENT_ID struct natively
[Destructor] ComplexEntity ID 1 reclaimed.
[PASS] Extern int** successfully exported GC pointer using & operator
=== Test 4: Polymorphism & Keywords (virtual, override, final) ===
[FinalWorker] Final task executed by ID 100 with power 9000.
[Destructor] ComplexEntity ID 666 reclaimed.
=== Test 5: Vmp Control Flow Flattening & Obfuscation ===
-> [Vmp Global] Executing protected global logic...
-> Message: This is a VMP protected global function!
-> [Vmp Member] Payload executed. Secret code mutated to: 85
=== Test 6: Advanced Vmp (Recursion, Loops, Global, Static & Extern) ===
[Constructor] ComplexEntity ID 1000 created via parameterized constructor.
[Constructor] ComplexEntity ID 2000 created via parameterized constructor.
[Destructor] ComplexEntity ID 1000 reclaimed.
[Constructor] ComplexEntity ID 3000 created via parameterized constructor.
[Constructor] ComplexEntity ID 4000 created via parameterized constructor.
[Constructor] ComplexEntity ID 5000 created via parameterized constructor.
[Destructor] ComplexEntity ID 4000 reclaimed.
[Constructor] ComplexEntity ID 300 created via parameterized constructor.
[Destructor] NativeResourceConfig PID 24620 reclaimed.
[Constructor] ComplexEntity ID 301 created via parameterized constructor.
[Destructor] ComplexEntity ID 300 reclaimed.
[Constructor] ComplexEntity ID 200 created via parameterized constructor.
[Constructor] ComplexEntity ID 201 created via parameterized constructor.
[Destructor] ComplexEntity ID 200 reclaimed.
[Constructor] ComplexEntity ID 100 created via parameterized constructor.
[Constructor] ComplexEntity ID 101 created via parameterized constructor.
[Destructor] ComplexEntity ID 100 reclaimed.
[Destructor] ComplexEntity ID 301 reclaimed.
[Destructor] ComplexEntity ID 201 reclaimed.
=== Test 7: Loop Memory Leak Prevention ===
[Constructor] ComplexEntity ID 8000 created via parameterized constructor.
[Destructor] FinalWorker ID 100 reclaimed.
[Constructor] ComplexEntity ID 8001 created via parameterized constructor.
[Destructor] ComplexEntity ID 8000 reclaimed.
[Constructor] ComplexEntity ID 8002 created via parameterized constructor.
[Destructor] ComplexEntity ID 8001 reclaimed.
[Constructor] ComplexEntity ID 8003 created via parameterized constructor.
[Destructor] ComplexEntity ID 8002 reclaimed.
[Constructor] ComplexEntity ID 8004 created via parameterized constructor.
[Destructor] ComplexEntity ID 8003 reclaimed.
=== Test 8: Helix System Keywords & Multi-Dimensional Read/Write ===
[System] OS: Windows 11 x64 v10.0 (Build 26100)
[System] HWID: ff5a6707-285e-4286-b054-6076cb71c4cd
[Cpu] Vendor: GenuineIntel | Brand: Intel(R) Core(TM) i9-10900K CPU @ 3.70GHz
[Cpu] Model: Family 6 Model 165 Stepping 5 | Serial: 000A0655BFEBFBFF
[Mac] Found 8 Network Adapter(s):
-> [0] D4:5D:64:B0:7D:74 (Intel(R) Ethernet Controller I225-V)
-> [1] D8:3B:BF:23:09:0F (Bluetooth Device (Personal Area Network))
-> [2] 00:50:56:C0:00:01 (VMware Virtual Ethernet Adapter for VMnet1)
-> [3] 00:50:56:C0:00:08 (VMware Virtual Ethernet Adapter for VMnet8)
-> [4] 00:15:5D:2E:35:6F (Hyper-V Virtual Ethernet Adapter)
-> [5] D8:3B:BF:23:09:0B (Intel(R) Wi-Fi 6 AX201 160MHz)
-> [6] D8:3B:BF:23:09:0C (Microsoft Wi-Fi Direct Virtual Adapter)
-> [7] DA:3B:BF:23:09:0B (Microsoft Wi-Fi Direct Virtual Adapter #2)
[Disk] Found 2 Storage Drive(s):
-> C:\ | Model: Samsung SSD 850 EVO 500GB | Serial: D4780CDB
Space: 242.64 GB Free / 464.808 GB Total
-> D:\ | Model: Samsung SSD 870 EVO 4TB | Serial: D4C5FE73
Space: 1212.01 GB Free / 3726.02 GB Total
--> Testing Local Bypass (PID = -1) Read/Write/Allocate...
[PASS] Local Bypass (-1) flawlessly allocated, wrote, and read stack value via zero-overhead fast path
--> notepad.exe not found. Launching decoy instance...
[PASS] Read<T> flawlessly retrieved memory directly as stack value
--> Testing Cross-Process Nested Arrays Write/Read (T[n], T*[n], void*[n])...
[Constructor] AdvancedArrayNode ID 8888 created.
[Constructor] AdvancedArrayNode ID 9999 created.
[PASS] Write<T[n]> successfully injected Array of Nested Structs (AdvancedArrayNode[2])
[PASS] Read<T[n]> effortlessly retrieved Array Objects
[PASS] Read<T[n]> meticulously extracted nested void*[n]
[PASS] Read<T[n]> meticulously extracted nested T*[n]
[PASS] Read<T[n]> meticulously extracted nested T[n] from second element
[PASS] Read<void*[n]> explicitly pinpointed and extracted subset void* array
--> Simulated memory tracker recorded void* remote allocations (fd3a0000) for AST cleanup.
[Destructor] AdvancedArrayNode ID 9999 reclaimed.
[Destructor] AdvancedArrayNode ID 8888 reclaimed.
--> Terminating decoy notepad.exe instance...
[Destructor] AdvancedArrayNode ID 9999 reclaimed.
[Destructor] AdvancedArrayNode ID 8888 reclaimed.
=== Test 9: Keyword Zero-Leak Stress Test (10 Iterations) ===
--> Running 10 iterations of New, Cpu, System, Mac, Disk, Read, and Allocate (using Local Bypass -1)...
[Constructor] ComplexEntity ID 99000 created via parameterized constructor.
[Constructor] ComplexEntity ID 99001 created via parameterized constructor.
[Destructor] ComplexEntity ID 99000 reclaimed.
[Constructor] ComplexEntity ID 99002 created via parameterized constructor.
[Destructor] ComplexEntity ID 99001 reclaimed.
[Constructor] ComplexEntity ID 99003 created via parameterized constructor.
[Destructor] ComplexEntity ID 99002 reclaimed.
[Constructor] ComplexEntity ID 99004 created via parameterized constructor.
[Destructor] ComplexEntity ID 99003 reclaimed.
[Constructor] ComplexEntity ID 99005 created via parameterized constructor.
[Destructor] ComplexEntity ID 99004 reclaimed.
[Constructor] ComplexEntity[成功] 模块已安全卸载。
ID 99006 created via parameterized constructor.
[Destructor] ComplexEntity ID 99005 reclaimed.
[Constructor] ComplexEntity ID 99007 created via parameterized constructor.
[Destructor] ComplexEntity ID 99006 reclaimed.
[Constructor] ComplexEntity ID 99008 created via parameterized constructor.
[Destructor] ComplexEntity ID 99007 reclaimed.
[Constructor] ComplexEntity ID 99009 created via parameterized constructor.
[Destructor] ComplexEntity ID 99008 reclaimed.
[PASS] 10 iterations completed (Including Allocate). Memory delta: 0 KB.
=== Test 10: Dynamic API Keyword (Ring 3) ===
[PASS] API Keyword triggered seamlessly! Random Value: 4264093569 (New Seed: 2147395045)
[PASS] Ring 3 Ordinal (ws2_32.dll #115 WSAStartup) Executed Successfully!
[PASS] Ring 3 Ordinal (ntdll.dll #15) Resolved successfully to: 00007FFB0E16BFCC
=== Test 11: Cross-Ring Native SDK Struct Reflection ===
[PASS] Deserialize<CLIENT_ID> successfully restored Native SDK Struct (UniqueProcess)
[PASS] Reflec<CLIENT_ID> successfully modified Native SDK Struct field dynamically
[PASS] Deserialize<LIST_ENTRY> successfully restored Doubly-Linked List node
[PASS] Reflec<LIST_ENTRY> successfully modified Doubly-Linked List field dynamically
[PASS] Deserialize<MDL> successfully restored Kernel-Only Struct (ByteCount)
[PASS] Reflec<MDL> successfully modified Kernel-Only Struct field dynamically
[PASS] Deserialize<SYSTEMTIME> successfully restored User-Only Struct (wMonth) inside Ring 3
[PASS] Reflec<SYSTEMTIME> successfully modified User-Only Struct field dynamically inside Ring 3
[Destructor] ComplexEntity ID 5000 reclaimed.
[Destructor] ComplexEntity ID 8004 reclaimed.
[Destructor] ComplexEntity ID 99009 reclaimed.
Releasing ComplexEntity ID 1038 reclaimed.
[System] Load Reason : DLL_PROCESS_DETACH
[System] Helix DLL is safely shutting down...
[Destructor] ComplexEntity ID 999 reclaimed.
[Destructor] ComplexEntity ID 888 reclaimed.
[Destructor] ComplexEntity ID 777 reclaimed.
[Destructor] ComplexEntity ID 2000 reclaimed.
[Destructor] ComplexEntity ID 3000 reclaimed.
[Destructor] ComplexEntity ID 101 reclaimed.
3. Sys
ComplexTest.h
#pragma once #include <stddef.h> // [跨 Ring 包含装甲] // VSIX 引擎会自动将其隔离，并逆向提取出 Ring 3 的特有结构体 // 为 Ring 0 提供完美的 1:1 像素级 Polyfill 支持！ #include <Windows.h> #include <TlHelp32.h> #include <Psapi.h> #include <winternl.h> #include <ntifs.h> #include "Helix.h" using EventCallback = void (*)(int, const char*); // [原生内核 API 声明] // 使用引擎的 API 宏动态解析 ntoskrnl.exe 导出函数 API("ntoskrnl.exe") unsigned long NTAPI RtlRandomEx(unsigned long* Seed); API("ntoskrnl.exe") NTSTATUS NTAPI _15(void* Param1); API("ntoskrnl.exe") NTSTATUS NTAPI ZwQuerySystemInformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength); #pragma pack(push, 1) struct SensorData { public: short sensorId; Offset(2); union { float floatVal; int intVal; }; char status; unsigned char flagA : 1; unsigned char flagB : 3; unsigned char flagC : 4; }; class ComplexEntity { public: int entityId; Offset(4); SensorData sensor; static ComplexEntity* staticBoss; Extern void* externalResource; ComplexEntity* childNode; Extern EventCallback onEventTriggered; ComplexEntity() = default; ComplexEntity(int id) : entityId(id) { DbgPrint("[Constructor] ComplexEntity ID %d created via parameterized constructor.\n", entityId); } ~ComplexEntity() { DbgPrint("[Destructor] ComplexEntity ID %d reclaimed.\n", entityId); } void ProcessData(int multiplier) { sensor.intVal *= multiplier; if (onEventTriggered) { onEventTriggered(entityId, "Data Processed successfully via callback!"); } } }; struct NestedPayload { void* rawPointers[3]; ComplexEntity* entityList[2]; int matrix[4]; }; class AdvancedArrayNode { public: int nodeId; Offset(4); NestedPayload payload; AdvancedArrayNode() = default; AdvancedArrayNode(int id) : nodeId(id) { memset(&payload, 0, sizeof(payload)); DbgPrint("[Constructor] AdvancedArrayNode ID %d created.\n", nodeId); } ~AdvancedArrayNode() { DbgPrint("[Destructor] AdvancedArrayNode ID %d reclaimed.\n", nodeId); } void MutateArray(int multiplier) { for (int i = 0; i < 4; i++) { payload.matrix[i] *= multiplier; } } }; #pragma pack(pop) class IWorker { public: virtual ~IWorker() = default; virtual void ExecuteTask() = 0; }; class BaseWorker : public IWorker { public: int baseId; virtual void ExecuteTask() override { DbgPrint("[BaseWorker] Task executed by ID %d.\n", baseId); } virtual void Upgrade() { baseId += 1; } }; class FinalWorker final : public BaseWorker { public: int powerLevel; void ExecuteTask() override final { DbgPrint("[FinalWorker] Final task executed by ID %d with power %d.\n", baseId, powerLevel); } void Upgrade() override { powerLevel += 10; } ~FinalWorker() { DbgPrint("[Destructor] FinalWorker ID %d reclaimed.\n", baseId); } }; class NativeResourceConfig { public: DWORD targetPid; CLIENT_ID clientId; UNICODE_STRING imagePath; ~NativeResourceConfig() { DbgPrint("[Destructor] NativeResourceConfig PID %d reclaimed.\n", targetPid); } void InitNativeData() { clientId.UniqueProcess = (HANDLE)(ULONG_PTR)targetPid; clientId.UniqueThread = (HANDLE)0x1337; imagePath.Length = 10; imagePath.MaximumLength = 12; imagePath.Buffer = (PWSTR)L"Helix"; } }; inline void AssignGlobalPointer(Extern int** outPtr) { auto newInt = New<int>(9999); *outPtr = &newInt; } Vmp inline void VmpGlobalFunction(const char* message) { DbgPrint(" -> [Vmp Global] Executing protected global logic...\n"); DbgPrint(" -> Message: %s\n", message); } class SecurityManager { public: int secretCode = 0; Vmp static bool VerifyLicense(const char* key) { DbgPrint(" -> [Vmp Static] Verifying license key...\n"); bool match = true; const char* secret = "SECRET-KEY"; for (int i = 0; i < 10; ++i) { if (key[i] != secret[i]) match = false; } if (match) { DbgPrint("[Vmp] License Verified Successfully!\n"); return true; } return false; } Vmp void ExecutePayload() { secretCode ^= 0x55; DbgPrint(" -> [Vmp Member] Payload executed. Secret code mutated to: %d\n", secretCode); } Vmp int ComplexVmpLogic(int multiplier) { int tempCode = 10; this->secretCode += (tempCode * multiplier); if (this->secretCode > 10) { tempCode = 999; } ExecutePayload(); return this->secretCode + tempCode; } }; extern ComplexEntity* g_VmpGlobalNode; class VmpAdvancedTester { public: static ComplexEntity* staticNode; Extern ComplexEntity* externDataNode; Vmp void RecursiveAllocTest(int depth, Extern ComplexEntity** outParam) { if (depth <= 0) return; for (int i = 0; i < 2; i++) { auto node = New<ComplexEntity>(depth * 100 + i); if (depth == 1 && i == 1 && outParam != nullptr) { *outParam = &node; } } RecursiveAllocTest(depth - 1, outParam); } Vmp void LoopAllocAndAssign() { for (int i = 1; i <= 5; i++) { auto node = New<ComplexEntity>(i * 1000); if (i == 2) { g_VmpGlobalNode = &node; } else if (i == 3) { staticNode = &node; } else if (i == 5) { externDataNode = &node; } } } };
Main.cpp
#include "ComplexTest.h"
ComplexEntity* ComplexEntity::staticBoss = nullptr;
void* g_PersistentWeapon = nullptr;
int* g_PersistentInt = nullptr;
ComplexEntity* g_VmpGlobalNode = nullptr;
ComplexEntity* VmpAdvancedTester::staticNode = nullptr;
void GlobalEventLogger(int id, const char* msg) {
DbgPrint(" -> [Callback Invoked] Entity %d reported: %s\n", id, msg);
}
DWORD FindProcessId(const char* processName) {
DWORD pid = 0;
ULONG bufferSize = 0;
// SystemProcessInformation = 5
ZwQuerySystemInformation(5, NULL, 0, &bufferSize);
if (bufferSize == 0) return 0;
void* buffer = Allocate((uint32_t)-1, bufferSize + 0x2000);
if (!buffer) return 0;
if (NT_SUCCESS(ZwQuerySystemInformation(5, buffer, bufferSize + 0x2000, &bufferSize))) {
auto spi = (SYSTEM_PROCESS_INFORMATION*)buffer;
while (true) {
if (spi->ImageName.Buffer && spi->ImageName.Length > 0) {
char exeName[260] = { 0 };
ULONG len = spi->ImageName.Length / 2;
for (ULONG i = 0; i < len && i < 259; i++) {
exeName[i] = (char)spi->ImageName.Buffer[i];
}
bool match = true;
for (int i = 0; i < 260; i++) {
char c1 = exeName[i];
char c2 = processName[i];
if (c1 >= 'A' && c1 <= 'Z') c1 += 32;
if (c2 >= 'A' && c2 <= 'Z') c2 += 32;
if (c1 != c2) { match = false; break; }
if (c1 == '\0') break;
}
if (match) {
pid = (DWORD)(uintptr_t)spi->UniqueProcessId;
break;
}
}
if (spi->NextEntryOffset == 0) break;
spi = (SYSTEM_PROCESS_INFORMATION*)((PUCHAR)spi + spi->NextEntryOffset);
}
}
return pid;
}
void TestSerializationAndReflection() {
DbgPrint("=== Test 1: Complex Serialization & Reflection ===\n");
auto assertTest = [](bool condition, const char* msg) {
if (condition) DbgPrint("[PASS] %s\n", msg);
else DbgPrint("[FAIL] %s\n", msg);
};
auto entity = New<ComplexEntity>(1024);
entity->sensor.sensorId = 7;
entity->sensor.floatVal = 3.14f;
entity->sensor.status = 'A';
entity->sensor.flagA = 1;
entity->sensor.flagB = 5;
entity->sensor.flagC = 10;
entity->onEventTriggered = GlobalEventLogger;
auto bytes = Serialize(entity);
auto cloned = Deserialize<ComplexEntity>(bytes);
assertTest(cloned.entityId == 1024, "Deserialization restored entityId on Stack Obj");
assertTest(cloned.onEventTriggered == GlobalEventLogger, "Deserialization flawlessly restored function pointer");
auto meta = Reflec(cloned);
meta.SetValue("entityId", 2048);
assertTest(cloned.entityId == 2048, "Reflection SetValue correctly modified local Stack Obj memory");
DbgPrint(" --> Testing Deep Nested Reflection (xxxx.yyyy)...\n");
auto childEnt = New<ComplexEntity>(888);
childEnt->sensor.sensorId = 42;
childEnt->sensor.intVal = 10;
cloned.childNode = childEnt;
childEnt->onEventTriggered = nullptr;
int childId = meta.GetValue<int>("childNode.entityId");
assertTest(childId == 888, "Nested GetValue traversed pointer 'childNode' to read 'entityId'");
short fetchedSensorId = meta.GetValue<short>("childNode.sensor.sensorId");
assertTest(fetchedSensorId == 42, "Nested GetValue penetrated multiple levels (childNode.sensor.sensorId)");
float localfloatVal = meta.GetValue<float>("sensor.floatVal");
assertTest(localfloatVal > 3.1f && localfloatVal < 3.2f, "Nested GetValue read local value-type nested struct (sensor.floatVal)");
meta.SetValue("childNode.sensor.sensorId", (short)999);
assertTest(cloned.childNode->sensor.sensorId == 999, "Nested SetValue mutated deep pointer structure field");
meta.SetValue("sensor.status", 'Z');
assertTest(cloned.sensor.status == 'Z', "Nested SetValue mutated local value-type nested struct (sensor.status)");
meta.Invoke("childNode.ProcessData", 5);
assertTest(cloned.childNode->sensor.intVal == 50, "Nested Invoke dynamically resolved target and executed method with arguments");
DbgPrint(" --> Testing Nested Arrays (T[n], T*[n], void*[n])...\n");
AdvancedArrayNode advNode(7777);
advNode.payload.rawPointers[0] = (void*)(intptr_t)0xDEADBEEF;
advNode.payload.rawPointers[1] = (void*)(intptr_t)0xCAFEBABE;
advNode.payload.entityList[0] = (ComplexEntity*)entity;
advNode.payload.matrix[0] = 10;
advNode.payload.matrix[1] = 20;
auto advBytes = Serialize(advNode);
auto advCloned = Deserialize<AdvancedArrayNode>(advBytes);
assertTest(advCloned.nodeId == 7777, "Nested array deserialization preserved base attributes");
assertTest(advCloned.payload.rawPointers[0] == (void*)(intptr_t)0xDEADBEEF, "Nested array deserialization flawlessly restored void*[n]");
assertTest(advCloned.payload.entityList[0] == (ComplexEntity*)entity, "Nested array deserialization flawlessly restored T*[n]");
assertTest(advCloned.payload.matrix[1] == 20, "Nested array deserialization flawlessly restored T[n]");
auto advMeta = Reflec(advCloned);
advMeta.Invoke("MutateArray", 5);
assertTest(advCloned.payload.matrix[0] == 50 && advCloned.payload.matrix[1] == 100, "SFINAE Reflection dynamically executed method on Nested Array Stack Object");
int testArr[3] = { 100, 200, 300 };
auto arrBytes = Serialize<int[3]>(testArr);
auto arrCloned = Deserialize<int[3]>(arrBytes);
assertTest(arrCloned[0] == 100 && arrCloned[2] == 300, "Direct TypeTrait Deserialize<T[n]> successfully extracted HArray");
DbgPrint("\n");
}
void TestGCAndPersistence() {
DbgPrint("=== Test 2: GC Persistence & Extern Validation ===\n");
{
auto tempObj = New<ComplexEntity>(1);
auto bossObj = New<ComplexEntity>(999);
ComplexEntity::staticBoss = &bossObj;
auto weaponObj = New<ComplexEntity>(888);
g_PersistentWeapon = &weaponObj;
auto extObj = New<ComplexEntity>(777);
bossObj->externalResource = &extObj;
auto childObj = New<ComplexEntity>(666);
tempObj->childNode = &childObj;
}
DbgPrint("--- Inner scope ended. Only ID 1 and 666 should be reclaimed! ---\n\n");
}
void TestWinApiAndExtern() {
DbgPrint("=== Test 3: Windows Native Struct & Extern Pointer ===\n");
auto assertTest = [](bool condition, const char* msg) {
if (condition) DbgPrint("[PASS] %s\n", msg);
else DbgPrint("[FAIL] %s\n", msg);
};
auto nativeCfg = New<NativeResourceConfig>();
nativeCfg->targetPid = (DWORD)(uintptr_t)PsGetCurrentProcessId();
auto meta = Reflec(nativeCfg);
meta.Invoke("InitNativeData");
assertTest(nativeCfg->clientId.UniqueProcess == (HANDLE)(ULONG_PTR)nativeCfg->targetPid, "Reflection Invoked method updating CLIENT_ID struct natively");
AssignGlobalPointer(&g_PersistentInt);
assertTest(g_PersistentInt != nullptr && *g_PersistentInt == 9999, "Extern int** successfully exported GC pointer using & operator");
DbgPrint("\n");
}
void TestPolymorphism() {
DbgPrint("=== Test 4: Polymorphism & Keywords (virtual, override, final) ===\n");
auto finalObj = New<FinalWorker>();
finalObj->baseId = 100;
finalObj->powerLevel = 9000;
IWorker* interfacePtr = &finalObj;
DbgPrint(" ");
interfacePtr->ExecuteTask();
DbgPrint("\n");
}
void TestVmpAnnotations() {
DbgPrint("=== Test 5: Vmp Control Flow Flattening & Obfuscation ===\n");
VmpGlobalFunction("This is a VMP protected global function!");
auto secMgr = New<SecurityManager>();
secMgr->ExecutePayload();
DbgPrint("\n");
}
void TestAdvancedVmp() {
DbgPrint("=== Test 6: Advanced Vmp (Recursion, Loops, Global, Static & Extern) ===\n");
auto tester = New<VmpAdvancedTester>();
tester->LoopAllocAndAssign();
ComplexEntity* recursiveOut = nullptr;
tester->RecursiveAllocTest(3, &recursiveOut);
DbgPrint("\n");
}
void TestLoopMemoryLeak() {
DbgPrint("=== Test 7: Loop Memory Leak Prevention ===\n");
for (int i = 0; i < 5; i++) {
void* p = New<ComplexEntity>(8000 + i);
}
DbgPrint("\n");
}
void TestHelixSystemKeywords() {
DbgPrint("=== Test 8: Helix System Keywords & Multi-Dimensional Read/Write ===\n");
auto assertTest = [](bool condition, const char* msg) {
if (condition) DbgPrint("[PASS] %s\n", msg);
else DbgPrint("[FAIL] %s\n", msg);
};
// 1. 获取系统信息 (System Keyword)
auto sys = System();
if (sys != nullptr) {
DbgPrint("[System] OS: %s v%u.%u (Build %u)\n",
sys->OSName, sys->MajorVersion, sys->MinorVersion, sys->BuildNumber);
DbgPrint("[System] HWID: %s\n", sys->SerialNumber);
}
// 2. 获取 CPU 信息 (Cpu Keyword)
auto cpu = Cpu();
if (cpu != nullptr) {
DbgPrint("[Cpu] Vendor: %s | Brand: %s\n", cpu->Vendor, cpu->Brand);
DbgPrint("[Cpu] Model: %s | Serial: %s\n", cpu->ModelName, cpu->SerialNumber);
}
// 3. 获取物理网卡 MAC 阵列 (Mac Keyword)
auto macs = Mac();
if (macs != nullptr && macs->size() > 0) {
DbgPrint("[Mac] Found %I64u Network Adapter(s):\n", (uint64_t)macs->size());
for (size_t i = 0; i < macs->size(); i++) {
DbgPrint(" -> [%I64u] %s (%s)\n",
(uint64_t)i, (*macs)[i].MacAddress, (*macs)[i].Description);
}
}
// 4. 获取磁盘信息阵列 (Disk Keyword)，例如Disk("c")
auto disks = Disk();
if (disks != nullptr && disks->size() > 0) {
DbgPrint("[Disk] Found %I64u Storage Drive(s):\n", (uint64_t)disks->size());
for (size_t i = 0; i < disks->size(); i++) {
// 内核安全浮点模拟：分离整数位与百分位 (保留两位小数精度)
uint64_t gbDivisor = 1024ULL * 1024ULL * 1024ULL;
uint64_t totalGbInt = (*disks)[i].TotalSize / gbDivisor;
uint64_t totalGbFrac = (((*disks)[i].TotalSize % gbDivisor) * 100ULL) / gbDivisor;
uint64_t freeGbInt = (*disks)[i].FreeSpace / gbDivisor;
uint64_t freeGbFrac = (((*disks)[i].FreeSpace % gbDivisor) * 100ULL) / gbDivisor;
DbgPrint(" -> %s | Model: %s | Serial: %s\n",
(*disks)[i].DriveLetter, (*disks)[i].Model, (*disks)[i].SerialNumber);
DbgPrint(" Space: %I64u.%02I64u GB Free / %I64u.%02I64u GB Total\n",
freeGbInt, freeGbFrac, totalGbInt, totalGbFrac);
}
}
DbgPrint("\n");
DbgPrint(" --> Testing Local Bypass (PID = -1) Read/Write/Allocate...\n");
void* localMem = Allocate((uint32_t)-1, sizeof(int));
if (localMem) {
int payload = 7777;
Write((uint32_t)-1, localMem, payload);
auto pureVal = Read<int>((uint32_t)-1, localMem);
assertTest(pureVal == 7777, "Local Bypass (-1) flawlessly allocated, wrote, and read stack value via zero-overhead fast path");
}
DWORD notepadPid = FindProcessId("notepad.exe");
if (notepadPid == 0) {
DbgPrint(" --> notepad.exe not found. Please open notepad.exe manually for cross-process tests.\n");
}
else {
DbgPrint(" --> notepad.exe found! PID: %u\n", notepadPid);
void* pRemoteMem = Allocate(notepadPid, sizeof(int));
int remoteAddrInt = (int)(intptr_t)pRemoteMem;
if (pRemoteMem) {
int payload = 1337;
Write(notepadPid, pRemoteMem, payload);
auto pureVal = Read<int>(notepadPid, pRemoteMem);
assertTest(pureVal == 1337, "Read<T> flawlessly retrieved memory directly as stack value");
}
DbgPrint(" --> Testing Cross-Process Nested Arrays Write/Read (T[n], T*[n], void*[n])...\n");
AdvancedArrayNode localAdvArr[2] = { AdvancedArrayNode(8888), AdvancedArrayNode(9999) };
localAdvArr[0].payload.rawPointers[0] = (void*)(intptr_t)0x11112222;
localAdvArr[0].payload.entityList[1] = (ComplexEntity*)(intptr_t)0x33334444;
localAdvArr[1].payload.matrix[3] = 777;
void* remoteAdvArray = Allocate(notepadPid, sizeof(AdvancedArrayNode) * 2);
if (remoteAdvArray != nullptr) {
int wStatus = Write<AdvancedArrayNode[2]>(notepadPid, remoteAdvArray, localAdvArr);
assertTest(wStatus == 1, "Write<T[n]> successfully injected Array of Nested Structs (AdvancedArrayNode[2])");
auto readAdvArr = Read<AdvancedArrayNode[2]>(notepadPid, remoteAdvArray);
assertTest(readAdvArr[0].nodeId == 8888 && readAdvArr[1].nodeId == 9999, "Read<T[n]> effortlessly retrieved Array Objects");
assertTest(readAdvArr[0].payload.rawPointers[0] == (void*)(intptr_t)0x11112222, "Read<T[n]> meticulously extracted nested void*[n]");
assertTest(readAdvArr[0].payload.entityList[1] == (ComplexEntity*)(intptr_t)0x33334444, "Read<T[n]> meticulously extracted nested T*[n]");
assertTest(readAdvArr[1].payload.matrix[3] == 777, "Read<T[n]> meticulously extracted nested T[n] from second element");
void* rawPointersAddr = (void*)((uintptr_t)remoteAdvArray + offsetof(AdvancedArrayNode, payload) + offsetof(NestedPayload, rawPointers));
auto remoteVoidArray = Read<void* [3]>(notepadPid, rawPointersAddr);
assertTest(remoteVoidArray[0] == (void*)(intptr_t)0x11112222, "Read<void*[n]> explicitly pinpointed and extracted subset void* array");
DbgPrint(" --> Simulated memory tracker recorded void* allocations (%x) for AST cleanup.\n", remoteAddrInt);
}
}
DbgPrint("\n");
}
ComplexEntity* g_p;
Vmp void TestKeywordMemoryLeak() {
DbgPrint("=== Test 9: Keyword Zero-Leak Stress Test (10 Iterations) ===\n");
auto pmcTest = New<PROCESS_MEMORY_COUNTERS>();
pmcTest->WorkingSetSize = 1024;
int dummyVar = 42;
DbgPrint(" --> Running 10 iterations of New, Cpu, System, Mac, Disk, Read, and Allocate (using Local Bypass -1)...\n");
for (int i = 0; i < 10; i++) {
auto cpu = Cpu();
auto sys = System();
//auto macs = Mac();//无内存泄漏
auto disks = Disk();
auto pureVal = Read<int>((uint32_t)-1, &dummyVar);
auto dummyObj = New<ComplexEntity>(99000 + i);
void* remoteMem = Allocate((uint32_t)-1, 256);
//测试基本数据类型
auto basicInt = New<int>();
auto basicFloatArr = New<float[3]>();//非内存泄漏
auto refBasicFloatArray = Reflec(basicFloatArr);
}
g_p = Allocate((uint32_t)-1, sizeof(ComplexEntity));
g_p->entityId = 1038;
DbgPrint("[PASS] 10 iterations completed (Including Allocate). Polyfilled Struct Value: %llu\n", (unsigned long long)pmcTest->WorkingSetSize);
DbgPrint("\n");
}
void TestDynamicApi() {
DbgPrint("=== Test 10: Dynamic API Keyword (Ring 0) ===\n");
unsigned long seed = 0x1337;
unsigned long randomVal = RtlRandomEx(&seed);
if (randomVal != 0) {
DbgPrint("[PASS] API Keyword triggered seamlessly! Random Value: %lu (New Seed: %lu)\n", randomVal, seed);
}
else {
DbgPrint("[FAIL] API Keyword failed or returned 0.\n");
}
void* funcPtr15 = (void*)_15;
if (funcPtr15 != nullptr) {
DbgPrint("[PASS] Ring 0 Ordinal (ntoskrnl.exe #15) Resolved successfully to: %p\n", funcPtr15);
}
else {
DbgPrint("[FAIL] Ring 0 Ordinal failed to resolve.\n");
}
DbgPrint("\n");
}
void TestCrossRingSDKReflection() {
auto assertTest = [](bool condition, const char* msg) {
if (condition) DbgPrint("[PASS] %s\n", msg);
else DbgPrint("[FAIL] %s\n", msg);
};
DbgPrint("=== Test 11: Cross-Ring Native SDK Struct Reflection ===\n");
auto clientIdObj = New<CLIENT_ID>();
auto metaClientWrite = Reflec(clientIdObj);
metaClientWrite.SetValue("UniqueProcess", (HANDLE)(intptr_t)0x1234);
metaClientWrite.SetValue("UniqueThread", (HANDLE)(intptr_t)0x5678);
auto cidBytes = Serialize(clientIdObj);
auto cidCloned = Deserialize<CLIENT_ID>(cidBytes);
auto metaClientRead = Reflec(cidCloned);
assertTest(metaClientRead.GetValue<HANDLE>("UniqueProcess") == (HANDLE)(intptr_t)0x1234,
"Deserialize<CLIENT_ID> successfully restored Native SDK Struct (UniqueProcess)");
metaClientRead.SetValue("UniqueThread", (HANDLE)(intptr_t)0x9999);
assertTest(metaClientRead.GetValue<HANDLE>("UniqueThread") == (HANDLE)(intptr_t)0x9999,
"Reflec<CLIENT_ID> successfully modified Native SDK Struct field dynamically");
auto listEntryObj = New<LIST_ENTRY>();
auto metaListWrite = Reflec(listEntryObj);
metaListWrite.SetValue("Flink", (PLIST_ENTRY)(intptr_t)0xAAAA);
metaListWrite.SetValue("Blink", (PLIST_ENTRY)(intptr_t)0xBBBB);
auto listBytes = Serialize(listEntryObj);
auto listCloned = Deserialize<LIST_ENTRY>(listBytes);
auto metaListRead = Reflec(listCloned);
assertTest(metaListRead.GetValue<PLIST_ENTRY>("Blink") == (PLIST_ENTRY)(intptr_t)0xBBBB,
"Deserialize<LIST_ENTRY> successfully restored Doubly-Linked List node");
metaListRead.SetValue("Flink", (PLIST_ENTRY)(intptr_t)0xCCCC);
assertTest(metaListRead.GetValue<PLIST_ENTRY>("Flink") == (PLIST_ENTRY)(intptr_t)0xCCCC,
"Reflec<LIST_ENTRY> successfully modified Doubly-Linked List field dynamically");
auto mdlObj = New<MDL>();
auto metaMdlWrite = Reflec(mdlObj);
metaMdlWrite.SetValue("Size", (short)1024);
metaMdlWrite.SetValue("MdlFlags", (short)0x0004);
metaMdlWrite.SetValue("ByteCount", (unsigned long)4096);
auto mdlBytes = Serialize(mdlObj);
auto mdlCloned = Deserialize<MDL>(mdlBytes);
auto metaMdlRead = Reflec(mdlCloned);
assertTest(metaMdlRead.GetValue<unsigned long>("ByteCount") == 4096,
"Deserialize<MDL> successfully restored Kernel-Only Struct (ByteCount)");
metaMdlRead.SetValue("MdlFlags", (short)0x0008);
assertTest(metaMdlRead.GetValue<short>("MdlFlags") == 0x0008,
"Reflec<MDL> successfully modified Kernel-Only Struct field dynamically");
auto sysTimeObj = New<SYSTEMTIME>();
auto metaSysTimeWrite = Reflec(sysTimeObj);
metaSysTimeWrite.SetValue("wYear", (unsigned short)2026);
metaSysTimeWrite.SetValue("wMonth", (unsigned short)8);
auto sysTimeBytes = Serialize(sysTimeObj);
auto sysTimeCloned = Deserialize<SYSTEMTIME>(sysTimeBytes);
auto metaSysTimeRead = Reflec(sysTimeCloned);
assertTest(metaSysTimeRead.GetValue<unsigned short>("wMonth") == 8,
"Deserialize<SYSTEMTIME> successfully restored User-Only Struct (wMonth) inside Ring 0 via Polyfill");
metaSysTimeRead.SetValue("wYear", (unsigned short)2099);
assertTest(metaSysTimeRead.GetValue<unsigned short>("wYear") == 2099,
"Reflec<SYSTEMTIME> successfully modified User-Only Struct field dynamically inside Ring 0 via Polyfill");
DbgPrint("\n");
}
void DriverUnload(PDRIVER_OBJECT DriverObject) {
DbgPrint("========================================\n");
DbgPrint(" HELIX KERNEL-MODE ENGINE UNLOADED! \n");
DbgPrint("========================================\n");
}
int main(void** args) {
DbgPrint("========================================\n");
DbgPrint(" HELIX KERNEL-MODE ENGINE IGNITED! \n");
DbgPrint("========================================\n\n");
if (args && args[0]) {
DbgPrint("[System] Driver Path : %s\n\n", (const char*)args[0]);
}
if (args && args[1]) {
PDRIVER_OBJECT DriverObject = (PDRIVER_OBJECT)args[1];
DriverObject->DriverUnload = DriverUnload;
}
TestSerializationAndReflection();
TestGCAndPersistence();
TestWinApiAndExtern();
TestPolymorphism();
TestVmpAnnotations();
TestAdvancedVmp();
TestLoopMemoryLeak();
TestHelixSystemKeywords();
TestKeywordMemoryLeak();
TestDynamicApi();
TestCrossRingSDKReflection();
DbgPrint("Releasing ComplexEntity %d reclaimed.\n", g_p->entityId);
DbgPrint("[System] Helix Driver logic completed. Returning to OS.\n");
return 0;
}
输出(来自Windgb.exe)，驱动需自己签名加载，不签名就在测试模式下加载。不打算开源如何加载无签名驱动。
========================================
HELIX KERNEL-MODE ENGINE IGNITED!
========================================
[System] Driver Path : \??\C:\Users\dalgleish\Desktop\TestSys.sys
=== Test 1: Complex Serialization & Reflection ===
[Constructor] ComplexEntity ID 1024 created via parameterized constructor.
[PASS] Deserialization restored entityId on Stack Obj
[PASS] Deserialization flawlessly restored function pointer
[PASS] Reflection SetValue correctly modified local Stack Obj memory
--> Testing Deep Nested Reflection (xxxx.yyyy)...
[Constructor] ComplexEntity ID 888 created via parameterized constructor.
[PASS] Nested GetValue traversed pointer 'childNode' to read 'entityId'
[PASS] Nested GetValue penetrated multiple levels (childNode.sensor.sensorId)
[PASS] Nested GetValue read local value-type nested struct (sensor.floatVal)
[PASS] Nested SetValue mutated deep pointer structure field
[PASS] Nested SetValue mutated local value-type nested struct (sensor.status)
[PASS] Nested Invoke dynamically resolved target and executed method with arguments
--> Testing Nested Arrays (T[n], T*[n], void*[n])...
[Constructor] AdvancedArrayNode ID 7777 created.
[PASS] Nested array deserialization preserved base attributes
[PASS] Nested array deserialization flawlessly restored void*[n]
[PASS] Nested array deserialization flawlessly restored T*[n]
[PASS] Nested array deserialization flawlessly restored T[n]
[PASS] SFINAE Reflection dynamically executed method on Nested Array Stack Object
[PASS] Direct TypeTrait Deserialize<T[n]> successfully extracted HArray
[Destructor] AdvancedArrayNode ID 7777 reclaimed.
[Destructor] AdvancedArrayNode ID 7777 reclaimed.
[Destructor] ComplexEntity ID 2048 reclaimed.
=== Test 2: GC Persistence & Extern Validation ===
[Constructor] ComplexEntity ID 1 created via parameterized constructor.
[Constructor] ComplexEntity ID 999 created via parameterized constructor.
[Constructor] ComplexEntity ID 888 created via parameterized constructor.
[Constructor] ComplexEntity ID 777 created via parameterized constructor.
[Constructor] ComplexEntity ID 666 created via parameterized constructor.
[Destructor] ComplexEntity ID 1024 reclaimed.
[Destructor] ComplexEntity ID 888 reclaimed.
--- Inner scope ended. Only ID 1 and 666 should be reclaimed! ---
=== Test 3: Windows Native Struct & Extern Pointer ===
[PASS] Reflection Invoked method updating CLIENT_ID struct natively
[Destructor] ComplexEntity ID 1 reclaimed.
[PASS] Extern int** successfully exported GC pointer using & operator
=== Test 4: Polymorphism & Keywords (virtual, override, final) ===
[FinalWorker] Final task executed by ID 100 with power 9000.
[Destructor] NativeResourceConfig PID 4 reclaimed.
=== Test 5: Vmp Control Flow Flattening & Obfuscation ===
-> [Vmp Global] Executing protected global logic...
-> Message: This is a VMP protected global function!
-> [Vmp Member] Payload executed. Secret code mutated to: 85
[Destructor] FinalWorker ID 100 reclaimed.
=== Test 6: Advanced Vmp (Recursion, Loops, Global, Static & Extern) ===
[Constructor] ComplexEntity ID 1000 created via parameterized constructor.
[Constructor] ComplexEntity ID 2000 created via parameterized constructor.
[Destructor] ComplexEntity ID 1000 reclaimed.
[Constructor] ComplexEntity ID 3000 created via parameterized constructor.
[Constructor] ComplexEntity ID 4000 created via parameterized constructor.
[Constructor] ComplexEntity ID 5000 created via parameterized constructor.
[Destructor] ComplexEntity ID 4000 reclaimed.
[Constructor] ComplexEntity ID 300 created via parameterized constructor.
[Constructor] ComplexEntity ID 301 created via parameterized constructor.
[Destructor] ComplexEntity ID 300 reclaimed.
[Constructor] ComplexEntity ID 200 created via parameterized constructor.
[Constructor] ComplexEntity ID 201 created via parameterized constructor.
[Destructor] ComplexEntity ID 200 reclaimed.
[Constructor] ComplexEntity ID 100 created via parameterized constructor.
[Constructor] ComplexEntity ID 101 created via parameterized constructor.
[Destructor] ComplexEntity ID 100 reclaimed.
[Destructor] ComplexEntity ID 301 reclaimed.
[Destructor] ComplexEntity ID 201 reclaimed.
=== Test 7: Loop Memory Leak Prevention ===
[Constructor] ComplexEntity ID 8000 created via parameterized constructor.
[Destructor] ComplexEntity ID 5000 reclaimed.
[Constructor] ComplexEntity ID 8001 created via parameterized constructor.
[Destructor] ComplexEntity ID 8000 reclaimed.
[Constructor] ComplexEntity ID 8002 created via parameterized constructor.
[Destructor] ComplexEntity ID 8001 reclaimed.
[Constructor] ComplexEntity ID 8003 created via parameterized constructor.
[Destructor] ComplexEntity ID 8002 reclaimed.
[Constructor] ComplexEntity ID 8004 created via parameterized constructor.
[Destructor] ComplexEntity ID 8003 reclaimed.
=== Test 8: Helix System Keywords & Multi-Dimensional Read/Write ===
[System] OS: Windows 11 x64 v10.0 (Build 26100)
[System] HWID: 6201034c-2ba6-4efc-8739-4fb97b881936
[Cpu] Vendor: GenuineIntel | Brand: Intel(R) Core(TM) i9-10900K CPU @ 3.70GHz
[Cpu] Model: Family 6 Model 165 Stepping 5 | Serial: 000A06551F8BFBFF
[Mac] Found 1 Network Adapter(s):
-> [0] 00:0C:29:6E:5E:BF (Intel(R) 82574L Gigabit Network Connection)
[Disk] Found 1 Storage Drive(s):
-> C:\ | Model: VMware Virtual NVMe Disk | Serial: 3E91842F
Space: 408.91 GB Free / 499.05 GB Total
--> Testing Local Bypass (PID = -1) Read/Write/Allocate...
[Destructor] ComplexEntity ID 666 reclaimed.
[PASS] Local Bypass (-1) flawlessly allocated, wrote, and read stack value via zero-overhead fast path
--> notepad.exe found! PID: 5592
[PASS] Read<T> flawlessly retrieved memory directly as stack value
--> Testing Cross-Process Nested Arrays Write/Read (T[n], T*[n], void*[n])...
[Constructor] AdvancedArrayNode ID 8888 created.
[Constructor] AdvancedArrayNode ID 9999 created.
[PASS] Write<T[n]> successfully injected Array of Nested Structs (AdvancedArrayNode[2])
[PASS] Read<T[n]> effortlessly retrieved Array Objects
[PASS] Read<T[n]> meticulously extracted nested void*[n]
[PASS] Read<T[n]> meticulously extracted nested T*[n]
[PASS] Read<T[n]> meticulously extracted nested T[n] from second element
[PASS] Read<void*[n]> explicitly pinpointed and extracted subset void* array
--> Simulated memory tracker recorded void* allocations (8b5f0000) for AST cleanup.
[Destructor] AdvancedArrayNode ID 9999 reclaimed.
[Destructor] AdvancedArrayNode ID 8888 reclaimed.
[Destructor] AdvancedArrayNode ID 9999 reclaimed.
[Destructor] AdvancedArrayNode ID 8888 reclaimed.
=== Test 9: Keyword Zero-Leak Stress Test (10 Iterations) ===
--> Running 10 iterations of New, Cpu, System, Mac, Disk, Read, and Allocate (using Local Bypass -1)...
[Constructor] ComplexEntity ID 99000 created via parameterized constructor.
[Constructor] ComplexEntity ID 99001 created via parameterized constructor.
[Destructor] ComplexEntity ID 99000 reclaimed.
[Constructor] ComplexEntity ID 99002 created via parameterized constructor.
[Destructor] ComplexEntity ID 99001 reclaimed.
[Constructor] ComplexEntity ID 99003 created via parameterized constructor.
[Destructor] ComplexEntity ID 99002 reclaimed.
[Constructor] ComplexEntity ID 99004 created via parameterized constructor.
[Destructor] ComplexEntity ID 99003 reclaimed.
[Constructor] ComplexEntity ID 99005 created via parameterized constructor.
[Destructor] ComplexEntity ID 99004 reclaimed.
[Constructor] ComplexEntity ID 99006 created via parameterized constructor.
[Destructor] ComplexEntity ID 99005 reclaimed.
[Constructor] ComplexEntity ID 99007 created via parameterized constructor.
[Destructor] ComplexEntity ID 99006 reclaimed.
[Constructor] ComplexEntity ID 99008 created via parameterized constructor.
[Destructor] ComplexEntity ID 99007 reclaimed.
[Constructor] ComplexEntity ID 99009 created via parameterized constructor.
[Destructor] ComplexEntity ID 99008 reclaimed.
[PASS] 10 iterations completed (Including Allocate). Polyfilled Struct Value: 1024
=== Test 10: Dynamic API Keyword (Ring 0) ===
[PASS] API Keyword triggered seamlessly! Random Value: 2017035263 (New Seed: 2017035263)
[PASS] Ring 0 Ordinal (ntoskrnl.exe #15) Resolved successfully to: FFFFF80678CF5450
=== Test 11: Cross-Ring Native SDK Struct Reflection ===
[PASS] Deserialize<CLIENT_ID> successfully restored Native SDK Struct (UniqueProcess)
[PASS] Reflec<CLIENT_ID> successfully modified Native SDK Struct field dynamically
[PASS] Deserialize<LIST_ENTRY> successfully restored Doubly-Linked List node
[PASS] Reflec<LIST_ENTRY> successfully modified Doubly-Linked List field dynamically
[PASS] Deserialize<MDL> successfully restored Kernel-Only Struct (ByteCount)
[PASS] Reflec<MDL> successfully modified Kernel-Only Struct field dynamically
[PASS] Deserialize<SYSTEMTIME> successfully restored User-Only Struct (wMonth) inside Ring 0 via Polyfill
[PASS] Reflec<SYSTEMTIME> successfully modified User-Only Struct field dynamically inside Ring 0 via Polyfill
[Destructor] ComplexEntity ID 8004 reclaimed.
[Destructor] ComplexEntity ID 99009 reclaimed.
Releasing ComplexEntity 1038 reclaimed.
[System] Helix Driver logic completed. Returning to OS.
[Destructor] ComplexEntity ID 999 reclaimed.
[Destructor] ComplexEntity ID 888 reclaimed.
[Destructor] ComplexEntity ID 777 reclaimed.
[Destructor] ComplexEntity ID 2000 reclaimed.
[Destructor] ComplexEntity ID 3000 reclaimed.
[Destructor] ComplexEntity ID 101 reclaimed.
========================================
HELIX KERNEL-MODE ENGINE UNLOADED!
========================================
浙公网安备 33010602011771号