Usermode WDA_MONITOR/WDA_EXCLUDEFROMCAPTURE bypasser written in C++ with bindings for several popular languages.
Starring:
- PEB walking
- Tartarus Gate
- Custom PE sections
Zw*Windows functions- EDR/AV evasion (0/70 on VirusTotal)
- No
0F 05viantdll.dllindirection constexprAES-like literals shredding, clean.rodata
TS
Install:
npm i @lofcz/thirdeye
Use:
import { ThirdEyeSession, ThirdeyeFormat } from '@lofcz/thirdeye';
const session = new ThirdEyeSession();
session.captureToFile('screenshot.jpg');
session.close();With options:
session.captureToFile('screenshot.jpeg', {
format: ThirdeyeFormat.Jpeg,
quality: 90,
bypassProtection: true,
});Capture to memory:
const buffer: Buffer = session.captureToBuffer();C#
Install:
dotnet add package ThirdEye
Use:
using ThirdEye;
using var session = new ThirdEyeSession();
session.CaptureToFile("screenshot.jpg");With options:
var options = new ThirdEyeOptions(
format: ThirdeyeFormat.Jpeg,
quality: 90,
bypassProtection: true
);
session.CaptureToFile("screenshot.jpeg", options);Capture to memory:
byte[] buffer = session.CaptureToBuffer();Python
Install:
pip install eye3
Use:
from eye3 import ThirdEyeSession, ThirdEyeOptions, ThirdeyeFormat
with ThirdEyeSession() as session:
session.capture_to_file("screenshot.jpg")With options:
options = ThirdEyeOptions(
format=ThirdeyeFormat.JPEG,
quality=90,
bypass_protection=True,
)
session.capture_to_file("screenshot.jpeg", options)Capture to memory:
buffer: bytes = session.capture_to_buffer()C/C++
Install: download thirdeye.dll + thirdeye_core.h from the latest release (or build from c/).
Use:
#include "thirdeye_core.h"
ThirdeyeContext* ctx = nullptr;
if (Thirdeye_CreateContext(&ctx) == THIRDEYE_OK) {
Thirdeye_CaptureToFile(ctx, L"screenshot.jpg", nullptr);
Thirdeye_DestroyContext(ctx);
}With options:
ThirdeyeOptions options;
Thirdeye_GetDefaultOptions(&options);
options.format = THIRDEYE_FORMAT_JPEG;
options.quality = 90;
Thirdeye_CaptureToFile(ctx, L"screenshot.jpeg", &options);Capture to memory:
uint8_t* buffer = nullptr;
uint32_t size = 0;
Thirdeye_CaptureToBuffer(ctx, &buffer, &size, nullptr);
Thirdeye_FreeBuffer(buffer);