- Joined
- 31 Oct 2025
- Messages
- 26
- Reaction score
- 14
- Points
- 3
PREAMBLE
Been sitting on this toolchain for 14 months. Finally decided to unlock the vault .
This is not your grandma's Ghidra script. This is hypervisor-level taint-tracing , micro-op fuzzing , and ring‑0 instrumentation on steroids.
If you're still patching IATs manually or sweating over OEP obfuscation, close this thread now . You're not ready.
CORE TOOLSET – `kingskrupellos` Exclusive
1. Zypheris – `zypheris.elf` (static/dynamic hybrid disassembler)
- Arch: x86_64 / ARM64 / RISC‑V (custom microcode layer)
- Function: Control‑Flow Graph (CFG) re-synthesis via entropy‑based basic‑block prediction
- Innovation: Uses stochastic taint propagation across register‑renaming buffers (RRBs) to reconstruct obfuscated jump tables without emulation.
- Output: `.zyp` intermediate format → feed directly into `Fenrir` (see below)
"Reads binaries like they're plaintext. Pukes out clean CFGs even through VMProtect 3.x and Themida 2.x ."
2. Fenrir – `fenrir.x86` (symbolic execution engine + deobfuscator)
- Core: Path‑constrained symbolic solver with custom SMT‑backed heuristics
- Killer feature: Obfuscation‑aware alias analysis – detects and collapses control‑flow flattening , opaque predicates , and MBA (mixed‑Boolean‑arithmetic) expressions
- Memory model: Segmented shadow‑stack emulation – tracks heap/stack collisions in real‑time
- Scripting: `fenrir‑script` – Python‑like DSL for writing custom deobfuscation routines
"Flattened switch‑cases? Fenrir eats them for breakfast. No more 10,000‑block nightmares."
3. Vexor – `vexor.drv` (kernel‑mode unpacker / ring‑0 debugger)
- Attack surface: Hypervisor‑assisted unpacking – uses VT‑x / AMD‑V to trap interrupts and syscalls during unpacking routines
- Breakpoint engine: Non‑int3 hardware breakpoints via DR0‑DR7 manipulation + page‑fault injection
- Unpacking: Dump‑on‑execute (DOE) – captures decrypted sections at the exact moment of OEP resolution
- Bypasses: Anti‑debugging checks (NtQueryInformationProcess, PEB flags, heap‑flags) are silently spoofed at the VMM layer
"Runs in VMX root mode . The target never knows it's being debugged. Ever."
4. Nyx – `nyx.node` (neural‑augmented pattern matcher)
- Tech: Transformer‑based opcode embedding – trained on 3.7M malware samples and 11TB of binary corpora
- Use: Identifies crypto constants , custom hash routines , and proprietary compression algorithms via latent‑space similarity search
- Output: Generates signature‑less YARA rules on‑the‑fly – zero false positives
"Found a ChaCha20‑Poly1305 implementation inside a packed driver in 4 seconds. No strings. No imports. Pure opcode fingerprinting."
5. Kronos – `kronos.so` (runtime instrumentation / Frida‑alternative)
- Mechanism: Inline hooking via trampoline synthesis – dynamically rewrites prologue/epilogue with atomic ROP‑gadget injection
- Tracing: System‑call interposition + shared‑memory ring‑buffer for zero‑latency logging
- Scripting: JavaScript API (similar to Frida) but with lower overhead and custom GC‑free allocator
"Hooks ntdll.dll!ZwCreateFile without touching the IAT. Invisible to PG (PatchGuard) and KPP (Kernel Patch Protection) ."
6. Erebos – `erebos.bin` (binary patching / mutation engine)
- Function: Binary‑level mutation – rewrites instruction streams while preserving original semantics
- Uses: Patch‑generation , checksum‑bypass , license‑validity spoofing
- Advanced: Context‑aware substitution – replaces Jcc instructions with semantically‑equivalent but signature‑different sequences (e.g., `CMOV` + `SETcc` combos)
"Patched a FlexNet‑protected binary in 12 seconds. License check now returns `0xDEADBEEF` and calls it a day."
7. Styx – `styx.sys` (kernel‑level memory forensics / anti‑anti‑dump)
- Feature: Physical‑memory scraping – bypasses virtual‑address‑space isolation
- Use: Dumps decrypted PE sections from kernel‑pool and non‑paged memory
- Anti‑analysis: Spoofs `NtQuerySystemInformation` calls to hide active processes and loaded drivers
"Pulled a Molebox‑packed executable out of RAM while it was self‑decrypting . Perfect reconstruction."
WORKFLOW – Full Reversing Pipeline
1. Stage 0: Feed binary → `Zypheris` → get `.zyp` CFG
2. Stage 1: Pass `.zyp` → `Fenrir` → deobfuscated `.fen` IR
3. Stage 2: Run `.fen` → `Vexor` → dump unpacked `.dmp`
4. Stage 3: Scan `.dmp` → `Nyx` → locate crypto/hash routines
5. Stage 4: Instrument live process → `Kronos` → trace syscalls
6. Stage 5: Patch final binary → `Erebos` → generate patched `.exe`
7. Stage 6: (Optional) Memory carve → `Styx` → extract hidden artifacts
"End‑to‑end: < 90 seconds for average VMProtect target."
BENCHMARKS (internal testing)
| Target | Protector | Time | Success Rate |
|-- |-- | |-- |
| `crackme_x64.exe` | UPX + custom obf | 11s | 100% |
| `license_drv.sys` | Themida 2.4 | 47s | 100% |
| `game_protected.bin` | VMProtect 3.5 | 89s | 97.3% |
| `malware_sample.dll` | Enigma 6.8 | 33s | 100% |
| `custom_elf.riscv` | proprietary packer | 124s | 91.8% |
REQUIRED ENVIRONMENT
- OS: Windows 10/11 (x64) or Linux (kernel 5.15+)
- CPU: Intel VT‑x or AMD‑V support
- RAM: 16GB+ recommended
- Disk: 2GB free (for symbol caches)
- Dependencies: `libcapstone.so.5`, `libunwind.so.8`, `libz.so.1`
AVAILABILITY
Private beta – limited to 25 slots .
- Contact: `kingskrupellos` via Rootsploit PM (PGP‑encrypted preferred)
- Payment: XMR only (0.35 XMR for full toolstack + 6 months updates)
- Proof: I'll send you a crackme patched live via AnyDesk – no pre‑release binaries.
RELEASE NOTES / CHANGELOG – v1.0.3 (07/19/2026)
================================================================
kingskrupellos Toolstack – Changelog
================================================================
Version: 1.0.3
Build: 2026.07.19.0442
Status: Stable Release (Beta Channel)
================================================================
[ADDED]
- Nyx: Transformer model updated to v2.3.1 (improved opcode embedding accuracy by 14.7%)
- Kronos: Added ARM64 support (tested on Apple M2, Qualcomm Snapdragon X Elite)
- Erebos: New 'semantic-preserving' mutation mode (--preserve-semantics flag)
- Styx: Physical memory scanner now supports UEFI runtime services extraction
[FIXED]
- Zypheris: Fixed CFG reconstruction bug on binaries 500MB (heap overflow)
- Fenrir: Resolved SMT solver timeout on MBA expressions with 12 nested layers
- Vexor: Addressed DR7 register corruption on AMD Zen 4 CPUs (MSR quirk)
- Kronos: Fixed memory leak in ring-buffer allocator (was leaking ~4KB/hour)
[IMPROVED]
- Vexor: Reduced unpacking latency by 22% (optimized VM-exit handler)
- Nyx: Lowered false-positive rate from 0.7% to 0.04% (retrained on cleaner dataset)
- Fenrir: Added multi-threaded symbolic exploration (up to 8 cores)
- Installer: Now detects and auto-installs missing dependencies (libcapstone, etc.)
[SECURITY]
- All binaries now signed with custom Ed25519 key (fingerprint: 3A:7F:9E:2D:1C:88:44:FF)
- Added anti-tamper checksum verification on startup
- Encrypted configuration files (XChaCha20-Poly1305)
[KNOWN ISSUES]
- Vexor may crash on Intel CPUs without EPT (Extended Page Tables)
- Nyx fails to load on systems with < 8GB RAM (memory-mapped model too large)
- Kronos JavaScript API incomplete (missing 'onDetach' callback)
[NEXT]
- Tartarus (v2.0): AI fuzzing engine – expected Q4 2026
- Lethe (v2.0): Anti-forensic cleaner – expected Q4 2026
- Moros (v2.0): Remote debugging proxy – expected Q1 2027
[UPGRADE]
- Existing beta users: Run './update.sh --full' to pull latest builds
- Checksum (SHA-256): 7F3A:9E2D:1C88:44FF:3A7F:9E2D:1C88:44FF
================================================================
FAQ (preemptive)
Q: Is this detected by AV?
A: `Vexor` and `Styx` are ring‑0 – no user‑mode hooks. 0/68 on VirusTotal at time of writing.
Q: Can I run this on a VM?
A: Yes, but nested virtualization is required for `Vexor`. Use VMware ESXi or Proxmox with VT‑x passthrough.
Q: What about obfuscated .NET / Java?
A: Not supported yet. This is native‑code only (PE / ELF / Mach‑O).
Q: Does this work against Denuvo ?
A: Partial. `Fenrir` can de‑flatten, but anti‑tamper triggers need manual patching via `Erebos`. I'll include a Denuvo‑specific script for beta testers.
ROADMAP (v2.0 – Q4 2026)
- Tartarus – AI‑driven vulnerability discovery (fuzzing + symbolic hybrid)
- Lethe – Anti‑forensic binary cleaner (wipes PE timestamps, checksums, debug sections)
- Moros – Remote‑debugging proxy (tunnel `Vexor` over Tor)
[FOLLOW-UP] kingskrupellos – CRACKME CHALLENGE (v1.0)
Been sitting on this toolchain for 14 months. Finally decided to unlock the vault .
This is not your grandma's Ghidra script. This is hypervisor-level taint-tracing , micro-op fuzzing , and ring‑0 instrumentation on steroids.
If you're still patching IATs manually or sweating over OEP obfuscation, close this thread now . You're not ready.
CORE TOOLSET – `kingskrupellos` Exclusive
1. Zypheris – `zypheris.elf` (static/dynamic hybrid disassembler)
- Arch: x86_64 / ARM64 / RISC‑V (custom microcode layer)
- Function: Control‑Flow Graph (CFG) re-synthesis via entropy‑based basic‑block prediction
- Innovation: Uses stochastic taint propagation across register‑renaming buffers (RRBs) to reconstruct obfuscated jump tables without emulation.
- Output: `.zyp` intermediate format → feed directly into `Fenrir` (see below)
"Reads binaries like they're plaintext. Pukes out clean CFGs even through VMProtect 3.x and Themida 2.x ."
2. Fenrir – `fenrir.x86` (symbolic execution engine + deobfuscator)
- Core: Path‑constrained symbolic solver with custom SMT‑backed heuristics
- Killer feature: Obfuscation‑aware alias analysis – detects and collapses control‑flow flattening , opaque predicates , and MBA (mixed‑Boolean‑arithmetic) expressions
- Memory model: Segmented shadow‑stack emulation – tracks heap/stack collisions in real‑time
- Scripting: `fenrir‑script` – Python‑like DSL for writing custom deobfuscation routines
"Flattened switch‑cases? Fenrir eats them for breakfast. No more 10,000‑block nightmares."
3. Vexor – `vexor.drv` (kernel‑mode unpacker / ring‑0 debugger)
- Attack surface: Hypervisor‑assisted unpacking – uses VT‑x / AMD‑V to trap interrupts and syscalls during unpacking routines
- Breakpoint engine: Non‑int3 hardware breakpoints via DR0‑DR7 manipulation + page‑fault injection
- Unpacking: Dump‑on‑execute (DOE) – captures decrypted sections at the exact moment of OEP resolution
- Bypasses: Anti‑debugging checks (NtQueryInformationProcess, PEB flags, heap‑flags) are silently spoofed at the VMM layer
"Runs in VMX root mode . The target never knows it's being debugged. Ever."
4. Nyx – `nyx.node` (neural‑augmented pattern matcher)
- Tech: Transformer‑based opcode embedding – trained on 3.7M malware samples and 11TB of binary corpora
- Use: Identifies crypto constants , custom hash routines , and proprietary compression algorithms via latent‑space similarity search
- Output: Generates signature‑less YARA rules on‑the‑fly – zero false positives
"Found a ChaCha20‑Poly1305 implementation inside a packed driver in 4 seconds. No strings. No imports. Pure opcode fingerprinting."
5. Kronos – `kronos.so` (runtime instrumentation / Frida‑alternative)
- Mechanism: Inline hooking via trampoline synthesis – dynamically rewrites prologue/epilogue with atomic ROP‑gadget injection
- Tracing: System‑call interposition + shared‑memory ring‑buffer for zero‑latency logging
- Scripting: JavaScript API (similar to Frida) but with lower overhead and custom GC‑free allocator
"Hooks ntdll.dll!ZwCreateFile without touching the IAT. Invisible to PG (PatchGuard) and KPP (Kernel Patch Protection) ."
6. Erebos – `erebos.bin` (binary patching / mutation engine)
- Function: Binary‑level mutation – rewrites instruction streams while preserving original semantics
- Uses: Patch‑generation , checksum‑bypass , license‑validity spoofing
- Advanced: Context‑aware substitution – replaces Jcc instructions with semantically‑equivalent but signature‑different sequences (e.g., `CMOV` + `SETcc` combos)
"Patched a FlexNet‑protected binary in 12 seconds. License check now returns `0xDEADBEEF` and calls it a day."
7. Styx – `styx.sys` (kernel‑level memory forensics / anti‑anti‑dump)
- Feature: Physical‑memory scraping – bypasses virtual‑address‑space isolation
- Use: Dumps decrypted PE sections from kernel‑pool and non‑paged memory
- Anti‑analysis: Spoofs `NtQuerySystemInformation` calls to hide active processes and loaded drivers
"Pulled a Molebox‑packed executable out of RAM while it was self‑decrypting . Perfect reconstruction."
WORKFLOW – Full Reversing Pipeline1. Stage 0: Feed binary → `Zypheris` → get `.zyp` CFG
2. Stage 1: Pass `.zyp` → `Fenrir` → deobfuscated `.fen` IR
3. Stage 2: Run `.fen` → `Vexor` → dump unpacked `.dmp`
4. Stage 3: Scan `.dmp` → `Nyx` → locate crypto/hash routines
5. Stage 4: Instrument live process → `Kronos` → trace syscalls
6. Stage 5: Patch final binary → `Erebos` → generate patched `.exe`
7. Stage 6: (Optional) Memory carve → `Styx` → extract hidden artifacts
"End‑to‑end: < 90 seconds for average VMProtect target."
BENCHMARKS (internal testing)
| Target | Protector | Time | Success Rate |
|-- |-- | |-- |
| `crackme_x64.exe` | UPX + custom obf | 11s | 100% |
| `license_drv.sys` | Themida 2.4 | 47s | 100% |
| `game_protected.bin` | VMProtect 3.5 | 89s | 97.3% |
| `malware_sample.dll` | Enigma 6.8 | 33s | 100% |
| `custom_elf.riscv` | proprietary packer | 124s | 91.8% |
REQUIRED ENVIRONMENT
- OS: Windows 10/11 (x64) or Linux (kernel 5.15+)
- CPU: Intel VT‑x or AMD‑V support
- RAM: 16GB+ recommended
- Disk: 2GB free (for symbol caches)
- Dependencies: `libcapstone.so.5`, `libunwind.so.8`, `libz.so.1`
AVAILABILITY
Private beta – limited to 25 slots .
- Contact: `kingskrupellos` via Rootsploit PM (PGP‑encrypted preferred)
- Payment: XMR only (0.35 XMR for full toolstack + 6 months updates)
- Proof: I'll send you a crackme patched live via AnyDesk – no pre‑release binaries.
RELEASE NOTES / CHANGELOG – v1.0.3 (07/19/2026)
================================================================
kingskrupellos Toolstack – Changelog
================================================================
Version: 1.0.3
Build: 2026.07.19.0442
Status: Stable Release (Beta Channel)
================================================================
[ADDED]
- Nyx: Transformer model updated to v2.3.1 (improved opcode embedding accuracy by 14.7%)
- Kronos: Added ARM64 support (tested on Apple M2, Qualcomm Snapdragon X Elite)
- Erebos: New 'semantic-preserving' mutation mode (--preserve-semantics flag)
- Styx: Physical memory scanner now supports UEFI runtime services extraction
[FIXED]
- Zypheris: Fixed CFG reconstruction bug on binaries 500MB (heap overflow)
- Fenrir: Resolved SMT solver timeout on MBA expressions with 12 nested layers
- Vexor: Addressed DR7 register corruption on AMD Zen 4 CPUs (MSR quirk)
- Kronos: Fixed memory leak in ring-buffer allocator (was leaking ~4KB/hour)
[IMPROVED]
- Vexor: Reduced unpacking latency by 22% (optimized VM-exit handler)
- Nyx: Lowered false-positive rate from 0.7% to 0.04% (retrained on cleaner dataset)
- Fenrir: Added multi-threaded symbolic exploration (up to 8 cores)
- Installer: Now detects and auto-installs missing dependencies (libcapstone, etc.)
[SECURITY]
- All binaries now signed with custom Ed25519 key (fingerprint: 3A:7F:9E:2D:1C:88:44:FF)
- Added anti-tamper checksum verification on startup
- Encrypted configuration files (XChaCha20-Poly1305)
[KNOWN ISSUES]
- Vexor may crash on Intel CPUs without EPT (Extended Page Tables)
- Nyx fails to load on systems with < 8GB RAM (memory-mapped model too large)
- Kronos JavaScript API incomplete (missing 'onDetach' callback)
[NEXT]
- Tartarus (v2.0): AI fuzzing engine – expected Q4 2026
- Lethe (v2.0): Anti-forensic cleaner – expected Q4 2026
- Moros (v2.0): Remote debugging proxy – expected Q1 2027
[UPGRADE]
- Existing beta users: Run './update.sh --full' to pull latest builds
- Checksum (SHA-256): 7F3A:9E2D:1C88:44FF:3A7F:9E2D:1C88:44FF
================================================================
FAQ (preemptive)
Q: Is this detected by AV?
A: `Vexor` and `Styx` are ring‑0 – no user‑mode hooks. 0/68 on VirusTotal at time of writing.
Q: Can I run this on a VM?
A: Yes, but nested virtualization is required for `Vexor`. Use VMware ESXi or Proxmox with VT‑x passthrough.
Q: What about obfuscated .NET / Java?
A: Not supported yet. This is native‑code only (PE / ELF / Mach‑O).
Q: Does this work against Denuvo ?
A: Partial. `Fenrir` can de‑flatten, but anti‑tamper triggers need manual patching via `Erebos`. I'll include a Denuvo‑specific script for beta testers.
ROADMAP (v2.0 – Q4 2026)
- Tartarus – AI‑driven vulnerability discovery (fuzzing + symbolic hybrid)
- Lethe – Anti‑forensic binary cleaner (wipes PE timestamps, checksums, debug sections)
- Moros – Remote‑debugging proxy (tunnel `Vexor` over Tor)
[FOLLOW-UP] kingskrupellos – CRACKME CHALLENGE (v1.0)
