/* name Vx Api type trojan cve — year unknown os Windows authors unknown source krisyotam archived krisyotam (2026) notes — */#include "Win32Helper.h" ULONG LzMaximumCompressBuffer(_In_ PBYTE UncompressedBuffer, _In_ ULONG SizeOfUncompressedBufferInBytes, _Inout_ PBYTE CompressedBuffer, _In_ ULONG CompressedBufferSizeInBytes){ RTLCOMPRESSBUFFER RtlCompressBuffer = NULL; RTLGETCOMPRESSIONWORKSPACESIZE RtlGetCompressionWorkSpaceSize = NULL; HMODULE hMod = NULL; NTSTATUS Status = STATUS_SUCCESS; USHORT CompressionFormatAndEngine = COMPRESSION_FORMAT_LZNT1 | COMPRESSION_ENGINE_MAXIMUM; ULONG CompressBufferWorkSpaceSize = 0; ULONG CompressFragmentWorkSpaceSize = 0; PVOID Workspace = NULL; ULONG FinalCompressedSize = 0; hMod = GetModuleHandleEx2W(L"ntdll.dll"); if (hMod == NULL) goto EXIT_ROUTINE; RtlCompressBuffer = (RTLCOMPRESSBUFFER)GetProcAddressA((DWORD64)hMod, "RtlCompressBuffer"); RtlGetCompressionWorkSpaceSize = (RTLGETCOMPRESSIONWORKSPACESIZE)GetProcAddressA((DWORD64)hMod, "RtlGetCompressionWorkSpaceSize"); if (!RtlCompressBuffer || !RtlGetCompressionWorkSpaceSize) goto EXIT_ROUTINE; Status = RtlGetCompressionWorkSpaceSize(CompressionFormatAndEngine, &CompressBufferWorkSpaceSize, &CompressFragmentWorkSpaceSize); if (Status != STATUS_SUCCESS) goto EXIT_ROUTINE; if (CompressBufferWorkSpaceSize == 0) goto EXIT_ROUTINE; Workspace = HeapAlloc(GetProcessHeapFromTeb(), HEAP_ZERO_MEMORY, CompressBufferWorkSpaceSize); if (Workspace == NULL) goto EXIT_ROUTINE; Status = RtlCompressBuffer(CompressionFormatAndEngine, UncompressedBuffer, SizeOfUncompressedBufferInBytes, CompressedBuffer, CompressedBufferSizeInBytes, 4096, &FinalCompressedSize, Workspace); if (Status != STATUS_SUCCESS) goto EXIT_ROUTINE; EXIT_ROUTINE: if (Workspace) HeapFree(GetProcessHeapFromTeb(), HEAP_ZERO_MEMORY, Workspace); return FinalCompressedSize;}
/*
name Vx Api
type trojan
cve —
year unknown
os Windows
authors unknown
source krisyotam
archived krisyotam (2026)
notes —
*/
#include "Win32Helper.h"
ULONG LzMaximumCompressBuffer(_In_ PBYTE UncompressedBuffer, _In_ ULONG SizeOfUncompressedBufferInBytes, _Inout_ PBYTE CompressedBuffer, _In_ ULONG CompressedBufferSizeInBytes)
{
RTLCOMPRESSBUFFER RtlCompressBuffer = NULL;
RTLGETCOMPRESSIONWORKSPACESIZE RtlGetCompressionWorkSpaceSize = NULL;
HMODULE hMod = NULL;
NTSTATUS Status = STATUS_SUCCESS;
USHORT CompressionFormatAndEngine = COMPRESSION_FORMAT_LZNT1 | COMPRESSION_ENGINE_MAXIMUM;
ULONG CompressBufferWorkSpaceSize = 0;
ULONG CompressFragmentWorkSpaceSize = 0;
PVOID Workspace = NULL;
ULONG FinalCompressedSize = 0;
hMod = GetModuleHandleEx2W(L"ntdll.dll");
if (hMod == NULL)
goto EXIT_ROUTINE;
RtlCompressBuffer = (RTLCOMPRESSBUFFER)GetProcAddressA((DWORD64)hMod, "RtlCompressBuffer");
RtlGetCompressionWorkSpaceSize = (RTLGETCOMPRESSIONWORKSPACESIZE)GetProcAddressA((DWORD64)hMod, "RtlGetCompressionWorkSpaceSize");
if (!RtlCompressBuffer || !RtlGetCompressionWorkSpaceSize)
goto EXIT_ROUTINE;
Status = RtlGetCompressionWorkSpaceSize(CompressionFormatAndEngine, &CompressBufferWorkSpaceSize, &CompressFragmentWorkSpaceSize);
if (Status != STATUS_SUCCESS)
goto EXIT_ROUTINE;
if (CompressBufferWorkSpaceSize == 0)
goto EXIT_ROUTINE;
Workspace = HeapAlloc(GetProcessHeapFromTeb(), HEAP_ZERO_MEMORY, CompressBufferWorkSpaceSize);
if (Workspace == NULL)
goto EXIT_ROUTINE;
Status = RtlCompressBuffer(CompressionFormatAndEngine, UncompressedBuffer, SizeOfUncompressedBufferInBytes, CompressedBuffer, CompressedBufferSizeInBytes, 4096, &FinalCompressedSize, Workspace);
if (Status != STATUS_SUCCESS)
goto EXIT_ROUTINE;
EXIT_ROUTINE:
if (Workspace)
HeapFree(GetProcessHeapFromTeb(), HEAP_ZERO_MEMORY, Workspace);
return FinalCompressedSize;
}