ThirdEye 1.0.6

Third Eye

Usermode WDA_MONITOR/WDA_EXCLUDEFROMCAPTURE bypasser written in C++ with bindings for several popular languages.

Starring:

• PEB walking
• Tartarus Gate
• Custom PE sections
• Zw* Windows functions
• EDR/AV evasion (0/70 on VirusTotal)
• No 0F 05 via ntdll.dll indirection
• constexpr AES-like literals shredding, clean .rodata

Getting Started

<details> <summary>TS</summary>

Install:

npm i @lofcz/thirdeye

Use:

import { ThirdEyeSession, ThirdeyeFormat } from '@lofcz/thirdeye';

const session = new ThirdEyeSession();
session.captureToFile('screenshot.jpg');
session.close();

With options:

session.captureToFile('screenshot.jpeg', {
  format: ThirdeyeFormat.Jpeg,
  quality: 90,
  bypassProtection: true,
});

Capture to memory:

const buffer: Buffer = session.captureToBuffer();

</details>

<details> <summary>C#</summary>

Install:

dotnet add package ThirdEye

Use:

using ThirdEye;

using var session = new ThirdEyeSession();
session.CaptureToFile("screenshot.jpg");

With options:

var options = new ThirdEyeOptions(
    format: ThirdeyeFormat.Jpeg,
    quality: 90,
    bypassProtection: true
);
session.CaptureToFile("screenshot.jpeg", options);

Capture to memory:

byte[] buffer = session.CaptureToBuffer();

</details>

<details> <summary>Python</summary>

Install:

pip install eye3

Use:

from eye3 import ThirdEyeSession, ThirdEyeOptions, ThirdeyeFormat

with ThirdEyeSession() as session:
    session.capture_to_file("screenshot.jpg")

With options:

options = ThirdEyeOptions(
    format=ThirdeyeFormat.JPEG,
    quality=90,
    bypass_protection=True,
)
session.capture_to_file("screenshot.jpeg", options)

Capture to memory:

buffer: bytes = session.capture_to_buffer()

</details>

<details> <summary>C/C++</summary>

Install: download thirdeye.dll + thirdeye_core.h from the latest release (or build from c/).

Use:

#include "thirdeye_core.h"

ThirdeyeContext* ctx = nullptr;
if (Thirdeye_CreateContext(&ctx) == THIRDEYE_OK) {
    Thirdeye_CaptureToFile(ctx, L"screenshot.jpg", nullptr);
    Thirdeye_DestroyContext(ctx);
}

With options:

ThirdeyeOptions options;
Thirdeye_GetDefaultOptions(&options);
options.format = THIRDEYE_FORMAT_JPEG;
options.quality = 90;
Thirdeye_CaptureToFile(ctx, L"screenshot.jpeg", &options);

Capture to memory:

uint8_t* buffer = nullptr;
uint32_t size = 0;
Thirdeye_CaptureToBuffer(ctx, &buffer, &size, nullptr);
Thirdeye_FreeBuffer(buffer);

</details>