
项目说明
Richkware
![CI]()
![CodeQL]()
Richkware is a modern C++20 framework for building educational malware agents. It provides a comprehensi, and modular architecture for understanding malware mechanics and cybersecurity defense strategies.
> Disclaimer / Ethical use: This project is intended only for educational and research purposes. Do not use the code to harm, compromise, or access systems without explicit permission. The author and contributors are not responsible for misuse.
Architecture
Richkware features a modern modular architecture with the following components:
Core: Agent management, configuration, and error handling
Crypto: Modern cryptographic operations (AES-256-GCM, key deri)
Network: Secure C2 communications with TLS 1.3 support
System: Persistence, pri management, and stealth capabilities
Modules: Command execution, file operations, and system control
Utils: JSON parsing, logging framework, and helper functions
System O
Richkware operates as part of a three-component ecosystem:
Richkware Agent (this project): The C++ malware framework that runs on target systems
Richkware-Manager-Server (RMS): Command and control server
Richkware-Manager-Client (RMC): GUI client for operator interaction
!System Diagram
Documentation
| | EN | IT |
|--------------|:----------------------------:|:----------------------:|
| Presentation | PDF | PDF |
| Report | PDF | PDF |
Features
Core Capabilities
Modern C++20: Uses latest C++ standards with concepts, coroutines, and smart pointers
Memory Safety: RAII principles, smart pointers, and bounds checking
Type Safety: Strong typing with std::expected for error handling
Thread Safety: Concurrent operations with proper synchronization
Security
AES-256-GCM Encryption: Modern authenticated encryption
TLS 1.3 Communications: Secure C2 channel with certificate pinning
Key Deri: PBKDF2/Argon2 for secure key generation
Secure Random: Cryptographically secure random number generation
System Integration
Multi-Method Persistence: Registry, services, scheduled tasks, WMI
Pri Management: UAC bypass and pri escalation
Stealth Operations: Process hiding and anti-analysis techniques
Command Execution: Multiple backends (CMD, PowerShell, WMI)
Network Operations
Asynchronous I/O: Non-blocking network operations
HTTP/HTTPS Client: Modern HTTP client with connection pooling
C2 Protocol: Encrypted command and control communications
Resilient Connections: Automatic retry and failo
File Operations
File Management: Read, write, delete, and search files
Directory Listing: Browse filesystem with metadata
Exfiltration Support: Encrypted file upload/download
Pattern Matching: Wildcard-based file searching
Utilities
Ad JSON: Complete JSON parser/serializer with object/array support
Logging Framework: Thread-safe logging with multiple levels
Error Handling: Consistent Result<T> pattern throughout
CI/CD
Richkware uses GitHub Actions for comprehensi CI testing.
Build Status
!CI
Requirements
To build and use Richkware, you need:
CMake 3.20+
C++20 compliant compiler:
-
MSVC 2022+ ( Studio 2022)
-
GCC 11+
-
Clang 13+
OpenSSL 3.0+ (for cryptographic operations)
Google Test (for unit testing, optional)
Platform Support
| Platform | Compiler | Build Status |
|----------|----------|--------------|
| Linux | GCC 11+, Clang 13+ | ✅ CI Passing |
| macOS | Clang (Xcode 16+) | ✅ CI Passing |
| Windows | MSVC 2022 | ✅ CI Passing |
| Cross-compilation | MinGW-w64 | ❌ Not supported |
Current CI Build Matrix:
Ubuntu 24.04: GCC 11, Clang 13
macOS 14: Clang (latest)
Windows 2022: MSVC 2022
All platforms are tested and supported through GitHub Actions CI with automated builds.
Getting Started
Basic Usage
Configuration Options
The agent can be configured through:
Code: Direct configuration in source
En : Runtime configuration
JSON/YAML Files: External configuration files
Compilation
Quick Build Scripts (Recommended)
For interacti configuration, use the provided scripts:
Linux/macOS:
Windows:
The scripts will prompt you for:
Target platform (current, Linux, Windows, macOS)
Build type (Release/Debug)
Optional features (tests, sanitizers, co)
Using CMake Directly
Build Options
Dependencies Installation
#### Ubuntu/Debian
#### Windows (vcpkg)
Usage Examples
Command Execution
Stealth Operations
Persistence
Secure Communications
File Operations
Logging
API Reference
Core Components
#### Agent
#### File Manager
#### Command Executor
#### Cryptography
#### JSON Utilities
#### Logging
Testing
Richkware includes comprehensive unit and integration tests:
Contributing
Contributions are welcome! Please:
1. Follow the existing code style
2. Add tests for new functionality
3. Update documentation
4. Ensure all tests pass
License
This project is licensed under the terms specified in the LICENSE file.
Security Notice
This software is for educational purposes only. Using this software for unauthorized access to computer systems is illegal and unethical. The authors are not responsible for misuse of this software.
Features
Core Capabilities
Modern C++20: Uses latest C++ standards with concepts, coroutines, and smart pointers
Memory Safety: RAII principles, smart pointers, and bounds checking
Type Safety: Strong typing with std::expected for error handling
Thread Safety: Concurrent operations with proper synchronization
Security
AES-256-GCM Encryption: Modern authenticated encryption
TLS 1.3 Communications: Secure C2 channel with certificate pinning
Key Deri: PBKDF2/Argon2 for secure key generation
Secure Random: Cryptographically secure random number generation
System Integration
Multi-Method Persistence: Registry, services, scheduled tasks, WMI
Pri Management: UAC bypass and pri escalation
Stealth Operations: Process hiding and anti-analysis techniques
Command Execution: Multiple backends (CMD, PowerShell, WMI)
Network Operations
Asynchronous I/O: Non-blocking network operations
HTTP/HTTPS Client: Modern HTTP client with connection pooling
C2 Protocol: Encrypted command and control communications
Resilient Connections: Automatic retry and failo
Ad Modules
File Management: Read, write, delete, and search files with encryption support
Keylogger: Cross-platform keyboard input capture with real-time callbacks
Screenshot: Screen capture for entire desktop or specific windows
Process Management: Enumerate, start, terminate, and inject into processes
Anti-Analysis: Detect debuggers, machines, and sandbox en
Self-Deletion: Secure agent removal and cleanup
Utilities
Ad JSON: Complete JSON parser/serializer with object/array support
Logging Framework: Thread-safe logging with multiple levels and timestamps
Error Handling: Consistent Result<T> pattern throughout the codebase
Related Projects
Richkware-Manager-Server: C2 server for agent management
Richkware-Manager-Client: GUI client for C2 operations
项目信息
开发语言:C++
Star 数:547
技术要点
该项目属于病毒分析方向的开源资源,代码结构清晰,适合安全研究人员学习参考。项目围绕Richkware is a modern C++20 framework for building educational malware agents. It provides a comprehensive, secure, and modular architecture for understanding malware mechanics and cybersecurity defense strategies.展开,提供了可运行的实现,对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看,此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论,梳理项目的初始化流程、核心模块职责与数据流转,逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包,解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证,避免影响生产系统。
免责声明
本资源来源于开源社区,仅供安全研究、技术学习与合法授权范围内的攻防演练使用,请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。