Project-Oedipus - Three PowerShell scripts to silently disable, back

项目说明

USB Camera Stealth Toolkit

![Platform]()
![Language]()
![License](LICENSE)
![Admin Required](#requirements)

Temporarily disable any U on your own Windows machine — no policy keys, no "device disabled" flags, no Group Policy fingerprints.

The camera appears to have a broken driver. Device Manager shows a yellow triangle and a generic Code 39 error. When you're done, a single script brings e back exactly as it was.

> Use only on hardware you own or with explicit written permission.
> The author assumes no liability for misuse.

---

⚠️ Warning

This toolkit modifies protected system files and ACLs. Misuse can leave your webcam non-functional until you manually restore from backup, or re-install the driver Update.

Always run CameraBackup.ps1 before CameraService.ps1.

Always test with -WhatIf (disable and restore only) before a live run.

A reboot is required after every disable and every restore for changes to fully apply.

---

What's Inside

| Script | Purpose |
|---|---|
| CameraBackup.ps1 | Snapshots all U components to an encrypted-manifest backup |
| CameraService.ps1 | Disables the camera corruption and ACL manipulation |
| CameraRestore.ps1 | Restores every component from the backup, exactly as it was |

---

Key Features

No policy changes — the camera simply looks like broken hardware, not a blocked device.

DPAPI-encrypted manifest — the backup index (index.bin) is encrypted and tied to your Windows user account. A machine-scope fallback (index.bin.machine) can be decrypted by any local administrator on the same machine, protecting against profile corruption.

Timestomping — backup files and modified system files ha timestamps o to match those of ntfs.sys, blending them in with surrounding OS artifacts.

Portable — uses %SystemRoot% and %LOCALAPPDATA% throughout; works on any dri, not just C:\.

Self-ele — all three scripts detect insufficient pri and re-launch with a UAC prompt automatically.

Silent mode — all console output is suppressed when launched with -WindowStyle Hidden.

Safe restore — restores the runtime driver, PNF, and dri folder(s); resets ACLs; cleans pending rename operations; returns folder ownership to TrustedInstaller.

Self-clean — -SelfClean securely o every file in the backup folder with 3 passes (random → zero → random) before deleting it.

Simulation mode — -WhatIf on CameraService.ps1 and CameraRestore.ps1 previews every planned change without touching the system. *(Note: CameraBackup.ps1 has no simulation mode — it performs real file copies.)*

---

How It Works

Phase 1 — Backup (`CameraBackup.ps1`)

Copies three categories of dri into a backup folder, then writes a DPAPI-encrypted JSON manifest tracking what was copied and each file's SHA256 hash.

| What is copied | Source path | Backup name |
|---|---|---|
| Runtime driver | %SystemRoot%\System32\drivers\usbvideo.sys | net.dat |
| INF pre-compile file | %SystemRoot%\INF\usbvideo.PNF | cfg.dat |
| Dri folder(s) | %SystemRoot%\System32\Dri\FileRepository\usbvideo.inf_* | drv_<sha256hex>/ |
| Pending rename registry snapshot | HKLM:\...\Session Manager\PendingFileRenameOperations | inside index.bin |

The backup folder is stored at %LOCALAPPDATA%\Microsoft\Windows\Caches\{deri}. The GUID is deterministic: it is derived from SHA256(COMPUTERNAME + USERNAME + "cam"), so it can always be recalculated and does not need to be written down.

> Important: Only the manifest files (index.bin, index.bin.machine) are DPAPI-encrypted. The dri themselves (net.dat, cfg.dat, and the drv_* folders) are plaintext copies. The backup folder's security relies on its obscure derived path, timestomping, and the self-clean option — not file-le.

After writing the backup, Set-Timestamp o the creation, write, and access times of every file and the folder itself to match those of ntfs.sys, making the backup indistinguishable from ambient OS artifacts by timestamp alone.

Phase 2 — Disable (`CameraService.ps1`)

Corrupts the U in three ways, each targeting a different layer Windows uses to load it:

Dri folder(s)
Takes ownership, grants Administrators full control, empties the folder, replaces its contents with zero-byte usbvideo.inf and usbvideo.sys decoys, then applies Deny ACEs for NT AUTHORITY\SYSTEM and NT SERVICE\TrustedInstaller to prevent auto-repair.

PNF file
Opens usbvideo.PNF via a file stream and sets its length to zero in-place, destroying its content without deleting the file entry.

Runtime driver (usbvideo.sys)

If the file can be opened for writing, it is truncated to zero bytes immediately and write-Deny ACEs are applied to prevent repair.

If the driver is in use (file locked), a zero-byte temp file is written to %TEMP% and a PendingFileRenameOperations entry is added to the Session Manager registry key, scheduling the swap on next boot. Deny ACEs are deliberately not applied in this case to avoid conflicts with the pending rename.

Policy cleanup
If HKLM:\SOFTWARE\Policies\Microsoft\Camera\AllowCamera exists, it is removed. This prevents a conflicting policy entry from interfering with the hardware-failure illusion.

Stale temp file cleanup
At startup, CameraService.ps1 scans %TEMP% for zero-byte files older than one hour whose names match the random-filename pattern it generates, and removes them. This cleans up orphaned temp files left by any previous aborted run.

After disable, unplug the webcam and reboot. Windows re-e the driver on plug-in; the zero-byte or missing dri a Code 39 hardware error, with no policy or pri fingerprints.

Phase 3 — Restore (`CameraRestore.ps1`)

Decrypts the manifest (tries CurrentUser scope first; falls back to LocalMachine if that fails), then re every change:

Reads the original dri path and SHA256 hash from the manifest.

Removes Deny ACEs from the runtime driver, deletes the zero-byte stub, and copies net.dat back as usbvideo.sys.

Clears Deny ACEs and decoy files from the dri folder(s), copies the originals back, and restores TrustedInstaller ownership.

Copies cfg.dat back as usbvideo.PNF.

Scans PendingFileRenameOperations for pairs in usbvideo.sys and removes them, preserving all other pairs.

Optionally removes AllowCamera registry value (-CleanPolicy).

Optionally wipes the backup folder with a 3-pass secure erase (-SelfClean).

After restore, unplug the webcam and reboot.

---

Requirements

Windows 10 or Windows 11 (64-bit recommended)

PowerShell 5.1 or later (ships with Windows 10/11)

Administrator rights — scripts self-elevate via UAC, but UAC must be enabled

PowerShell execution policy must permit script execution:

---

Quick Start

Always back up before disabling.

Preview before committing (recommended for first run)

-WhatIf is a on the disable and restore scripts. Use it to what each script would do before any files are touched:

Silent, no-history run

Launching with -NonInteractive and -WindowStyle Hidden suppresses all console output and prevents the commands from appearing in PSReadLine history:

---

Parameter Reference

`CameraBackup.ps1`

| Parameter | Description |
|---|---|
| -BackupPath <path> | O the auto-deri location |
| -SkipDri | Skip backing up dri folder(s) |
| -SkipRuntimeDriver | Skip usbvideo.sys |
| -SkipPnf | Skip usbvideo.PNF |
| -SkipRegistry | Skip the PendingFileRenameOperations snapshot |

> No -WhatIf — this script always performs real file operations.

`CameraService.ps1`

| Parameter | Description |
|---|---|
| -BackupPath <path> | Check for an existing backup at this path (warning only if absent) |
| -Force | Continue even when no backup is found, without prompting |
| -WhatIf | Preview all planned changes without modifying anything |

`CameraRestore.ps1`

| Parameter | Description |
|---|---|
| -BackupPath <path> | Location of the backup folder (auto-derived if omitted) |
| -CleanPolicy | Also remove the AllowCamera registry value if present |
| -Force | Suppress confirmation prompts |
| -WhatIf | Preview all planned changes without modifying anything |
| -SelfClean | Securely wipe the backup folder (3-pass o) after a successful restore |

---

Safety & Design Philosophy

No permanent system changes — a successful restore returns every modified file and permission to its exact original state.

No external processes — pure PowerShell and .NET APIs throughout. No icacls.exe, no takeown.exe, no spawned child processes.

Defensive by design — -WhatIf lets you audit every planned operation before it runs; -Force is opt-in, not the default.

Self-cleaning — -SelfClean ensures backup files don't linger after restore.

Timestomping — all created and modified files are gi matching ntfs.sys to reduce in casual forensic scans.

Dual-scope DPAPI — the manifest is encrypted twice: once with CurrentUser scope (tied to your login) and once with LocalMachine scope (reco by any local admin on the same machine, protecting against profile corruption).

> Note on machine-scope backup: Any local administrator on the same machine can decrypt index.bin.machine. This is intentional — it protects you if your user profile is corrupted — but reduces confidentiality in multi-admin en. Use -SelfClean after restore if that is a concern.

---

Limitations

U — integrated laptop cameras, proprietary drivers (e.g. certain Logitech models), and IP cameras are not affected. This toolkit targets the standard usbvideo.sys U.

Reboot required — changes take effect when Windows re-enumerates the device on plug-in after a reboot. There is no li path.

Windows Update can repair the driver — Windows Update and dri tools can restore usbvideo.sys from Windows Component Store. If that happens, run CameraService.ps1 again.

powershell.exe is in Task Manager — even with -WindowStyle Hidden, the process appears in Task Manager. Tools like ps2exe can reduce this footprint by compiling the script to a standalone .exe.

Not forensic-proof — a targeted analyst can detect zero-byte dri, Deny ACEs, and the GUID backup folder. The design goal is to prevent detection by standard user-facing tools, not by a forensic in.

---

Contributing

Bug reports and thoughtful pull requests are welcome. Please open an issue first to discuss any changes before submitting a PR.

---

License

项目信息

开发语言：PowerShell

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Three PowerShell scripts to silently disable, backup, and restore standard USB webcams on Windows. No privacy flags, no group policy fingerprints – just a generic driver error.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	Project-Oedipus - Three PowerShell scripts to silently disable, back
所属分类	防护思路
发布作者	admin
发布时间	2026-10-06 00:22:45
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	311
讨论数量	0
主题状态	正常讨论中