+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] How-To Make your own Scantime/Runtime Vista/7/XP crypter (/showthread.php?tid=379558)
* - krayon - Apr 22, 2010
So this method is working flawlessly on windows 7 victims, but on xp home it seems to open up multiple instances of the server and cancels each other out. Ending up in a death loop of services starting and stopping. Any idea why it would keep trying to open the file over and over? I swear RunPE has a mind of its own sometimes.
* - South Park - Apr 22, 2010
Now theirs going to be another 100 crypters on the marketplace.
* - stoney666 - Apr 22, 2010
Thanks man this helped me on my crypter im working on shouldnt be long now there will be a PUBLIC beta and then it will probably go private ill give credits to you and everyone else i need 2.
* - L0w hack3r - Apr 23, 2010
nice tut im going to read this later its bit long...🤝
* - JIMP - Apr 23, 2010
(Apr 22, 2010 08:42 PM)krayon Wrote: So this method is working flawlessly on windows 7 victims, but on xp home it seems to open up multiple instances of the server and cancels each other out. Ending up in a death loop of services starting and stopping. Any idea why it would keep trying to open the file over and over? I swear RunPE has a mind of its own sometimes.
i totally agree.
* - DeltaNox - Apr 23, 2010
Very nice tutorial. You're the first I've seen actually explain what the parts of the RunPE do, this will be helpful for members wanting to learn and write their own.
* - HeXploit - Apr 23, 2010
@$atanrulze
Could you list the service packs and .Net frameworks you have installed, as it could be a incorrect mix you have that's causing you error.
If you want you could PM me and I could help.
Yours,
HeXploit
* - JIMP - Apr 23, 2010
I dont think its th prob of .net framework.It works for some exe.
* - krayon - Apr 23, 2010
(Apr 23, 2010 06:30 AM)$atanrulze Wrote: I dont think its th prob of .net framework.It works for some exe.
This is exactly right, after further testing it works fine with dark comet under xp and windows7...and goes ape sh1t with cybergate under xp but fine under win7...it's just the nature of the beast.
* - stoney666 - Apr 23, 2010
well i cant figure out how to get rid of the avira detection.
* - Wind - Apr 23, 2010
(Apr 23, 2010 04:59 PM)stoney666 Wrote: well i cant figure out how to get rid of the avira detection.
I've been told all you need to do is change the icon of your .exe.
✌
* - stoney666 - Apr 23, 2010
(Apr 23, 2010 05:25 PM)Wind Wrote: I've been told all you need to do is change the icon of your .exe.
✌
ive tried that it dont work.
* - imperium - Apr 23, 2010
RunPE ideas:
I bet you the reason it doesn't work on 64-bit is because of this line where it checks the registers (since the processors are structured differently, the apis will work on any processor) I'm just trying to figure out if I'm right and if I can bypass it since it looks like its just checking to see if there are any values in the thread before injecting the byte array.
Code
If H.GetThreadContext(PI.Thread, C) And H.ReadProcessMemory(PI.Process, C.Ebx + 8, Address, 4, 0) >= 0 And H.ZwUnmapViewOfSection(PI.Process, Address) >= 0 ThenAny one familiar with this?
I did something similar in C# that injects shellcode into an existing process and it works on Win7 64 (and 32) since thats what I'm running, I just used the raw api calls, so i'm assuming I can do the same for this. Right now I'm just going through it all and seeing if I should try to convert it or start from scratch based on my program since I use c# not vb.net.
Check out my program shellInjector @ http://imperiumsec.com
* - JIMP - Apr 23, 2010
(Apr 23, 2010 08:41 PM)imperium Wrote: RunPE ideas:
I bet you the reason it doesn't work on 64-bit is because of this line where it checks the registers (since the processors are structured differently, the apis will work on any processor) I'm just trying to figure out if I'm right and if I can bypass it since it looks like its just checking to see if there are any values in the thread before injecting the byte array.
CodeIf H.GetThreadContext(PI.Thread, C) And H.ReadProcessMemory(PI.Process, C.Ebx + 8, Address, 4, 0) >= 0 And H.ZwUnmapViewOfSection(PI.Process, Address) >= 0 Then
Any one familiar with this?
I did something similar in C# that injects shellcode into an existing process and it works on Win7 64 (and 32) since thats what I'm running, I just used the raw api calls, so i'm assuming I can do the same for this. Right now I'm just going through it all and seeing if I should try to convert it or start from scratch based on my program since I use c# not vb.net.
Check out my program shellInjector @ http://imperiumsec.com
Can u be more specific bro.I think ur geting to somewhere usefull.
* - imperium - Apr 23, 2010
Specifically I'm trying to make it work on a 64bit processors, right now using my own code I can inject shellcode into a process but not start a process from a full pe in 64bit. Going through this runpe module line by line I'm trying to find the areas that are 32-bit specific and the line I posted above is one place that jumps out at me. So I'm asking people who are experienced with this technique of starting a process if they know the areas we can change to make it work on both 32 and 64 bi processors.