+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] [SCR] New way of EOF Data (No Dropper Detection) ! (/showthread.php?tid=429735)
* - GoldStar - May 19, 2010
i understand it, but i feel like it's unsecure.
what if the file has numbers in it's eof? that will fuck it off.
btw, the Split is also not 100% secure, but there is a very small chance that the stub or the file contains the split string, specially if the split is some wierd sentence lool. well resources are more secure i think. but thx, good thinking.
* - SteloNLD - May 19, 2010
i have a little problem because i see this program writes it like this
stub + file + filesize and normal crypter does it like this
stub + spliter + file yes :P i know how to split it but how
does your your function find the lengt of the filesize because could be 1 ore 12
and the eof contains file + filesize and how does this program knows
that the last 2 chars(example 12) ore the last 1 char(example 1) are the filelenth
i am learning code and i tried to understand this and so far i dont see anything good :P because
you even could write stub + file and then use getEOF result : file
in this case it isn't posible to use some thing like booleans
(example indicates if anti's should be activated ore not )
a stub with booleans looks like his stub + split + file + split + 0/1
( if 0 then the anti's are deactivated if 1 then they are enabled)
* - pr0t0typ3 - May 19, 2010
It won't fuck of because there is nomatter of the other files .. only the number that is written afeter that is detected as after eof and will get read.. anyway it#s working and it is okay for asimple crypter and if you want to continue using eof
(May 19, 2010 11:09 AM)SteloNLD Wrote: i have a little problem because i see this program writes it like thisIt's a kind of strange but the stub+the crypted file is detected as 1 file with 1 eof after teh second file don't knwo why xD
stub + file + filesize and normal crypter does it like this
stub + spliter + file yes :P i know how to split it but how
does your your function find the lengt of the filesize because could be 1 ore 12
and the eof contains file + filesize and how does this program knows
that the last 2 chars(example 12) ore the last 1 char(example 1) are the filelenth
i am learning code and i tried to understand this and so far i dont see anything good :P because
you even could write stub + file and then use getEOF result : file
in this case it isn't posible to use some thing like booleans
(example indicates if anti's should be activated ore not )
a stub with booleans looks like his stub + split + file + split + 0/1
( if 0 then the anti's are deactivated if 1 then they are enabled)
* - smp211 - May 19, 2010
What is the purpose of writing the file.Length in the write_file sub?
* - pr0t0typ3 - May 19, 2010
(May 19, 2010 11:15 AM)smp211 Wrote: What is the purpose of writing the file.Length in the write_file sub?
It is used to fin the start of the second file agian becuase you don't use any splits
* - SteloNLD - May 19, 2010
lol i think i understand
files arent detected as after EOF
so program will think eof is filesize
but when you use
stub + splitter + file
then the splitter is detected as in EOF and because other file is after the spliter(EOF) the av thinks it is other file :P because he sees it as file and in this case he knows it is been written after the EOF
am i richt ore did i explain it the noobie way
* - smp211 - May 19, 2010
(May 19, 2010 11:16 AM)pr0t0typ3 Wrote: It is used to fin the start of the second file agian becuase you don't use any splits
Can you explain where it fits into:
ex = in1.Substring(in1.Length - read_sze.Length - read_sze, read_sze)
Or am i misunderstanding where file.Length is used?
* - Bitwin - May 19, 2010
Pretty good(haven't used yet),
I'll still use resoruces because IMO it's much easier after Julians example (I made some functions out of it.)
* - SteloNLD - May 19, 2010
lol i know how to use this with booleans
write is like this:
stub + file + splitter + filesize + boolean
this work because if he wont detect filesize's as something bad he wont think it of booleans and normal text is no code so this is not detected to :P
is this true then ur are fucking awesome other wise this will be useless for advanced crypters(i think)
* - GoldStar - May 19, 2010
(May 19, 2010 11:25 AM)SteloNLD Wrote: lol i know how to use this with booleans
write is like this:
stub + file + splitter + filesize + boolean
this work because if he wont detect filesize's as something bad he wont think it of booleans and normal text is no code so this is not detected to :P
is this true then ur are fucking awesome other wise this will be useless for advanced crypters(i think)
i think avira is detecting the first EOF, of the stub. cuz it reads it all, and read sections of a valid win32 app, to get the size of the app compiled. then the left is EOF Data. but i hope i'm wrong loool.
* - pr0t0typ3 - May 19, 2010
this is just an simple example if you only want to write on file .. if you want to write differnt inofs you would have to mod this functions
(May 19, 2010 11:29 AM)Miharbi-DoNo Wrote: i think avira is detecting the first EOF, of the stub. cuz it reads it all, and read sections of a valid win32 app, to get the size of the app compiled. then the left is EOF Data. but i hope i'm wrong loool.If you simply write a "/" between the 2 file it will also bedetcted.. I can't explain but it is working for now so plz guys I'm not a macigan I just foudn out how to do this
* - SteloNLD - May 19, 2010
(May 19, 2010 11:29 AM)Miharbi-DoNo Wrote: i think avira is detecting the first EOF, of the stub. cuz it reads it all, and read sections of a valid win32 app, to get the size of the app compiled. then the left is EOF Data. but i hope i'm wrong loool.
?? with first EOF u mean the file(encrypted virus :P)
* - Deathader - May 19, 2010
Ew ew ew ew EW. Do NOT use fileput!
* - GoldStar - May 19, 2010
(May 19, 2010 11:34 AM)SteloNLD Wrote: ?? with first EOF u mean the file(encrypted virus :P)
yes it should be detected all of it as EOF Data. or i think so.
* - Bitwin - May 19, 2010
(May 19, 2010 11:36 AM)Deathader Wrote: Ew ew ew ew EW. Do NOT use fileput!
Agreed.