+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] MenaRunPE, Injects all type of .NET exe's (x86 -> x64, x64 -> x86 and so on) (/showthread.php?tid=4432024)
Pages: Pages
1
2
* - intrinsic - Sep 7, 2014
(Sep 7, 2014 01:21 PM)Menalix Wrote: Yes i know what code cave is..... Which has nothing to do with this, with a RunPE we simply don't let the exe load finish, and overwrites it's data with ours, simply put.
It was a misspell idiot, I was answering from my iPhone when I was with my GF answering, and wrote "Get" instead of "Query", get over it dude, how the hell would even make my injector work if I declared a wrong API name.
Just try my injector if you don't believe me, how can it be so hard?
If you knew what a codecave was you wouldn't have brought up the problem for 'assembly.load being only available on the calling application' How does loadlibrary work? you utter and complete retard.
'with a runpe we simply don't let the exe load finish' You clearly HAVE no technical knowledge of as to what a 'RUNPE' actually does. You can inject a file into a remote process whether or not it has been loaded. Despite this you'd have to rebuild the IAT.
You clearly don't know anything about the PE Format, nor the WINDOWS OS.
Also it's InformationProcess NOT ProcessInformation. You got the entire name wrong.
"CONTEXT_AMD64 it's a really baddy converting." What's there to convert? Are you incapable of implementing multiple structures and placing a check for the reference size?
* - Menalix - Sep 7, 2014
(Sep 7, 2014 01:23 PM)intrinsic Wrote: If you knew what a codecave was you wouldn't have brought up the problem for 'assembly.load being only available on the calling application' How does loadlibrary work? you utter and complete retard.I never mentioned assembly.load anywhere, else than saying this is a RunPE, and that's what I wanted to show since so many call it impossible to inject x86 .NET into x64 .NET.
'with a runpe we simply don't let the exe load finish' You clearly HAVE no technical knowledge of as to what a 'RUNPE' actually does. You can inject a file into a remote process whether or not it has been loaded. Despite this you'd have to rebuild the IAT.
You clearly don't know anything about the PE Format, nor the WINDOWS OS.
Also it's InformationProcess NOT ProcessInformation. You got the entire name wrong.
"CONTEXT_AMD64 it's a really baddy converting." What's there to convert? Are you incapable of implementing multiple structures and placing a check for the reference size?
If I wanted to talk about Assembly.Load I would have done that.
Dumbass, of course I know that, but we're not talking about those type of injections, here we talk about the RunPE method, therefor we make sure by suspending it at start that we don't have to patch the import address table.
Then lets say that, I'm still the first to publish a RunPE which can inject a x64 .NET into a x86 .NET exe.
Sorry I didn't check MSDN up for you, didn't expect you were to lazy for that, grab a cola or something to power up.
For the average .NET coder on HF not many can convert this type of structure, I think there is like 20 at maximum in this section out of 200 who knows what they are doing:
Code
typedef struct DECLSPEC_ALIGN(16) _CONTEXT {
//
// Register parameter home addresses.
//
// N.B. These fields are for convience - they could be used to extend the
// context record in the future.
//
DWORD64 P1Home;
DWORD64 P2Home;
DWORD64 P3Home;
DWORD64 P4Home;
DWORD64 P5Home;
DWORD64 P6Home;
//
// Control flags.
//
DWORD ContextFlags;
DWORD MxCsr;
//
// Segment Registers and processor flags.
//
WORD SegCs;
WORD SegDs;
WORD SegEs;
WORD SegFs;
WORD SegGs;
WORD SegSs;
DWORD EFlags;
//
// Debug registers
//
DWORD64 Dr0;
DWORD64 Dr1;
DWORD64 Dr2;
DWORD64 Dr3;
DWORD64 Dr6;
DWORD64 Dr7;
//
// Integer registers.
//
DWORD64 Rax;
DWORD64 Rcx;
DWORD64 Rdx;
DWORD64 Rbx;
DWORD64 Rsp;
DWORD64 Rbp;
DWORD64 Rsi;
DWORD64 Rdi;
DWORD64 R8;
DWORD64 R9;
DWORD64 R10;
DWORD64 R11;
DWORD64 R12;
DWORD64 R13;
DWORD64 R14;
DWORD64 R15;
//
// Program counter.
//
DWORD64 Rip;
//
// Floating point state.
//
union {
XMM_SAVE_AREA32 FltSave;
struct {
M128A Header[2];
M128A Legacy[8];
M128A Xmm0;
M128A Xmm1;
M128A Xmm2;
M128A Xmm3;
M128A Xmm4;
M128A Xmm5;
M128A Xmm6;
M128A Xmm7;
M128A Xmm8;
M128A Xmm9;
M128A Xmm10;
M128A Xmm11;
M128A Xmm12;
M128A Xmm13;
M128A Xmm14;
M128A Xmm15;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
//
// Vector registers.
//
M128A VectorRegister[26];
DWORD64 VectorControl;
//
// Special debug control registers.
//
DWORD64 DebugControl;
DWORD64 LastBranchToRip;
DWORD64 LastBranchFromRip;
DWORD64 LastExceptionToRip;
DWORD64 LastExceptionFromRip;
} CONTEXT, *PCONTEXT;* - Menalix - Sep 7, 2014
(Sep 7, 2014 02:45 PM)intrinsic Wrote: You fucking said 'assembly.load is only available in the calling application'Where exactly does it state you can use it to load a .NET file into a remote app domain: http://msdn.microsoft.com/en-us/library/system.reflection.assembly.load(v=vs.110).aspx
Are you fucking retarded? WHAT TYPE OF INJECTION? I'm TALKING ABOUT THE 'DYNAMIC FORKING' you utter complete fucking retard.
I seriously can't argue with you anymore you don't even understand what i'm saying.
What does other HF Coders have to do with converting an unmanaged structure? Its you that is writing the shit runpe.
Go back to fucking copy pasting you utter skid.
? I've never played with that function, so well I'm just purely looking on MSDN here.
If you think RunPE's shit then go somewhere else and complain about them, this was thread to learn others how to make 64bit -> 32bit and opposit, possible in .NET with the well known RunPE method as around 99% of all .NET crypters uses it.
Go back to school and learn to manner you language, you über bad mannered guy.
* - intrinsic - Sep 7, 2014
(Sep 7, 2014 02:51 PM)Menalix Wrote: Where exactly does it state you can use it to load a .NET file into a remote app domain: http://msdn.microsoft.com/en-us/library/system.reflection.assembly.load(v=vs.110).aspx
? I've never played with that function, so well I'm just purely looking on MSDN here.
If you think RunPE's shit then go somewhere else and complain about them, this was thread to learn others how to make 64bit -> 32bit and opposit, possible in .NET with the well known RunPE method as around 99% of all .NET crypters uses it.
Go back to school and learn to manner you language, you über bad mannered guy.
THATS THE POINT OF A CODE CAVE
YOU DELUSIONAL FUCKING RETARD
* - Menalix - Sep 7, 2014
(Sep 7, 2014 02:53 PM)intrinsic Wrote: THATS THE POINT OF A CODE CAVE
YOU DELUSIONAL FUCKING RETARD
Uuh yes because modifying the IL code on the run is what we were discussing here.
Sorry that I haven't made the technic which suits your liking, I'm very sorry, now just stay away thanks :)
* - Menalix - Oct 12, 2014
Published source for this now at: https://hackforums.net/showthread.php?tid=4487085
Fixed AeonHacks small API errors, and made the API's dynamically loaded due to it being a habit.
* - whitemask - Jan 9, 2015
thank that is really greate :) :) ✌
* - Vuno - Jan 10, 2015
Copy and pasted from the dev Aeon. Wow what a nub.
* - Disasm - Jan 10, 2015
This injection method is terrible and should never be used. The fact that you think this is a cross reference between x64 and x86 baffles me.
Considering .NET is executed by the CLR you can change the base architecture in the headers. This is not a true 'x86->x64' injection. When will .NET programmers start learning native programming for shit like this? Stop misusing the language for it's main purpose.
* - Menalix - Jan 11, 2015
(Jan 10, 2015 03:37 PM)Disasm Wrote: This injection method is terrible and should never be used. The fact that you think this is a cross reference between x64 and x86 baffles me.
Considering .NET is executed by the CLR you can change the base architecture in the headers. This is not a true 'x86->x64' injection. When will .NET programmers start learning native programming for shit like this? Stop misusing the language for it's main purpose.
Where does I indicate I thinks that?
Exactly and that is what this does, manipulating the flags in the PE header and CLR Header of the payload, nope this is not a true x86 to x64 injection as it is bytecode and doesn't have any too do with x64 asm opcodes and etc.
If you dont think I can code Native look at my inline hook tutorial with asm code injection. This is an old thread btw
(Jan 10, 2015 02:39 PM)Vuno Wrote: Copy and pasted from the dev Aeon. Wow what a nub.
Are you sad that I made a decompile of your stupid cheat, be glad I didnt bother cracking it too.
How is this a copy-paste? This is a tutorial on improving it?