Hack Forums
[.NET] [Tutorial] Making an effective and undetected crypter! - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] [Tutorial] Making an effective and undetected crypter! (/showthread.php?tid=1073965)

Pages: Pages 1 2 3 4 5 6 7 8

[Tutorial] Making an effective and undetected crypter! - pr3fix - Feb 19, 2011

Hello everyone,

And welcome to my thread related to topic on how to lower the detection rate and make an effective crypter in Visual Basic (Remember, this is only for .NET, but some of the techniques I used can be also used in other languages as well). So you came to this thread wondering how to FUD or at least UD your crypter against the Anti-Virus scanners, well you came to the right place! This tutorial does not contain and particular/private technique that could be tagged by an Anti-Virus or anything, so mixing it with your imagination you could easily make an effective and UD crypter. So let's begin, shall we ?

STEP 1: (Encrypting Strings)

So let's say that we got our plain non-obfuscated code and it is detected, so let's say that our code looks like this:
[deleted]

As you can see, it's just a plain code, which Anti-Virus vendors could easily tag. So what we're going to do first is encrypt all possible strings. In case you don't know what is a string, a string is, essentially, a sequence of characters, and it looks like this: "Hello, I'm string! Understand?"

Note: Do not encrypt APIs just yet, because if you do you will most likely corrupt the API declaration, which would cause a more trouble, so don't do it just yet.

So to encrypt our strings, we need a encryption algorithm, which is in this case already there (XOR encryption). But in case your encryption's output is not compatible with the Editor's syntax, you can easily just encode the text with any encoding algorithm, I recommend a built-in encoding algorithm, which is Base64 which can be easily accessed within 1 line of a code.

So, this is how it should look after we encrypt our strings:
[deleted]

You may not notice a big differences, that's just because this source code has only few string declarations, but in real stub code it would've more encryptable values, of course this is just an example but you should get the point. So that's how you encrypt your strings, it is really important yet simple step which will past most of the AntiViruses, but this was just beginning don't get too excited just yet.

STEP 2: (Obfuscating Variables)

So in next part of the tutorial, I will be showing you how to obfuscate variables. You may think that this involve a usage of 3rd party application , but you're wrong. This can be done manually too , and it is much more effective than using any 3rd party application since they may corrupt your assembly or add random detections, so it's always better to do it manually since you know what you're dealing with rather than guessing what's that obfuscator doing to your code.

So, obfuscating variables is relatively easy and can be done in 2 simple steps:
  • Select and hit your Ctrl + H

  • Then just simply write a new name for that variable and replace it with new one



And that's it. And it should look like something like this:
[deleted]

Note: You choose from 3 different character-set types of for your variables's names:

STEP 3: (Encrypting APIs)

For this part of tutorial, I am going to use snippet from AeonHack, but with few modifications. To get a source code of a snippet that allows you to dynamically call APIs just click on the link bellow:

His thread:
https://hackforums.net/showthread.php?tid=652914
OR
http://pastebin.com/LbEDMqjX

So once you get it, just copy/paste the code to your class/module and make delegates of your APIs, basically taking the signatures of real APIs but just without declaring a library or anything related to API which can be detected by Anti-Virus:

Real API:
Code
Private Declare Function SizeofResource Lib "kernel32" (ByVal hModule As IntPtr, ByVal hResInfo As IntPtr) As Integer

Delegated API:
Code
Delegate Function SizeOfResource(ByVal hModule As IntPtr, ByVal hResInfo As IntPtr) As Integer

Note: You can use whatever name you want for it, but make sure you remember the real Function Name & Library, in this case it was SizeOfResource as function name and kernel32 as library name (kernel32:SizeOfResource).

Once you do everything as I said, this is how it should look:
[deleted]

Now you can easily encrypt/encode and obfuscate the APIs declarations and calls by using this cool function. Which will past 90% of the detections, in case you have any other detections related to the API it is probably the usage of the APIs so I recommend you to either find different way of using the API or write own function that does whatever you're doing for you, like me in some cases. You can always find a backup APIs, since some APIs have similar or even same features, for example LoadLibrary and GetModuleHandle, they even have same usage and signature / parameters, and they do the same thing, which is retrieving the Memory Address of the libraries.

Anyway, let's back to our topic. Next thing that you can do is encrypt and obfuscate your APIs, and it should look like something like this:
[deleted]

STEP 4: (Optimizing & Reducing the size)

This is not really required, but it is recommended to modify & optimize your code a bit. For instance, you can edit and randomize the parameters (signatures) of your functions and subs. This won't really affect anything nor it will bypass any detections (or it may will), but it will for sure confuse the Malicious Software Analysts, of course this can be implemented (for instance) in your U.S.G (Unique Stub Generator) so each time you generate new stub code it will scramble and randomize the functions parameters.

[deleted]

Note: You can only change signatures of the your custom made functions, DO NOT change any API parameters otherwise it will corrupt that API declaration.

Also, you can reduce the size of your stub by removing or replacing some code with new one, for instance you can reduce the string's length by renaming it to the one with lower length of characters.

Next this that you can do is to remove unused references and also playing with "Compile" settings.

Remove Unused References:
  • Double click My Project, placed at the right size of Visual Basic by default.

  • Click on References tab

  • Click on Unused References to export list and then to remove click on Remove button


[deleted]

The End

Well that's it for today folks, I hope you enjoyed my tutorial and if you did, please rate it with 5*. Also if you have any question related to this subject feel free to PM me or comment on this thread. Good luck! ✌

Credits: AeonHack

* - ThermalSloth - Feb 19, 2011

Looks really good man, thanks for sharing.

Bookmarked it so I can read it while I'm not sleeping :P

* - Xenon - Feb 19, 2011

Nice tutorial. Very detailed. You should of put this into an eBook and sold it.

* - GyroErbin0 - Feb 19, 2011

Nice tut pr3fix !!! this can help many many people out !

* - codepoet - Feb 19, 2011

Very nice and detailed guide. good work.

* - 6e756c6c - Feb 19, 2011

Very nice, it also demonstrates more or less how my engine outputs code so if someone ever needs an example I can point them here! :D

* - versx - Feb 19, 2011

Great tutorial pr3fix, this is just great.

* - DarkCore - Feb 19, 2011

wow, Nice job. I have seen loads of threads about re-fuding and this is the only one that isn't half assed!

* - RiperFish - Feb 20, 2011

most detaile tutorial on how to make a crypter FUD, Great man :).5stars :).

* - TraptCode - Feb 20, 2011

Don't forget that with API calls, you can use Alias "APIEntryPointHere", which will allow you to call upon the API with any name.

* - Taurine - Feb 20, 2011

To OP, how long have you been using coding with VB?

* - pr3fix - Feb 20, 2011

(Feb 20, 2011 01:48 AM)TraptCode Wrote:  Don't forget that with API calls, you can use Alias "APIEntryPointHere", which will allow you to call upon the API with any name.

Yeah I know that, I thought about writing about that too but that won't really do anything, I personally tried it. 😖

* - Krox - Feb 20, 2011

thanks a lot, very nice tutorial!! :)

* - hacphongthan - Feb 20, 2011

bookmark it
thanks pr3fix
good tut


* - kurokitsune - Feb 20, 2011

Nice tutorial! Thanks for sharing!