+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] [C#] Efficient Read EoF Function (/showthread.php?tid=1193297)
Pages: Pages
1
2
[C#] Efficient Read EoF Function - Zer0Fact0r - Apr 7, 2011
This is essentially a stripped down version of the code in this thread (with the exception that this will work on .NET assemblies): https://hackforums.net/showthread.php?tid=1191361
I put this together a long time ago. It works and is much more memory efficient than other EoF functions I've seen here.
Code
public static byte[] ReadEoF(string fileName)
{
byte[] buffer = null;
using (FileStream fs = new FileStream(fileName, FileMode.Open))
{
buffer = new byte[4];
fs.Position = 0x3C;
fs.Read(buffer, 0, 4);
fs.Position = BitConverter.ToInt32(buffer, 0) + 0x6;
buffer = new byte[2];
fs.Read(buffer, 0, 2);
fs.Position += 0x100 + ((BitConverter.ToInt16(buffer, 0) - 1) * 0x28);
buffer = new byte[8];
fs.Read(buffer, 0, 8);
fs.Position = BitConverter.ToInt32(buffer, 0) + BitConverter.ToInt32(buffer, 4);
buffer = new byte[fs.Length - fs.Position];
fs.Read(buffer, 0, buffer.Length);
}
return buffer;
}Example Usage:
Code
File.AppendAllText("lol.exe", "123456");
Console.WriteLine(Encoding.ASCII.GetString(ReadEoF("lol.exe")));
// writes "123456" to the console* - Vysse - Apr 7, 2011
Very nice share this is quite the small snippet
* - DragQueen - Apr 7, 2011
i tries my code on process explorer and i got 3229 byte[] with urs i got 6008 byte[]
the question is what function is not work my / urs
* - no1me - Apr 7, 2011
his code working just fine i check it
* - DragQueen - Apr 7, 2011
my mistake work on .net files Omg
and process explorer is not .net file
EDIT :: i liked this code i added it to my class. with source link + right credit.
* - mnbv - Apr 7, 2011
Wow thanks very much, this is very short and efficient
But how can I use this in my crypter? First checking EOF and, if there is if then: ???
And also doing something with the EOF in the Stub?
After a quick search (btw Im using CodeDom, but it should be the same)
The steps: read EOF, crypt file, write it back to the file.
And quote of Vorfin
"Well, since EoF Preservation is a Function on the Builder, not the Stub, it doesn't matter if you use CodeDom or not. "
* - Zer0Fact0r - Apr 7, 2011
(Apr 7, 2011 10:58 AM)DragQueen Wrote: i tries my code on process explorer and i got 3229 byte[] with urs i got 6008 byte[]
the question is what function is not work my / urs
Your (ported) code loads the contents of the executable into memory (File.ReadAllBytes). Mine doesn't.
* - mnbv - Apr 7, 2011
Build is crypting the file
Read Bytes, Convert to string, Encrypt, Write with CodeDom
Edit: this is not the good way
Code
//Byte[] norm_file = System.IO.File.ReadAllBytes(i.Text); // Reads all bytes <This worked
Byte[] norm_file = ReadEoF(i.Text);Can anyone offer some help?
* - DragQueen - Apr 7, 2011
(Apr 7, 2011 12:15 PM)Zer0Fact0r Wrote: Your (ported) code loads the contents of the executable into memory (File.ReadAllBytes). Mine doesn't.
its still not explain the diffrent in the bytes []
in .net file it work like charm ... in other native files
i see big diffrent [6000 and 3000 its big diffrents]
and string its also weird ... with my class i get readable string
with this func i get unreadable string
ur methood work only on .net files, check it and see
mu methood work only with native with .net it fail
* - Zer0Fact0r - Apr 7, 2011
(Apr 7, 2011 01:15 PM)DragQueen Wrote: its still not explain the diffrent in the bytes []
in .net file it work like charm ... in other native files
i see big diffrent [6000 and 3000 its big diffrents]
and string its also weird ... with my class i get readable string
with this func i get unreadable string
ur methood work only on .net files, check it and see
mu methood work only with native with .net it fail
I did... and it works fine...
You're testing it wrong.
* - mnbv - Apr 10, 2011
Anybody that can refere me or post a writeeof function that belongs to this read function?
Else, Its useless
* - no1me - Apr 10, 2011
File.AppendAllText("lol.exe", "123456");
Console.WriteLine(Encoding.ASCII.GetString(ReadEoF("lol.exe")));
// writes "123456" to the console
* - mnbv - Apr 10, 2011
This is with a console, but a crypted server for example is different, Actually thats the thing im searching (for days)
Thanks for the unput though ..
Anyone?
* - no1me - Apr 10, 2011
write to file
File.AppendAllText("lol.exe", "123456");
read the eof
msgbox(Encoding.ASCII.GetString(ReadEoF("lol.exe")));
the same for any file
* - mnbv - Apr 10, 2011
But what you are basically doing now is:
Make a file with name: lol.exe and eof: 123456
Then you read it and show it in a msgbox, console or whatever.
but this is not writing to a crypted file on the desktop for example right?
File.AppendAllText("cryptedfile.exe", "ReadedEofdata");
If its like above , I get it