+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] Crypting DarkComet with a .net Crypter? (/showthread.php?tid=3368015)
Pages: Pages
1
2
Crypting DarkComet with a .net Crypter? - iRtehLeet™ - Mar 30, 2013
Does this require EOF preservation or what dude?
* - 0xBB - Mar 30, 2013
I dont see any eof in dc stubs. And you can't load unmanaged bytes in domain.
* - ScΛrƒΛc3_ - Mar 30, 2013
No problem with darkcomet, i know cybergate needs eof presevation. You can use a RunPE and load the bytes....no problem with that.
* - ScΛrƒΛc3_ - Mar 30, 2013
No. You'll need a RunPE for unmanaged .exe, and Reflection for managed.
* - The-One - Mar 30, 2013
(Mar 30, 2013 04:20 PM)๖ۣۜMephobia Wrote: You can use .net reflection to load an unmanged exe. And both DC and CG are both unmanaged.
Lol no, managed means that it relies on a code which is already written such as .NET. Unmanaged doesn't have all those prewritten codes. So .NET reflection only works for managed code, but compiled with .NET.
* - salmoneus - Mar 30, 2013
You are selling a crypter. You should know this.
* - ๖ۣۜMephobia - Mar 30, 2013
I meant to say .net reflection is used with managed code. I was on my phone and didn't proofread. That's why I said DC and CG were both unmanaged.
* - n0$f3ratu$ - Mar 30, 2013
The answer is simple.
NO, it doesn't need EOF!!!, but either way you will crypt the server, with or without upx, it will work.
At least in my case it doesn't break it.
(Mar 30, 2013 04:36 PM)Scarfac3_ Wrote: No. You'll need a RunPE for unmanaged .exe, and Reflection for managed.
Not really.
I am using runpe for both.
The only difference is when crypting .Net files i inject in it self.
* - 0xBB - Mar 30, 2013
(Mar 30, 2013 08:23 PM)n0$f3ratu$ Wrote: The answer is simple.
NO, it doesn't need EOF!!!, but either way you will crypt the server, with or without upx, it will work.
At least in my case it doesn't break it.
Not really.
I am using runpe for both.
The only difference is when crypting .Net files i inject in it self.
So what you're saying here is you currently inject managed code ? I mean for managed , don't you use a domain ? 🤝
* - n0$f3ratu$ - Mar 30, 2013
(Mar 30, 2013 08:51 PM)ibennz Wrote: So what you're saying here is you currently inject managed code ? I mean for managed , don't you use a domain ? 🤝
Exactly.
I never did and as far as i am concern never will.
* - 0xBB - Mar 30, 2013
(Mar 30, 2013 11:06 PM)n0$f3ratu$ Wrote: Exactly.
I never did and as far as i am concern never will.
Intersting, I guess you inject into a managed process. If you don't mind, which .exe is by default in .NET that is coded in managed ? Or you drop something 😧
Edit :
Nvm I found something 👍 ; http://msdn.microsoft.com/en-us/library/99sz37yh.aspx
* - ScΛrƒΛc3_ - Mar 31, 2013
(Mar 30, 2013 08:23 PM)n0$f3ratu$ Wrote: The answer is simple.
NO, it doesn't need EOF!!!, but either way you will crypt the server, with or without upx, it will work.
At least in my case it doesn't break it.
Not really.
I am using runpe for both.
The only difference is when crypting .Net files i inject in it self.
You are Correct! I actually have too a RunPE that runs managed too. But as you said inject in itself 😅
* - iRtehLeet™ - Mar 31, 2013
I know you need two different ways to inject managed/native, but my current Native RunPE doesn't seem to run DC servers properly with no settings on the DC server.
* - 0xBB - Apr 1, 2013
(Mar 31, 2013 02:23 AM)Scarfac3_ Wrote: You are Correct! I actually have too a RunPE that runs managed too. But as you said inject in itself 😅
Yeh, and how you guys handle eof ? Copying any eof to the crypted file would trigger avira. 😑
* - ScΛrƒΛc3_ - Apr 1, 2013
yes, if we talk about well known rat's....only cybergate needs to keep the EOF, anyway, i have my personal rat project that uses EOF only for settings (i'm currently using appendalltext) and it's clean, since the data is really really small. So...if the EOF of cybergate is not so large in size, probably would not be a problem to copy it and append to the stub, but never used cybergate. I can only say for sure that an irrilevant size of data, would probably not be a problem with avira. But for storing the entire file in your stub you can't use EOF obviously, actually i'm using cecil to add it as emebedded resource.