![]() |
|
[.NET] [SRC] Vb.net Read/Write Resource (API) GET PAST AVIRA! - Printable Version +- Hack Forums (https://hackforums.net) +-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444) +--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151) +---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118) +---- Thread: [.NET] [SRC] Vb.net Read/Write Resource (API) GET PAST AVIRA! (/showthread.php?tid=430500) |
[SRC] Vb.net Read/Write Resource (API) GET PAST AVIRA! - Deathader - May 19, 2010 You can use this to get past Avira! Please credit me if used. I've been slaving over a hot pc for the last few hours trying to get this to work (there is almost no documentation or examples on this) Write resources to exe: Code Imports System.Runtime.InteropServicesRead resources: Code Imports System.Runtime.InteropServicesHow can this bypass avira? Simple. Instead of writing data to the EOF, you are writing it to the exe's resources (can be viewed in ResHacker and similar programs) How do I use it? Put the writer in the builder and the reader in the stub. Get the builder to WRITE the settings to the server after it's written, then get the stub to read the resources, and parse out whatever. You can use this to read the output (if you are using strings) Code System.Text.Encoding.Default.GetString("BYTES!")and to convert to byte array: Code System.Text.Encoding.Default.GetBytes("STRING!")Please credit me if used. Thanks. * - Kōtei - May 19, 2010 WTF Why has NO ONE commented yet??? THANK YOU DEATH!!! <3 * - StRaXxXD - May 19, 2010 THANK YOU FOR THIS....Will use this....Great tut and great job... and wtf 50 views 2 comm ^_^ * - Fake. - May 19, 2010 Nice share, looks real interesting. You always release awesome sources, what a cool kid :D * - Stylis - May 19, 2010 Yes, we have two method to write data ! 1. EOF 2. RES :) * - Bitwin - May 19, 2010 Nice,though I use slightly modified versions of Julian's example. (Slightly easier for me to use IMHO) * - adware - May 20, 2010 Thanks Deathader. Will add you in credits for sure :) * - Inveno - May 20, 2010 Thanks for the share. Will test this out later, i have a stub that's been detecting on avira, so will see if this fixes that issue. Thank you for the share mate. * - flAmingw0rm - May 20, 2010 That's a great tutorial. Thanks Deathader. I'm going to test this with my stub. * - Soul Collector - May 20, 2010 Thanks a lot mate... Gonna try it out * - julian - May 20, 2010 I thought about using a Try block with a GCHandle, but it doesn't work out so well... .Net is garbage collected, objects live on the heap, the garbage collector compacts the heap intermittently, which can involve moving objects to other memory locations. When you pin an object you are making it so that the object cannot be moved - it will remain at the same address. This allows you to then get the address of the object in memory, because you know the object isn't going to be moved and so the address will be valid. Only when you have finished using this address should you unpin the object. In short, You should: pin, use, unpin What you are doing: pin, copy address, unpin, use address. - When you get to use the copy of the address, the object may have moved off somewhere else - the pointer isn't guaranteed to be pointing where you want it to point to. It means the function ToPtr isn't robust. You should scrap it and just do it with verbose code. I thought about using: Code Dim gch As GCHandleBut if you think about it the only place it can fail is if whatever is Nothing, or if whatever isn't blittable, or if SomeAPICall throws an exception. You can test for Nothing easily, so that doesn't require a Try block. API calls will only throw .Net exceptions if the signature is incorrect. You would want to iron out problems like that before deploying. So I didn't bother and just stuck GCH.Free in without the Try...Finally. * - [Eprouvez] - May 20, 2010 MUAHAHA... You have just conquered Avira. You sir, are a master in VB.Net. Sharing is caring. Lol. * - GoldStar - May 20, 2010 humm very good. the try catch was wierd though.i usally free the GChandle last thing in my code, but i don't exacly know when that garbage collector that julien is talking about cleans up xD. but great exemple mate. but i noticed something when i first started using the updateresource, is that sometimes some "PADDINGXXPADDING" is added to the EOF after updating. i found no documentation about the subject, but iStealer seems to updateresource the stub then deletes that padding thing by getting eof and writing nullbytes. try updating some win32 app and hex edit, and you'll see it. i just want to know what it is before handling it lool * - Gringo241 - May 20, 2010 Thanks for the share, I will try this out when i get back from work. * - Local Celeb - May 20, 2010 Thanks Death :D This is going to help me a load :D |