(Aug 24, 2014 10:30 PM)TheUnknownProgrammer Wrote:  Not to be the jerk here, but I've seen an AVEvader here before, with this exact same name. Is this your second account or something? If not, please accept my apology then.

(Aug 25, 2014 02:56 AM)Assault Wrote:  No, this is his 58921398218th account.
I left a neg on the profile, now we wait for staff to do a cleanup.

FYI: If anyone wants to know how to do it themselves: all it does is form a really large loop; don't use any sleep/pause functions either.
The ideology behind is this to make the computing seem like it takes forever, so this way the anti-virus gives up instead of stalling on analysis of your file.

(Aug 24, 2014 10:30 PM)TheUnknownProgrammer Wrote:  There is not much feedback to give regarding the source to be honest, as you're not giving out the most important code, which is the shell code. For instance we will never know how it works, and if it is able to be optimised and never know why the key should be of size 4.

However, on the source you've provided us with, I can say a couple of things about. In the Evade method, you are using some convention that seems rather like you'd do with a C++ application though. You are returning an integer as return value, even if Key.Length equals 4. I'd suggest to go with a higher level way, and use exceptions instead.

PHP Code


<?php 
if (Key.Length == 4)
   throw new ArgumentException("Key should be of size 4", "key");
// ... 


Also consider using more exceptions based on the output of the szDecrypt function pointer and only return without them if everything went without problems. With this, you can replace the int return type of your Evade method to void.

Moreover, you are using Hungarian notation for your variables, which is not really that encouraged in the .NET environment. There are some MSDN articles about these conventions. Be sure to check them out.

http://msdn.microsoft.com/en-us/library/ms229045%28v=vs.110%29.aspx
http://msdn.microsoft.com/en-us/library/ff926074.aspx

Spoiler (Click to View)
Not to be the jerk here, but I've seen an AVEvader here before, with this exact same name. Is this your second account or something? If not, please accept my apology then.

(Aug 25, 2014 02:12 PM)d3agle Wrote:  Oh cool, finally a share that doesn't write 0's to your MBR. :P

Would you mind explaining what the shell code is doing?

(Aug 25, 2014 02:19 PM)Only3 Wrote:  so basically ur shell code can be replace with long loop

(Aug 25, 2014 02:37 PM)d3agle Wrote:  Would you say it would be comparable to something like this? How does your method differ?

Code

public void Slow()
{
    long nthPrime = FindPrimeNumber(1000); //set higher value for more time
}

public long FindPrimeNumber(int n)
{
    int count=0;
    long a = 2;
    while(count<n)
    {
      long b = 2;
      int prime = 1;// to check if found a prime
      while(b * b <= a)
      {
      if(a % b == 0)
      {
      prime = 0;
      break;
      }
      b++;
      }
      if(prime > 0)
      count++;
      a++;
    }
    return (--a);
}

(Aug 25, 2014 02:41 PM)spdy Wrote:  Mine goes more in depth with binary.

(Aug 25, 2014 06:24 PM)Assault Wrote:  brb guise gotta go learn binary really quick to compete with this fag

Spoiler (Click to View)
No one cares, plenty of users have handled anti-emulation on their own.
When you have an actual identity, maybe someone will want to talk to you <.<

(Aug 25, 2014 06:29 PM)spdy Wrote:  Binary is an easy concept. Instead of using the number 10 base system you're counting with the number two base system.
0,
1,
10,
11, 100, 101,110,111,1000 etc
I don't understand how you can write code and not understand Binary.

No one cares, plenty of users have handled anti-emulation on their own.
Yeah i'm sure plenty of users have handled anti-emulation as they know what they're actually doing. Since you can't come up with pseudo code regarding this i'll just assume you cant

(Aug 25, 2014 06:38 PM)Assault Wrote:  What are you talking about?
Utilizing the most advanced functions from the .net framework, I can easily do this.
Simply reference the "Crypter.Functions" namespace, and make a call to the static method called "DoWitchCraft" located in the "AntiEmulation" class.

(Aug 25, 2014 06:43 PM)Tweety. Wrote:  I can vouch for this, Assault has sold me this DoWithCraft() method for $1500 and I am making bank. He anti emulated the anti emulator to emulate fudness.