+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] MenaPE (RunPE Class) (/showthread.php?tid=4487085)
MenaPE (RunPE Class) - Menalix - Oct 12, 2014
removed content do to leeching.
* - Cornflower Blue இڿڰۣ-ڰۣ— - Oct 12, 2014
That code looks ALLOOOOT like Aeons RunPE, just saying...
* - Menalix - Oct 12, 2014
(Oct 12, 2014 12:11 PM)Cornflower Blue இڿڰۣ-ڰۣ— Wrote: That code looks ALLOOOOT like Aeons RunPE, just saying...It's also highly inspirated from AeonHacks RunPE. My old RunPE was a mess, and when I saw AeonHacks source I couldn't help myself about sorting it in a different way, and I couldn't see a reason why I would need to anyway.
And this:
Code
Public Function Run(ByVal path As String, ByVal payload As Byte(), ByVal creationflag As Integer) As Boolean
For I As Integer = 1 To 5
If HandleRun(path, payload, creationflag) Then Return True
Next
Return False
End Function* - Cornflower Blue இڿڰۣ-ڰۣ— - Oct 12, 2014
https://www.diffchecker.com/diff
Just run Aeon's code and Menalix's code on here, only thing you have changed is some names, added comments and reordered some things.
How skiddy.
* - Menalix - Oct 12, 2014
(Oct 12, 2014 12:15 PM)Cornflower Blue இڿڰۣ-ڰۣ— Wrote: https://www.diffchecker.com/diff
Just run Aeon's code and Menalix's code on here, only thing you have changed is some names, added comments and reordered some things.
How skiddy.
You can take any RunPE and do that, RunPE's works the same way.
If you actually looked the code trough you would notice how different it is, since we can do x64 to x86 injection.
The API's is named after msdn, that's also pretty normal.
* - $lick - Oct 12, 2014
(Oct 12, 2014 12:15 PM)Cornflower Blue இڿڰۣ-ڰۣ— Wrote: https://www.diffchecker.com/diff
Just run Aeon's code and Menalix's code on here, only thing you have changed is some names, added comments and reordered some things.
How skiddy.
No idea what you are talking about, they are completely different.
Code
ByVal ApplicationName As String, _
ByVal CommandLine As String, _
ByVal ProcessAttributes As IntPtr, _
ByVal ThreadAttributes As IntPtr, _
ByVal InheritHandles As Boolean, _
ByVal CreationFlags As UInteger, _
ByVal Environment As IntPtr, _
ByVal CurrentDirectory As String, _
ByRef StartupInfo As STARTUPINFO, _Code
ByVal applicationName As String, _
ByVal commandLine As String, _
ByVal processAttributes As IntPtr, _
ByVal threadAttributes As IntPtr, _
ByVal inheritHandles As Boolean, _
ByVal creationFlags As UInteger, _
ByVal environment As IntPtr, _
ByVal currentDirectory As String, _
ByRef startupInfo As STARTUP_INFORMATION, _* - Cornflower Blue இڿڰۣ-ڰۣ— - Oct 12, 2014
(Oct 12, 2014 12:17 PM)Menalix Wrote: You can take any RunPE and do that, RunPE's works the same way.
If you actually looked the code trough you would notice how different it is, since we can do x64 to x86 injection.
99.9% of your code is a direct copy paste, with just a little change to some variables.
No getting out of this hole mate.
* - He B TeMy - Oct 12, 2014
(Oct 12, 2014 12:17 PM)LazySoftware Wrote: No idea what you are talking about, they are completely different.
CodeByVal ApplicationName As String, _
ByVal CommandLine As String, _
ByVal ProcessAttributes As IntPtr, _
ByVal ThreadAttributes As IntPtr, _
ByVal InheritHandles As Boolean, _
ByVal CreationFlags As UInteger, _
ByVal Environment As IntPtr, _
ByVal CurrentDirectory As String, _
ByRef StartupInfo As STARTUPINFO, _
CodeByVal applicationName As String, _
ByVal commandLine As String, _
ByVal processAttributes As IntPtr, _
ByVal threadAttributes As IntPtr, _
ByVal inheritHandles As Boolean, _
ByVal creationFlags As UInteger, _
ByVal environment As IntPtr, _
ByVal currentDirectory As String, _
ByRef startupInfo As STARTUP_INFORMATION, _
lol, almost one bit off, next time'll be better.
* - Menalix - Oct 12, 2014
(Oct 12, 2014 12:17 PM)LazySoftware Wrote: No idea what you are talking about, they are completely different.
CodeByVal ApplicationName As String, _
ByVal CommandLine As String, _
ByVal ProcessAttributes As IntPtr, _
ByVal ThreadAttributes As IntPtr, _
ByVal InheritHandles As Boolean, _
ByVal CreationFlags As UInteger, _
ByVal Environment As IntPtr, _
ByVal CurrentDirectory As String, _
ByRef StartupInfo As STARTUPINFO, _
CodeByVal applicationName As String, _
ByVal commandLine As String, _
ByVal processAttributes As IntPtr, _
ByVal threadAttributes As IntPtr, _
ByVal inheritHandles As Boolean, _
ByVal creationFlags As UInteger, _
ByVal environment As IntPtr, _
ByVal currentDirectory As String, _
ByRef startupInfo As STARTUP_INFORMATION, _
That's how it's written on msdn:
http://msdn.microsoft.com/en-us/library/windows/desktop/ms682425(v=vs.85).aspx
I don't waste time to change it away from it's original ways.
So if people suddenly now Declare API's the same way (correctly) after msdn, its copyed, haha joke.
(Oct 12, 2014 12:18 PM)Cornflower Blue இڿڰۣ-ڰۣ— Wrote: 99.9% of your code is a direct copy paste, with just a little change to some variables.
No getting out of this hole mate.
Hahaha joke you are. look it through dude.
* - $lick - Oct 12, 2014
(Oct 12, 2014 12:20 PM)Menalix Wrote: That's how it's written on msdn:
http://msdn.microsoft.com/en-us/library/windows/desktop/ms682425(v=vs.85).aspx
I don't waste time to change it away from it's original ways.
So if people suddenly now Declare API's the same way (correctly) after msdn, its copyed, haha joke.
So what you are trying to say here is that Aeonhack is in fact the skid here.
Copying things straight from msdn, grab a pitch fork.
------E
------E
------E
------E
------E
* - Cornflower Blue இڿڰۣ-ڰۣ— - Oct 12, 2014
More proof
https://i.imgur.com/lOsYzIQ.png
https://i.imgur.com/PmBwBII.png
https://i.imgur.com/mz6iEGm.png
https://i.imgur.com/FZ6lGqj.png
* - Menalix - Oct 12, 2014
(Oct 12, 2014 12:22 PM)LazySoftware Wrote: So what you are trying to say here is that Aeonhack is in fact the skid here.
Copying things straight from msdn, grab a pitch fork.
------E
------E
------E
------E
------E
Nope I'm saying that's what mostly people would do when declaring an API, unless they look it up with a Dissambler instead of using msdn.
* - $lick - Oct 12, 2014
(Oct 12, 2014 12:24 PM)Menalix Wrote: Nope I'm saying that's what mostly people would do when declaring an API, unless they look it up with a Dissambler instead of using msdn.
I don't think it is wise to call Aeon a skid.
He is protected by top men.
Top. Men.
* - Menalix - Oct 12, 2014
(Oct 12, 2014 12:24 PM)Cornflower Blue இڿڰۣ-ڰۣ— Wrote: More proof
https://i.imgur.com/lOsYzIQ.png
https://i.imgur.com/PmBwBII.png
https://i.imgur.com/mz6iEGm.png
https://i.imgur.com/FZ6lGqj.png
Like I said the way I stabilize the RunPE is directly taken from AeonHack.
You are showing how I use API's the same way as AeonHack? API's can't really be used different.
Then you might aswell take a picture of how I use VB functions the same way.
* - SIM-1676753 - Oct 12, 2014
(Oct 12, 2014 12:25 PM)LazySoftware Wrote: I don't think it is wise to call Aeon a skid.
He is protected by top men.
Top. Men.
Top men as in Top Ramen or..? What kind?