+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] File pumper always detected (/showthread.php?tid=4833798)
File pumper always detected - whitemask - May 23, 2015
hello everyone , i got many codes for file pumper ,,but always detected by AV (avira & kaspersky) ,,
that is the code i use
Code
TextBox1.Text = "E:\6.exe"
Dim out As String = "E:\6_m2.exe"
IO.File.Copy(TextBox1.Text, out)
Dim filetopump = IO.File.OpenWrite(out)
Dim size = filetopump.Seek(0, IO.SeekOrigin.[End])
Dim filesize As Double = (10 * 1000) + size
While size < filesize
filetopump.WriteByte(10)
size += 1
End While
filetopump.Close()
' MsgBox("Successfully Pumped!")by the way the main goal ,i wonna change file signature so i got some ideas to do this :
1)file pumper -detected-
2)assembly info changer -the code i got not stable-
anyone give me more ideas ,thanks ✌✌
* - webdev77 - May 23, 2015
If you have the same repeated bytes, it's very obvious to an AV program that something is wrong.
* - Hoody - May 23, 2015
ideas for changing the file signature...
1) append a single null byte to the file. wont be detected
2) write in the null spaces of the DOS and PE headers. might cause detections... idk
3) add a resource (with winapi) <- probably gonna be hard if your new to programming
4) edit the manifest
5) you could also just change one byte in the icon.
hopefully i gave you some helpful ideas. i realize some of them probably aren't practical... but whatever
* - whitemask - May 24, 2015
(May 23, 2015 02:52 PM)Hoody Wrote: ideas for changing the file signature...
1) append a single null byte to the file. wont be detected
2) write in the null spaces of the DOS and PE headers. might cause detections... idk
3) add a resource (with winapi) <- probably gonna be hard if your new to programming
4) edit the manifest
5) you could also just change one byte in the icon.
hopefully i gave you some helpful ideas. i realize some of them probably aren't practical... but whatever
thank you very much ,adding null byte is perfect !! ✌✌