+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] Open Source CodeDom Runtime Crypter - UD 2/35 (/showthread.php?tid=5238647)
Pages: Pages
1
2
Open Source CodeDom Runtime Crypter - UD 2/35 - KrypteX - Apr 15, 2016
Hello everyone, I just thought I'd made a rolling release of my project.
I am new to making my own crypters and would love to learn more and continue working on this project and new projects similar to this.
Spoiler (Click to View)
This project is Currently UD - 2/35
Spoiler (Click to View)
I am using very well known methods for Encrypting/Decrypting as well as file writing/dropping/executing the file.
This Crypter is, and will always be, open source for everyone here, feel free to contribute to the project.
Currently the biggest bug with this Crypter is that the output is compiling into the 4.0 Framework, and CodeDom is Specified to compile to v2.0.
Update: The code has been updated and now only depends on the 2.0 Framework for both the Crypter and the Output. ;)
No, I will not be providing ANY kind of bin for anyone so don't ask. If you don't know how to compile it don't use it.
No ShitCash, No Survey, Not even Adfly, No bullshit.
Password is KrypteX for the uppit link.
GitHub Here: https://github.com/F2C-KrypteX/Scratch-Runtime-Crypter
Download here: http://uppit.com/oszpdcdrvax9
I'm looking forward to, and slightly terrified of feedback.
* - ShittyAdvice - Apr 15, 2016
You should look into Github.
Github is great for sharing code. Other members can check it out without downloading anything and help you develop your code using pull requests.
If you plan on working as a developer you will most likely be required to use and / or know Github.
OT: Thanks for contributing and good luck with your crypter.
* - KrypteX - Apr 15, 2016
I've never used Git before but I used to be quite familiar with SVN.
* - taktaktak - Apr 15, 2016
I second the github motion, its just easier for everyone.
OT: this may be scantime fud, but will be fucked in runtime detection if it's a dropper.
* - KrypteX - Apr 15, 2016
It is indeed a dropper. It's my first Crypter Project. I'm not sure how I would get the bytes to run without dropping a file other than RunPE, which I'm infamiliar with. I'm also unsure if RunPE can be used with CodeDom, and if I want to actually use codedom for scantime/runtime protection.
* - GuRuHaX - Apr 16, 2016
Nice share thank you verry much !
I want to learn about crypters and everything coming with that and im sure this will help a lot !
🤝
* - Cecilia - Apr 16, 2016
(Apr 15, 2016 07:46 PM)KrypteX Wrote: It is indeed a dropper. It's my first Crypter Project. I'm not sure how I would get the bytes to run without dropping a file other than RunPE, which I'm infamiliar with. I'm also unsure if RunPE can be used with CodeDom, and if I want to actually use codedom for scantime/runtime protection.
RunPE will run in a codedom app, look at some examples.
Most crypters have the runpe/settings in a different dll and build it/reference it when you are making the stub, then invoke it on runtime.
* - KrypteX - Apr 16, 2016
Just finished the last major update on GitHub for the version before going for RunPE testing and such. Hope you enjoy the music XD
I've been testing allot of testing but I can't seem to get a RunPE to actually execute my server..
* - Slavoj Žižek - Apr 16, 2016
adding RunPE is a headache at first but when you set up all the automated
RunPE.dll --> crypt it --> convert it to image (etc) --> then store it (prob as a icon)
its really easy to work on afterwards + it will always be FUD (the RunPE)
* - KrypteX - Apr 16, 2016
(Apr 16, 2016 06:22 AM)Blezzedd Wrote: adding RunPE is a headache at first but when you set up all the automatedscratches my head
RunPE.dll --> crypt it --> convert it to image (etc) --> then store it (prob as a icon)
its really easy to work on afterwards + it will always be FUD (the RunPE)
You know what, that's not a bad damn idea lol. But that'd require me to.. Hmmm... What if I were to include the runPE as a resource within the crypter, that'd randomize all the strings/calls before encrypting/storing it as an image and adding that resource to the codedom output somehow
* - Slavoj Žižek - Apr 16, 2016
(Apr 16, 2016 11:40 AM)KrypteX Wrote: *scratches my head*
You know what, that's not a bad damn idea lol. But that'd require me to.. Hmmm... What if I were to include the runPE as a resource within the crypter, that'd randomize all the strings/calls before encrypting/storing it as an image and adding that resource to the codedom output somehow
there is no point - its going to be stored as a png or something anyway
* - KrypteX - Apr 16, 2016
True, I've been searching around but I can't seem to find any posts here on doing string/byte() to image. The only one that I've managed to find I'm unsure of how to implement:
Code
Public Shared Function String2Icon(ByVal input As String) As System.Drawing.Image
Dim img As System.Drawing.Image
Dim MS As New MemoryStream
Dim b64 As String = input.Replace(" ", "+")
Dim b() As Byte
b = Convert.FromBase64String(b64)
MS = New MemoryStream(b)
img = System.Drawing.Image.FromStream(MS)
Return img
End Function* - $lick - Apr 16, 2016
An open-source crypter, what a great idea, can't see how this could go wrong.
* - KrypteX - Apr 16, 2016
(Apr 16, 2016 02:25 PM)Nexus™  Wrote: An open-source crypter, what a great idea, can't see how this could go wrong.
This is not a tool to be used as a crypter per say to spread, but rather a reference of progress in development, ideas and methods on which this community can learn from.
To my knowledge, I've never seen an open source, complete with using undetection methods and updates as a better example of how everyone can learn how to do this if they are willing to.
I'm not planning on using this to spread. I'm knocking something off of my bucket list which I've long wished to accomplish, and I hope that everyone can participate and learn a bit of something themselves.
* - Slavoj Žižek - Apr 18, 2016
for some reason I could not post here... it said something about i'm trying a sql attack or something
I thought I might as well use my "expertise" on this subject and add something to it
here :
http://pastebin.com/ANZQaFHV
it uses reflection for .net files and drops the native ones...
its not as good as RunPE but it less hassle