+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] [Source][Help]My Injection wont work fully in .net 2 but works fully in .net 4, Ideas (/showthread.php?tid=5753105)
Pages: Pages
1
2
[Source][Help]My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - C Plus C Sharp C - Nov 15, 2017
I am having a problem injecting into different .net exe versions of the following files
- itself
- regasm.exe
- csc.exe
- cvtres.exe
- vbc.exe
- applaunch.exe
when injecting into the .net 4 versions of these files i can inject into all of them, but when using the .net 2 exe versions i can only inject into the first 2.
I was hoping someone could shed some light why this is an issue for me?
EDIT: the following is my source code: ( i am not allowed to post links, so just append github url to the front of the below
/C-Plus-C-Sharp-C/Pen-Crypter-Example
RE: My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - gigajew - Nov 15, 2017
Not sure because we can’t see what you’re trying to inject, or what you’re using to inject it to begin with. Anyway you should try to avoid using .NET 2.0 because it’s incompatible with a lot of system
RE: My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - C Plus C Sharp C - Nov 15, 2017
my bad the injection code i am testing with is "CMemoryExecute.cs", easy to find with google.
And i am injecting a compiled "32bit .net 2" exe, into the .net 2 version of the target exe
and then
And i am injecting a compiled "32bit .net 4" exe, into the .net 4 version of the target exe
Just testing to see if it works. All work in .net 4 versions but only 2 with .net 2 versions.
RE: My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - cocaine_monkey - Nov 15, 2017
(Nov 15, 2017 07:15 AM)gigajew Wrote: Not sure because we can’t see what you’re trying to inject, or what you’re using to inject it to begin with. Anyway you should try to avoid using .NET 2.0 because it’s incompatible with a lot of system
isnt 2.0 default in all windowses? or other version?
RE: My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - Ninja - Nov 15, 2017
(Nov 15, 2017 04:00 PM)cocaine_monkey Wrote: isnt 2.0 default in all windowses? or other version?
https://blogs.msdn.microsoft.com/astebner/2007/03/14/mailbag-what-version-of-the-net-framework-is-included-in-what-version-of-the-os/
RE: My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - 0xDEAD10CC - Nov 15, 2017
Have you bothered verifying the difference in .NET Runtimes of those binaries? csc.exe is also not a managed .NET assembly for instance. Without seeing what exactly you're trying to do this can't be answered. Injection can mean many things here, and we don't even know what you're trying to inject...
RE: My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - gigajew - Nov 15, 2017
(Nov 15, 2017 04:00 PM)cocaine_monkey Wrote: isnt 2.0 default in all windowses? or other version?
Not anymore it’s not, the user have to manually install it on 8-10
RE: My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - C Plus C Sharp C - Nov 16, 2017
(Nov 15, 2017 05:58 PM)0xDEAD10CC Wrote: Have you bothered verifying the difference in .NET Runtimes of those binaries? csc.exe is also not a managed .NET assembly for instance. Without seeing what exactly you're trying to do this can't be answered. Injection can mean many things here, and we don't even know what you're trying to inject...
How would i go about verifying the difference in .NET Runtimes of those binaries?
This is a problem i am really struggling with debugging problems, iv googled a lot and processes hollowing is hard to find detailed guides about but debuuging issues with process hollowing is totally missing in googles search results. Any advice would be greatly appreciated.
i know csc.exe is not a managed .NET assembly but it works when i inject my prog into the csc.exe in the .net 4 folder, i assume its because the needed .ddl's are in the .net 4 folder (which iv just had the idea of).
Id really like to figure out how to debug these failed injection target to see what the actual cause of the failure was, so any advice on how to do that, if its even possible would be great.
Also i am about to create a github account to upload my inject example too, Ill edit it in at the top if am able
Also heres the error log
Version=1
EventType=APPCRASH
EventTime=131553115767382563
ReportType=2
Consent=1
UploadTime=131553115771783019
ReportStatus=268435456
ReportIdentifier=d0bce2b2-2c51-4542-afc5-0b31b250d1d2
Wow64Host=34404
Wow64Guest=332
AppSessionGuid=00005c04-0001-0017-95dd-599edc5ed301
TargetAppId=W:0000f519feec486de87ed73cb92d3cac802400000000!00003a1814cda10fca4a53de9cc52c374ad098a937e9!csc.exe
TargetAppVer=2017//11//16:13:03:56!0!csc.exe
BootId=4294967295
TargetAsId=37513
Response.BucketId=55ccaf44ee6881cd6c63c0220a338321
Response.BucketTable=1
Response.LegacyBucketId=2045689908188906273
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=csc.exe
Sig[1].Name=Application Version
Sig[1].Value=8.0.50727.8784
Sig[2].Name=Application Timestamp
Sig[2].Value=5a0d8cbc
Sig[3].Name=Fault Module Name
Sig[3].Value=KERNELBASE.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=6.2.15063.726
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=32774c02
Sig[6].Name=Exception Code
Sig[6].Value=e0434f4d
Sig[7].Name=Exception Offset
Sig[7].Value=000ecbb2
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=10.0.15063.2.0.0.256.48
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=2057
UI[2]=C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
UI[3]=CryptMeAppA32N2 has stopped working
UI[4]=Windows can check online for a solution to the problem.
UI[5]=Check online for a solution and close the program
UI[6]=Check online for a solution later and close the program
UI[7]=Close the program
LoadedModule[0]=C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\Windows\SYSTEM32\MSCOREE.DLL
LoadedModule[3]=C:\Windows\System32\KERNEL32.dll
LoadedModule[4]=C:\Windows\System32\KERNELBASE.dll
LoadedModule[5]=C:\Windows\SYSTEM32\apphelp.dll
LoadedModule[6]=C:\Windows\System32\ADVAPI32.dll
LoadedModule[7]=C:\Windows\System32\msvcrt.dll
LoadedModule[8]=C:\Windows\System32\sechost.dll
LoadedModule[9]=C:\Windows\System32\RPCRT4.dll
LoadedModule[10]=C:\Windows\System32\SspiCli.dll
LoadedModule[11]=C:\Windows\System32\CRYPTBASE.dll
LoadedModule[12]=C:\Windows\System32\bcryptPrimitives.dll
LoadedModule[13]=C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
LoadedModule[14]=C:\Windows\System32\SHLWAPI.dll
LoadedModule[15]=C:\Windows\System32\combase.dll
LoadedModule[16]=C:\Windows\System32\ucrtbase.dll
LoadedModule[17]=C:\Windows\System32\GDI32.dll
LoadedModule[18]=C:\Windows\System32\gdi32full.dll
LoadedModule[19]=C:\Windows\System32\msvcp_win.dll
LoadedModule[20]=C:\Windows\System32\USER32.dll
LoadedModule[21]=C:\Windows\System32\win32u.dll
LoadedModule[22]=C:\Windows\System32\IMM32.DLL
LoadedModule[23]=C:\Windows\System32\kernel.appcore.dll
LoadedModule[24]=C:\Windows\SYSTEM32\VERSION.dll
LoadedModule[25]=C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
LoadedModule[26]=C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9307_none_d0882a20442f72e4\MSVCR80.dll
LoadedModule[27]=C:\Windows\System32\shell32.dll
LoadedModule[28]=C:\Windows\System32\cfgmgr32.dll
LoadedModule[29]=C:\Windows\System32\shcore.dll
LoadedModule[30]=C:\Windows\System32\windows.storage.dll
LoadedModule[31]=C:\Windows\System32\powrprof.dll
LoadedModule[32]=C:\Windows\System32\profapi.dll
LoadedModule[33]=C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\8af4e275cca61579302056fbc4ac484f\mscorlib.ni.dll
LoadedModule[34]=C:\Windows\System32\ole32.dll
State[0].Key=Transport.DoneStage1
State[0].Value=1
FriendlyEventName=APPCRASH
ConsentKey=APPCRASH
AppName=CryptMeAppA32N2
AppPath=C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
ReportDescription=Stopped working
ApplicationIdentity=00000000000000000000000000000000
MetadataHash=-1939372679
RE: [Source][Help]My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - n0$f3ratu$ - Nov 17, 2017
(Nov 15, 2017 06:37 AM)C Plus C Sharp C Wrote: I am having a problem injecting into different .net exe versions of the following filesYour problem is targeted net framework.
- itself
- regasm.exe
- csc.exe
- cvtres.exe
- vbc.exe
- applaunch.exe
when injecting into the .net 4 versions of these files i can inject into all of them, but when using the .net 2 exe versions i can only inject into the first 2.
I was hoping someone could shed some light why this is an issue for me?
EDIT: the following is my source code: ( i am not allowed to post links, so just append github url to the front of the below
/C-Plus-C-Sharp-C/Pen-Crypter-Example
RE: [Source][Help]My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - C Plus C Sharp C - Nov 18, 2017
(Nov 17, 2017 09:01 PM)n0$f3ratu$ Wrote: Your problem is targeted net framework.
Thanks for the reply, could you please expand on this.
My understanding is that i can inject .net exe into the .net 2 target exe's and .net 4 exe's into the .net 4 target exe's? is this right?
or did you mean somthing else?
RE: [Source][Help]My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - subtilebestia - Nov 18, 2017
This might be a stupid question but are you injection do you means of windows hooking or createRemoteThread technique. Because i might be able to help if u need assistance.
RE: [Source][Help]My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - C Plus C Sharp C - Nov 18, 2017
i use windows hooking to edit the in memory COFF file, add my code in memory, replace entry point and the resume process... simplified version anyways. It would be great if you could help
RE: [Source][Help]My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - subtilebestia - Nov 18, 2017
I will be looking into the code in like 2 hours. I'll give you my feedback. That good for you ?
RE: [Source][Help]My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - kevy42 - Nov 19, 2017
Idk why ur having this prob, but dont use 2.0 as Win 8/10 dosnt come with it by default. I use 4.5.2
RE: [Source][Help]My Injection wont work fully in .net 2 but works fully in .net 4, Ideas - C Plus C Sharp C - Nov 19, 2017
(Nov 18, 2017 10:10 PM)subtilebestia Wrote: I will be looking into the code in like 2 hours. I'll give you my feedback. That good for you ?
Looking forward to your feedback
(Nov 19, 2017 09:39 AM)WeedmasterOG Wrote: Idk why ur having this prob, but dont use 2.0 as Win 8/10 dosnt come with it by default. I use 4.5.2
Thanks i know this but i like my code to work on all systems with .net 2 all the way to latest. This guarantees most targets are viable, example, my work is still on windows 7, lots of servers still run on 2003.
Covering .net 4 allows the injection software to target the majority of home users but would not allow the software to target lots of businesses.
Just to clarify i am not actually targeting anyone, this is just theory and experimentation (might sound stupid saying that but just want to be clear).