+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! (/showthread.php?tid=5831066)
Pages: Pages
1
2
ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - gigajew - Apr 29, 2018
Finally managed to stabilize my .NET RunPE after researching some. If an exception is thrown when you use it, you're probably running a .NET version lower than the assembly you're trying to run. For Quasar; try .NET 3.5 or .NET 4.0
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - Hyperhacktive - Apr 29, 2018
Thank you I'll test it soon 🙂
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - ShallowME - May 6, 2018
I think you just added 10 more crypters to the market. GL!
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - ChainChain - May 7, 2018
nice work bro , thnx for sharing
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - gigajew - May 7, 2018
(May 7, 2018 05:52 AM)MrSn0w Wrote: Thanks for sharing, the only problem i have is, when i try to test it with Quasar (on 4.0) it just open and close itself over and over again, but nothing happens :/
Sounds like your AV is detecting it in memory
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - Washi - May 8, 2018
Okay so I have a couple of questions about this snippet.
What is the reason behind the thread affinity and critical regions?
PHP Code
<?php
Thread.BeginThreadAffinity();
Thread.BeginCriticalRegion();
Why are we changing the apartment state based on the amount of parameters the entry point has?
PHP Code
<?php
if (parameters.Length > 0)
{
 assemblyExecuteThread.SetApartmentState(ApartmentState.STA);
}
else
{
 assemblyExecuteThread.SetApartmentState(ApartmentState.MTA);
}
And what is the purpose of clearing the first 32 bytes of the module?
PHP Code
<?php
RtlZeroMemory(Marshal.GetHINSTANCE(assembly.ManifestModule), 32);
Also not sure about the value of the unwrap function to be honest. Couldn't you just use one of the Encoding classes and use GetBytes instead?
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - Cyber Satan - May 12, 2018
I get this "A first chance exception of type 'System.Reflection.TargetInvocationException' occurred in mscorlib.dll"_____
Visual Basic 2010 Express
.Net 2.0 and .Net 4 (Tried both)
Immnient Monitor
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - narc0tic - May 19, 2018
Entrypoint.Invoke has been known for a long time.
Its very very detected at runtime and should not be used in a crypter.
Nice source though.
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - gigajew - May 25, 2018
I accidentally got the SetApartmentState in wrong order, if > 0 set it to MTA, otherwise set it to STA
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - ubbelol - May 26, 2018
(May 25, 2018 05:26 PM)gigajew Wrote: I accidentally got the SetApartmentState in wrong order, if > 0 set it to MTA, otherwise set it to STA
The number of parameters is irrelevant to what thread apartment state you should use. Read Washi's comment.
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - RamboII - Jul 3, 2018
another joke ??? get some errors too
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - Interallahu - Jul 4, 2018
Dude, your just adding more encouragement to use Assembly.Load Stuff, compared to a Injector or a Unmanaged alternative
Plus, Its hard to obfusacate APIs, Especially RtlZeroMemory, I suggest not using such an Anti-Dump.
AVs detect RtlZeroMemory alot ( Common ) and when it gets to VT, it probably just alreayd got 66/66
At least try using something Like Exception Filters or Int2D, not to be rude and a Delegate for 1/2 method doesnt make much sense.. 😧
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - SIM-3947811 - Nov 14, 2018
Works perfect for me. Idk why people says : IT'S DETECTED OMGGGG. It's looks like loadpe, very clean, no api calls. Thanks for share!
BTW, i test it now, hollows hunter and runpe hunter doesn't detect this ! VERY NICE !
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - Anonz8 - Aug 12, 2019
nice work bro , thnx for sharing :)
RE: ProjectorPE | Stable RunPE substitute for .NET assemblies! C# AND VB.NET! - xHeaven - Aug 13, 2019
(Nov 14, 2018 08:04 PM)hiddenkitty Wrote: Works perfect for me. Idk why people says : IT'S DETECTED OMGGGG. It's looks like loadpe, very clean, no api calls. Thanks for share!
BTW, i test it now, hollows hunter and runpe hunter doesn't detect this ! VERY NICE !
You make no sense. This is nothing like a LoadPE, I wouldn't even comment the rest of your reply.