C# Encrypted way of dynamic API calls

[C#] Encrypted way of dynamic API calls - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] Encrypted way of dynamic API calls (/showthread.php?tid=6052897)

Encrypted way of dynamic API calls - gigajew - Feb 26, 2020

In this code sample I tested a theory that you could call Windows API using encrypted strings in C#, and the proof of concept is here. Here I am defining two secure strings, one is "user32.dll" and the other "MessageBoxA", and then using LoadLibrary to load user32.dll and GetProcAddress to get the MessageBoxA procedural address. Afaik this is a first of it's kind, I could be wrong. I've never seen it before though.

This may or may not bypass or throw off AV scanners runtime scans.

[Image: 86exIgV.png]

RE: Encrypted way of dynamic API calls - NYANxCAT - Feb 27, 2020

Great idea I think it could bypass av scantime easily.

Thanks for sharing this with us. Glad you still posting here.

RE: Encrypted way of dynamic API calls - Jurashit - Feb 28, 2020

Code 
private SecureString ConvertToSecureString(string password)

{

    if (password == null)

        throw new ArgumentNullException("password");

    var securePassword = new SecureString();

    foreach (char c in password)

        securePassword.AppendChar(c);

    securePassword.MakeReadOnly();

    return securePassword;

}

RE: Encrypted way of dynamic API calls - gigajew - Mar 5, 2020

I implemented this in my open-source 64-bit traditional RunPE available on Github. It brought static detection down to 2/26, but without any evasions the dynamic detection was rated 60/100 using the reverse.it service.