+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] Vb.Net FUD Builder method VIA server patching / byte replacement (Source) (/showthread.php?tid=680003)
Vb.Net FUD Builder method VIA server patching / byte replacement (Source) - nathan72389 - Sep 15, 2010
wow, ok, this was a little tricky to work out, but here we go.
This is another method of passing string from a builder to a server, its FUD, and really should remain FUD because there is nothing for an AV to flag. yeah, no odd API calls, or anything crazy.
so, how is it done?
well, we will simply replace the bytes of our server with some new bytes.
wait, a few pics might help.
first, lets check the end result.....
[img]http://i53.[censored].com/5488lg.jpg[/img]
^^^ hey! just like any other method right?
ok ok, now, we are not using any EOF / Resources / Codedom stuff for this.
ok, lets look at it in our hex editor....
[img]http://i52.[censored].com/2igf58h.jpg[/img]
^^^ O.o
so basically what we have done is setup a string inside our server, and then replaced it with a new one from the builder by reading the bytes, checking for our "Target" string, when found, simply replace it.
ok, i know its hard to describe, and your probably a little more confused than understanding.
but just so you have a better idea of whats happening, i have included a sample project for you to look and play with.
now, there are some things to remember when doing this. the new and old string MUST be the same length or else you will have to start screwing around with the PE, and thats not the point of this. If you look through the code, I have my "Replacement String" padded with a crapload of spaces at the end, this is setting up some free space inside the server for me to add just about anything i wanted to (with a length restriction). This method (as far as i know) will only work with strings, so it might not be a good idea for you crypter nuts out there.
so, uh, i think thats about it, d/l the source and check it out. im not saying that its 100% error proof, but its just another method to add under your belt.
MediaFire Download
enjoy, have fun, and leave me a bit of feedback.
* - M4xIm - Sep 15, 2010
Wow, gonna check this out. THanks
* - pr0t0typ3 - Sep 15, 2010
As Always it looks nice but Wydle (Dunno how to write his name) already posted the same idea for vb6 ..anyway it seams nice.... But you need a very long string to store all data for a stealer or smth...
* - H3x0S - Sep 15, 2010
Wait, UbbeLol had the same idea.
* - DarkSeven46 - Sep 15, 2010
Had this in my head a while ago, thanks for this nathan.
* - Ironside - Sep 15, 2010
Same as it was before Patch 16/17
* - nathan72389 - Sep 15, 2010
(Sep 15, 2010 10:12 AM)pr0t0typ3 Wrote: As Always it looks nice but Wydle (Dunno how to write his name) already posted the same idea for vb6 ..anyway it seams nice.... But you need a very long string to store all data for a stealer or smth...
yeah, i know what your refering to, he sent / linked me to the same thing also, but (idk why, bad timing i guess) he always links me to stuff when im about 3/4 plowed and i end up loosing the link.
as for the string length..
well, just think of the logic, if a (for example) gmail username can only have a max of 25 chars, then thats one string that we know the length of, so simply (like i did in the source) pad it with a few extra spaces, and use the trim function.
or...
pile it all into one string, seperate it with a "|" and use a combination of the "Split" and "Trim" functions.
meh, its something else to have under your belt that may come in handy on a rainy day.
(Sep 15, 2010 10:18 AM)Barathrum Wrote: Same as it was before Patch 16/17
lol, well hell if your stuff is already detected that more your problem than it is mine.
* - xCocaine - Sep 15, 2010
You're a fucking genious .
* - The Weeknd. - Sep 15, 2010
Great idea, I just gave a look at the code.
Pretty easy to understand, thanks :D
* - Ironside - Sep 15, 2010
(Sep 15, 2010 10:18 AM)Barathrum Wrote: Same as it was before Patch 16/17
lol, well hell if your stuff is already detected that more your problem than it is mine.
[/quote]
Oh I thought this was some sort of crypt 👍
So this is used to protect a source code (encrypt it)?
* - pr0t0typ3 - Sep 15, 2010
(Sep 15, 2010 10:23 AM)Barathrum Wrote: Oh I thought this was some sort of crypt 👍
So this is used to protect a source code (encrypt it)
lol you should read the hole thread before posting shit like that.. it will protect nothing .. it is used for storing
* - nathan72389 - Sep 15, 2010
(Sep 15, 2010 10:25 AM)pr0t0typ3 Wrote: lol you should read the hole thread before posting shit like that.. it will protect nothing .. it is used for storing
HAHA,,... i always enjoy a good laugh.. but really, i told exactly what it was in the 2nd sentence of the thread.
* - Ironside - Sep 15, 2010
Yeah I noticed now, I got cunfused because I only read the word FUD and stopped reading afterwards :)
This is good thing indeed :)
* - pr0t0typ3 - Sep 15, 2010
(Sep 15, 2010 10:28 AM)nathan72389 Wrote: HAHA,,... i always enjoy a good laugh.. but really, i told exactly what it was in the 2nd sentence of the thread.I often enjoy it also but in most cases it is just annoying
* - d3c0mpil3r - Sep 15, 2010
Very interesting, I will surely take a look!
This is limited to strings, may be we need to think harder lol ..