[JapaBrz]

[EDITED] the code might not work since i did on the browser
if you have ever wondered how the keyloggers saves strings in the EXE(like email, port, address, etc) ill show how they do this:

this requires:
you know how to encrypt strings with crypting algs made by you
you know what a client/server is 😶
you know some VB
you know "string threading"

first of all ill set the variables and funcs used in this sample:

crypting() is the func to crypt the string
decrypting() is the func to decrypt the string

both is up to you to make 🙂

then a simple program, first open the EXE in read only binary view;

Code

open app.exename for binary shared as 1

then put all the code in a variable and close the file :

Code

code=Input(LOF(1), #1)
close 1

now you must search if there is already any data written on the file, if not, write your own data

Code

If InStr(1, data0, "japabrz") = 0 Then
   adddata
else
   readdata
end if

thi will find the first ocurrency of the string in the code, if dont find any goes to adddata

Code

private sub adddata()
FileCopy App.Path + "\" + App.EXEName + ".exe", App.Path + "\trojan.exe"

since you cannot edit a opened EXE, this will copy itself,but with a different name, then open the new EXE in read/write mode and add the string that you want in the last line of code, adding the header("japabrz") to shows the spot where your var is

Code

Open App.Path + "\trojan.exe" For Binary As 1
        Seek #1, LOF(1)
            Put #1, , "japabrz"
            Put #1, , YourVar
          Close 1
end sub

this will put a string on the last line of the EXE bin. then, if there is already data written on the code, means that there is something written there and you want to retrieve this code to do anything so this is the readdata sub:

Code

private sub readdata()
variantvar= Split(code, "japabrz", -1, vbBinaryCompare)

do you remember the code var on the beggining of the code? that var is the full code, if found a header("japabrz") splits the string in to, the code before the header and the code after the header, the code after the header will be the string that you want, so to get the last bound of a array is

Code

yourString=variantvar(ubound(variantvar))

this retrieves the code of your string that you already saved on the EXE. the main event is form_initiate(), before the form starts. this is the full code:

Code

dim code as string
dim yourvar as string
Private Sub Form_Initialize()
dim code as string
open app.exename for binary shared as 1
  code=Input(LOF(1), #1)
close 1

If InStr(1, data0, "japabrz") = 0 Then
     adddata()' add any string to the EXE
else
     readdata()
end if
end sub


private sub adddata()
yourvar="blabalboabloabloabloabloabloabloablabolabol"
FileCopy App.Path + "\" + App.EXEName + ".exe", App.Path + "\sample.exe"
       Open App.Path + "\sample.exe" For Binary As 1
        Seek #1, LOF(1)
            Put #1, , "japabrz"
            Put #1, , crypting(YourVar)
          Close 1
end sub

private sub readdata()
dim variantvar as variant
variantvar= Split(code, "japabrz", -1, vbBinaryCompare)
yourvar=decrypting(variantvar(ubound(variantvar)))
end sub

the crypting code is essencial to avoid reverse engineering by noobs, when make a trojan or something like this. a good reliable way that works on 99% of the skiddies is the ASC changing crypting, vry easy and simple, but still is "decryptable" by experts.

thats it, you can even makes it better splitting the code in the middle and the end of the EXE! 🤗

🤝

[Mr Fool]

Cool mate 👍
Thank you alot have nice day CyA 🤝

[Fallen]

Awesome, this should help out many people

[Bump for win]

[Sketchy]

japabrz, a question here, why is there no app in vb8 isn't it the same? I guess i need to dl vb6

If your running vista it wont work And Jababrz can you make one in VB8 I know your really good at both langs.

-Thanks

Sry if I double posted(Back Button)

[7h3r1pp3r]

cool thanks for that.
later.