[Joler1302]

Thanks for contributing.

Gonna link to this in my thread.

:)

[Kōtei]

Just saw this now. Very nice dude. Will wait for others results....I cbf to try it atm.

[xvisceral]

I also looked at it to see what language it was. Saw that it was VB.Net and not interested in even looking at the code. So don't assume everyone is an ungrateful leecher - which you will get no matter what you post

[HackerSnor]

im having 2 more detections ,
but where to add this piece of code
sry but this is looking difficult

[dark]

thanks but it is no useful for me since im not "coder".

[acidfreak]

i love you pr0t0 <3
^_^

gonna try this now

[GoldStar]

i understand it, but i feel like it's unsecure.
what if the file has numbers in it's eof? that will fuck it off.
btw, the Split is also not 100% secure, but there is a very small chance that the stub or the file contains the split string, specially if the split is some wierd sentence lool. well resources are more secure i think. but thx, good thinking.

[smp211]

What is the purpose of writing the file.Length in the write_file sub?

[smp211]

It is used to fin the start of the second file agian becuase you don't use any splits

Can you explain where it fits into:

ex = in1.Substring(in1.Length - read_sze.Length - read_sze, read_sze)

Or am i misunderstanding where file.Length is used?

[GoldStar]

lol i know how to use this with booleans

write is like this:
stub + file + splitter + filesize + boolean

this work because if he wont detect filesize's as something bad he wont think it of booleans and normal text is no code so this is not detected to :P

is this true then ur are fucking awesome other wise this will be useless for advanced crypters(i think)

i think avira is detecting the first EOF, of the stub. cuz it reads it all, and read sections of a valid win32 app, to get the size of the app compiled. then the left is EOF Data. but i hope i'm wrong loool.

[Deathader]

Ew ew ew ew EW. Do NOT use fileput!

[GoldStar]

?? with first EOF u mean the file(encrypted virus :P)

yes it should be detected all of it as EOF Data. or i think so.

[GoldStar]

lol i though he explained me that file + file will be detected like 1 file for av's and file + normal-tekst + file been detekted as 2 files

this have's some logic you can't see diferents between tekst and tekst
and diferent between file and file

explain 0101010 + 01011100 is 010101001011100 if you dont know how each file looks then you even dont know wich is wich part

but when you have 0101010 + hello + 01011100 result 0101010hello01011100 then you see it :P

now even each char from hello is an 8-bit (byte). but what i mean is, avira will read all file, then there is defined structures of a valid win32 app (you can check any runpe and you will find them). then it will take that file and start filling those structures from data of the file. if the data matches the structure, no eof. if we filled all structures and there is some data left, eof not empty.

[Deathader]

I find it's useful to use filesplits like this:
Dim fileSplit As String = "ïu¾‹Ç¨Õ®ipfx'f趷Íîªý"

For some reason they are a LOT more UD (I just open random exe's in notepad++ and mash 2 strings together)

[/etc/security/access.conf]

I was waiting for this from you mate.
Good release. I'll probably use it. Thanks!

-NoxiousHacker.