[Reaper91]

Hey everyone, I'm here trying to contribute to the community and I thought this tut would better help the programming noobs out. Ok, with that being said, please don't troll my thread and let's get started now.

For all the noobs, just to clarify, when you have a crypter, the stub is essentially your virus with the origional exe inside it somehow, when the stub is ran, the virus is decrypted and ran (usually in memory). With that being said, you have a runtime crypter. So, in order to make a runtime crypter, you need a RunPE, what this does is it will inject native exe's inside a Windows Process and create a child process. But that only works for native exe's, in order to run a .Net exe, you need my code. In order for this to work though, you need to remember a couple of things. This code will only work with files that don't have EOF Data (but there is a fix) and it will only invoke exe's with the same .Net Framework dependency or lower.

Code

Dim asm As Assembly = AppDomain.CurrentDomain.Load(bytes) ' Loads decrypted bytes.
Dim met As MethodInfo = asm.EntryPoint ' Finds EntryPoint (Main/Form1_Load).
Dim ObjCls As Object = asm.CreateInstance(met.Name) ' Gets EntryPoint as a function name.
Dim ObjParam As Object() = Nothing ' Variable for setting any extra parameters at Entry.
If (met.GetParameters.Length > 0) Then ' Checks Entry for any extra parameters.
    ObjParam = New Object() {New String() {Nothing}} ' If any are found, they're set in ObjParam.
End If
met.Invoke(ObjCls, ObjParam) ' Run our .Net exe at entry with or without any extra parameters.

[Only3]

old and not work on all options did u try it

[Reaper91]

old and not work on all options did u try it

Yes, it works fine in my crypter when it's compiled under .Net 3.5!

[ScΛrƒΛc3_]

Ok...good enough, and good explaination Reaper, but ...needs more cowbell!!!

[Cornflower Blue இڿڰۣ-ڰۣ—]

Just tested this out and get this error

Code

Exception has been thrown by the target of an invocation.

[gigajew]

First of, don't call people noobs when it's clear to me that you have little-to-no idea what you're talking about. You can't inject managed code into native code. Period. You just invoked a .NET assembly.

On top of that, you don't even know what the code does, because if you did, you'd know that you can invoke the assembly with only one line, and skip all that mess you copy pasted.

[ScΛrƒΛc3_]

Just tested this out and get this error

Code

Exception has been thrown by the target of an invocation.

not that was necessary to test for me, but works good on my side.

[Cornflower Blue இڿڰۣ-ڰۣ—]

not that was necessary to test for me, but works good on my side.

Any idea on how to fix this error? Nothing came up on google.

[gigajew]

Any idea on how to fix this error? Nothing came up on google.

Yeah, don't use his code. It's horrible.

[Cornflower Blue இڿڰۣ-ڰۣ—]

Yeah, don't use his code. It's horrible.

You want to give better code then instead of insulting OP?

[gigajew]

You want to give better code then instead of insulting OP?

He insulted himself by posting that code. And sure, I'll PM you with it later on.

[ScΛrƒΛc3_]

Any idea on how to fix this error? Nothing came up on google.

I think depends on what you are trying to run from memory, or an issue with the entry point. Sometimes is better and stable olso run from a new thread, try with this snippet:

PHP Code


<?php 
Public Sub Execute(ByVal bytes As Byte())
  Dim t As New Thread(AddressOf DoExecute)
  t.TrySetApartmentState(ApartmentState.STA)
  t.Start(bytes)
    End Sub

    Public Sub DoExecute(ByVal d As Byte())
  Try
    If d(&H3C) = &H80 Then
    Dim asm As Assembly = Assembly.Load(d)
    Dim entryPoint As MethodInfo = asm.EntryPoint
    Dim o As Object() = Nothing
    If entryPoint.GetParameters().Length > 0 Then
    o = New Object() {New String() {"1"}}
    End If
    entryPoint.Invoke(Nothing, o)
    Application.Exit()
    End If
  Catch
  End Try
    End Sub 


---

He insulted himself by posting that code. And sure, I'll PM you with it later on.

Op never said this code inject managed into native, insted he clearly specified that you cant, reason why he posted how to run from memory .net assemblyes....dunno on what you are complaining on... 😑

[Cornflower Blue இڿڰۣ-ڰۣ—]

I think depends on what you are trying to run from memory, or an issue with the entry point. Sometimes is better and stable olso run from a new thread, try with this snippet:

PHP Code


<?php 
Public Sub Execute(ByVal bytes As Byte())
  Dim t As New Thread(AddressOf DoExecute)
  t.TrySetApartmentState(ApartmentState.STA)
  t.Start(bytes)
    End Sub

    Public Sub DoExecute(ByVal d As Byte())
  Try
    If d(&H3C) = &H80 Then
    Dim asm As Assembly = Assembly.Load(d)
    Dim entryPoint As MethodInfo = asm.EntryPoint
    Dim o As Object() = Nothing
    If entryPoint.GetParameters().Length > 0 Then
    o = New Object() {New String() {"1"}}
    End If
    entryPoint.Invoke(Nothing, o)
    Application.Exit()
    End If
  Catch
  End Try
    End Sub 


---

Op never said this code inject managed into native, insted he clearly specified that you cant, reason why he posted how to run from memory .net assemblyes....dunno on what you are complaining on... 😑

Same error :/ Must be the EntryPoint?
Thanks for helping tho.

[ScΛrƒΛc3_]

Same error :/ Must be the EntryPoint?
Thanks for helping tho.

Yep. Im sure is an entry point issue for sure. But is hard to say without the specific code.

[Cornflower Blue இڿڰۣ-ڰۣ—]

Yep. Im sure is an entry point issue for sure. But is hard to say without the specific code.

PHP Code


<?php 
namespace Test
{
    public partial class Form1 : Form
    {
  public Form1()
  {
    InitializeComponent();
    MessageBox.Show("test");
  }
    }
} 


That's the code I am trying to run(Compiled into an Exe)