Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

.NET 

[SCR] New way of EOF Data (No Dropper Detection) !

i understand it, but i feel like it's unsecure.
what if the file has numbers in it's eof? that will fuck it off.
btw, the Split is also not 100% secure, but there is a very small chance that the stub or the file contains the split string, specially if the split is some wierd sentence lool. well resources are more secure i think. but thx, good thinking.
i have a little problem because i see this program writes it like this
stub + file + filesize and normal crypter does it like this
stub + spliter + file yes :P i know how to split it but how
does your your function find the lengt of the filesize because could be 1 ore 12
and the eof contains file + filesize and how does this program knows
that the last 2 chars(example 12) ore the last 1 char(example 1) are the filelenth

i am learning code and i tried to understand this and so far i dont see anything good :P because
you even could write stub + file and then use getEOF result : file
in this case it isn't posible to use some thing like booleans
(example indicates if anti's should be activated ore not )
a stub with booleans looks like his stub + split + file + split + 0/1
( if 0 then the anti's are deactivated if 1 then they are enabled)
It won't fuck of because there is nomatter of the other files .. only the number that is written afeter that is detected as after eof and will get read.. anyway it#s working and it is okay for asimple crypter and if you want to continue using eof


(May 19, 2010 11:09 AM)SteloNLD Wrote:  i have a little problem because i see this program writes it like this
stub + file + filesize and normal crypter does it like this
stub + spliter + file yes :P i know how to split it but how
does your your function find the lengt of the filesize because could be 1 ore 12
and the eof contains file + filesize and how does this program knows
that the last 2 chars(example 12) ore the last 1 char(example 1) are the filelenth

i am learning code and i tried to understand this and so far i dont see anything good :P because
you even could write stub + file and then use getEOF result : file
in this case it isn't posible to use some thing like booleans
(example indicates if anti's should be activated ore not )
a stub with booleans looks like his stub + split + file + split + 0/1
( if 0 then the anti's are deactivated if 1 then they are enabled)
It's a kind of strange but the stub+the crypted file is detected as 1 file with 1 eof after teh second file don't knwo why xD
What is the purpose of writing the file.Length in the write_file sub?
(May 19, 2010 11:15 AM)smp211 Wrote:  What is the purpose of writing the file.Length in the write_file sub?

It is used to fin the start of the second file agian becuase you don't use any splits
lol i think i understand

files arent detected as after EOF

so program will think eof is filesize

but when you use

stub + splitter + file

then the splitter is detected as in EOF and because other file is after the spliter(EOF) the av thinks it is other file :P because he sees it as file and in this case he knows it is been written after the EOF

am i richt ore did i explain it the noobie way
(May 19, 2010 11:16 AM)pr0t0typ3 Wrote:  It is used to fin the start of the second file agian becuase you don't use any splits

Can you explain where it fits into:

ex = in1.Substring(in1.Length - read_sze.Length - read_sze, read_sze)

Or am i misunderstanding where file.Length is used?
Pretty good(haven't used yet),
I'll still use resoruces because IMO it's much easier after Julians example (I made some functions out of it.)
lol i know how to use this with booleans

write is like this:
stub + file + splitter + filesize + boolean

this work because if he wont detect filesize's as something bad he wont think it of booleans and normal text is no code so this is not detected to :P

is this true then ur are fucking awesome other wise this will be useless for advanced crypters(i think)
(May 19, 2010 11:25 AM)SteloNLD Wrote:  lol i know how to use this with booleans

write is like this:
stub + file + splitter + filesize + boolean

this work because if he wont detect filesize's as something bad he wont think it of booleans and normal text is no code so this is not detected to :P

is this true then ur are fucking awesome other wise this will be useless for advanced crypters(i think)

i think avira is detecting the first EOF, of the stub. cuz it reads it all, and read sections of a valid win32 app, to get the size of the app compiled. then the left is EOF Data. but i hope i'm wrong loool.
this is just an simple example if you only want to write on file .. if you want to write differnt inofs you would have to mod this functions


(May 19, 2010 11:29 AM)GoldStar Wrote:  i think avira is detecting the first EOF, of the stub. cuz it reads it all, and read sections of a valid win32 app, to get the size of the app compiled. then the left is EOF Data. but i hope i'm wrong loool.
If you simply write a "/" between the 2 file it will also bedetcted.. I can't explain but it is working for now so plz guys I'm not a macigan I just foudn out how to do this
(May 19, 2010 11:29 AM)GoldStar Wrote:  i think avira is detecting the first EOF, of the stub. cuz it reads it all, and read sections of a valid win32 app, to get the size of the app compiled. then the left is EOF Data. but i hope i'm wrong loool.

?? with first EOF u mean the file(encrypted virus :P)
Ew ew ew ew EW. Do NOT use fileput!
(May 19, 2010 11:34 AM)SteloNLD Wrote:  ?? with first EOF u mean the file(encrypted virus :P)

yes it should be detected all of it as EOF Data. or i think so.
(May 19, 2010 11:36 AM)Deathader Wrote:  Ew ew ew ew EW. Do NOT use fileput!

Agreed.


Possibly Related Threads...
Thread / Author Replies Views Last Post
[C] by PulseLinkApr 8, 2024 05:06 PM 4 236 Apr 8, 2024 05:06 PM
Last Post: PulseLink
[Python] by SkunT3lloJun 29, 2021 01:59 PM 2 193 Jun 29, 2021 01:59 PM
Last Post: SkunT3llo
[Python] by TreasuretrioAug 2, 2020 08:01 PM 2 152 Aug 2, 2020 08:01 PM
Last Post: Treasuretrio