[Tostig]

Fixed this up and the source is for sale.

[BahNahNah]

Nice work, but there is a couple of questionable things:

1) You are adding a lot of unnecessary references to the codedom compiler. This:

Code

CompilerParameters Params = new CompilerParameters();
Params.ReferencedAssemblies.Add("System.dll");
Params.ReferencedAssemblies.Add("System.IO.dll");
Params.ReferencedAssemblies.Add("System.Threading.dll");
Params.ReferencedAssemblies.Add("System.Management.dll");
Params.ReferencedAssemblies.Add("System.Globalization.dll");
Params.ReferencedAssemblies.Add("System.ComponentModel.dll");
Params.ReferencedAssemblies.Add("System.Runtime.InteropServices.dll");
Params.ReferencedAssemblies.Add("System.Web.dll");
Params.ReferencedAssemblies.Add("System.Drawing.dll");

Can be simplified to

Code

CompilerParameters Params = new CompilerParameters(new string[] { "System.dll" });

2) What are the configs used for?
3) Why is frmMain being passed into the functions when its not used?
4) The lack of string.format.
5) (For future reference) you dont need to inject the icon, you can add it to the exe with codedom by adding

Code

Params.CompilerOptions += string.Format(" /win32icon:\"{0}\"", "Path");

[BahNahNah]

I'm super confused, is this app a "Crypter" or a downloader?
The reason I ask is because you said "obfuscates and compresses it".

Unless you have to do that in order to download something... in which case, I'll need someone to dumb it down for me 😧

Its a downloader, it downloads a file from a direct link then executes it.

It seems the compressor is just a packer, wich is making the stub bigger.
And i dont see the need for obfiscation with a stub as simple as this one.

[BahNahNah]

So a downloader doesn't have to compress files in order to make it into an executable, correct?

Also, if it is meant to compress it, why does it become larger?

No, the downloaded stub just contains the direct link to the file, there is no need for compression.

The reason it is making it bigger is because the compressed exe is an entirely new file that contains the compressed stub inside of it (i know its confusing) then, when it is executed it decompressed the original exe and runs it.

The reason it is bigger is because the stub used by the compresser is bigger than the stub produced by the downloader.

Leet paint skills:

Spoiler (Click to View)



So you can see that the downloaded output gets smaller, but it is countered by the compresser output.

[BahNahNah]

That is confusing as fuck.
Is the memory used smaller when the compressed file is ran since it is compressed?
Or when does the compressed aspect play into it? 😧

The memory usage would be more because

-> Runs compressed file (loads ~40kb into memory)
-> Loads compressed bytes into memory (depends on original stub, maybe 2kb in this case)
-> Writes decompressed bytes to disk
-> Launches decompressed exe (4kb in this case)
-> Closes compressed file (Unloads ~42kb)
so with the compression the most memory used at one time is ~46kb (compressed file + compressed bytes + decompressed exe running)

When its not compressed
-> Loads uncompressed file (4kb)

so yeah.

[Nervo]

That is confusing as fuck.
Is the memory used smaller when the compressed file is ran since it is compressed?
Or when does the compressed aspect play into it? 😧

The file is decompressed on runtime to the original state then run. So basically it will use the same amount of memory as before, maybe even more since decompressor has to be run too.

[BahNahNah]

The file is decompressed on runtime to the original state then run. So basically it will use the same amount of memory as before, maybe even more.

You are ignoring the memory used by the program that decompresses the original exe though.

[Nervo]

You are ignoring the memory used by the program that decompresses the original exe though.

Yeah I understand that, I said it that way because I was talking just about compressed file without adding memory usage of the compressor itself. Just so he understands that the compressed file is basically the same thing as before after decompression on runtime.

---

So combining what you both just said, this is like downloading a .zip, except when extracted, the files within it come out to be bigger (which happens when the compressed .exe runs)? I understand now xD

Basically yes, after extracting you get original file size.

[BahNahNah]

So combining what you both just said, this is like downloading a .zip, except when extracted, the files within it come out to be bigger (which happens when the compressed .exe runs)? I understand now xD

Using the example of zip files:
Its like if every time you compressed a file, a base 40kb was added, then the compressed files where added.
So basically its only worth compressing if your file is bigger than 40kb.

[BahNahNah]

Thanks guys, I understand now :3
And that base file 40kb (from the compression) is like the decompression key, more or less?

Err, no.

Spoiler (Click to View)
No, the downloaded stub just contains the direct link to the file, there is no need for compression.

The reason it is making it bigger is because the compressed exe is an entirely new file that contains the compressed stub inside of it (i know its confusing) then, when it is executed it decompressed the original exe and runs it.

The reason it is bigger is because the stub used by the compresser is bigger than the stub produced by the downloader.


Leet paint skills:

Spoiler (Click to View)



So you can see that the downloaded output gets smaller, but it is countered by the compresser output.

Its because the original exe is inside another program, and that other program is 40kb.

[.cYRil.]

its good to have this source ,thanks for this

[Aristocles]

Using ConfuserEX for malware purpose. You should be banned. Like really.

[Tostig]

Using ConfuserEX for malware purpose. You should be banned. Like really.

So remove the function that uses Confuser... it's not difficult.

I wanted each build to be somewhat different.

[BahNahNah]

So remove the function that uses Confuser... it's not difficult.

I wanted each build to be somewhat different.

This is achievable through codedom by adding random junk code and renaming all the functions and variables.

[Cecilia]

This is achievable through codedom by adding random junk code and renaming all the functions and variables.

Or you know, making your own obfuscator...