[gigajew]

Here's my easy to understand codedom crypter foundation. Americrypt. Hopefully this can help some people get started with crypters. Note that this does not actually encrypt any executables, it just adds them to resources. So it is up to you to add your own algorithm.



Download: https://files.catbox.moe/u2iy3o.zip

[int]

looks interesting, but looks more unclean than the normal .txt string replace crypters

[Electron]

Good job but dnlib would make it look better.

[int]

Good job but dnlib would make it look better.

I would like to see an example with dnlib, I have never seen that before

[Electron]

I would like to see an example with dnlib, I have never seen that before

Well, I think there are no public examples about it at least when I made it for my crypter, there was no documentation or anything. The most of the properties, methods, opcodes and classes are named like in dnSpy which is the only thing that helps. I would like to see dnlib documentation one day because it's the best existing library. Basically, you make separate projects for your stub and loader then you add resources to them (e.g. payload), randomize Mvid, patch strings (I assume you will have settings like MessageBox) and obfuscate your file. I won't give my code but I can help anyone who needs help for it. If you organize your code you will need like 2-3 methods for adding to resources, patching strings and some basic obfuscation to randomize Mvid, rename strings and maybe some more advanced extras like Control Flow Obfuscation, etc. The only advantage over CodeDOM is that you don't have edit something blindly (without Intellisense) but instead you are working on .cs files like every project.

[gigajew]

What's mvid out of curiosity

[josha28]

I would like to see an example with dnlib, I have never seen that before

same here, but is it posible to make a usg function.

[HFDone]

Module Version Id - MVID
The MVID is a Guid used to distinguish between two versions of the same module

var asm = Assembly.GetExecutingAssembly();
var mvid = asm.ManifestModule.ModuleVersionID;

[Electron]

What's mvid out of curiosity

Open an executable in dnSpy, right click on the module (purple colored) -> Edit Module, there it is. If you don't randomize it, ESET will detect your stub easier. Same goes for Assembly Custom Attributes (not Module). You can clear them too.

Hint:

Code

_assembly.Modules[0].Mvid = Guid.NewGuid();
_assembly.CustomAttributes.Clear();

[josha28]

can someone teach me how to make a runpe.

[int]

can someone teach me how to make a runpe.

how about you look at the 20000 public examples there are?
you have been spamming this section for more than enough time to figure it out

[josha28]

how about you look at the 20000 public examples there are?
you have been spamming this section for more than enough time to figure it out

cant find those public examples, just 1 working

[Electron]

cant find those public examples, just 1 working

Upload one on pastebin and tell me what you don't understand.

[3DES]

can someone teach me how to make a runpe.

Allocate memory in remote process, write/map PE image to the process, relocate pe, set entry point and resume thread, better option is to use LoadPE instead of RunPE but that is your choice.

[josha28]

Allocate memory in remote process, write/map PE image to the process, relocate pe, set entry point and resume thread, better option is to use LoadPE instead of RunPE but that is your choice.

and what does loadpe?