wow, ok, this was a little tricky to work out, but here we go.
This is another method of passing string from a builder to a server, its FUD, and really should remain FUD because there is nothing for an AV to flag. yeah, no odd API calls, or anything crazy.
so, how is it done?
well, we will simply replace the bytes of our server with some new bytes.
wait, a few pics might help.
first, lets check the end result.....
[img]http://i53.[censored].com/5488lg.jpg[/img]
^^^ hey! just like any other method right?
ok ok, now, we are not using any EOF / Resources / Codedom stuff for this.
ok, lets look at it in our hex editor....
[img]http://i52.[censored].com/2igf58h.jpg[/img]
^^^ O.o
so basically what we have done is setup a string inside our server, and then replaced it with a new one from the builder by reading the bytes, checking for our "Target" string, when found, simply replace it.
ok, i know its hard to describe, and your probably a little more confused than understanding.
but just so you have a better idea of whats happening, i have included a sample project for you to look and play with.
now, there are some things to remember when doing this. the new and old string MUST be the same length or else you will have to start screwing around with the PE, and thats not the point of this. If you look through the code, I have my "Replacement String" padded with a crapload of spaces at the end, this is setting up some free space inside the server for me to add just about anything i wanted to (with a length restriction). This method (as far as i know) will only work with strings, so it might not be a good idea for you crypter nuts out there.
so, uh, i think thats about it, d/l the source and check it out. im not saying that its 100% error proof, but its just another method to add under your belt.
MediaFire Download
enjoy, have fun, and leave me a bit of feedback.
This is another method of passing string from a builder to a server, its FUD, and really should remain FUD because there is nothing for an AV to flag. yeah, no odd API calls, or anything crazy.
so, how is it done?
well, we will simply replace the bytes of our server with some new bytes.
wait, a few pics might help.
first, lets check the end result.....
[img]http://i53.[censored].com/5488lg.jpg[/img]
^^^ hey! just like any other method right?
ok ok, now, we are not using any EOF / Resources / Codedom stuff for this.
ok, lets look at it in our hex editor....
[img]http://i52.[censored].com/2igf58h.jpg[/img]
^^^ O.o
so basically what we have done is setup a string inside our server, and then replaced it with a new one from the builder by reading the bytes, checking for our "Target" string, when found, simply replace it.
ok, i know its hard to describe, and your probably a little more confused than understanding.
but just so you have a better idea of whats happening, i have included a sample project for you to look and play with.
now, there are some things to remember when doing this. the new and old string MUST be the same length or else you will have to start screwing around with the PE, and thats not the point of this. If you look through the code, I have my "Replacement String" padded with a crapload of spaces at the end, this is setting up some free space inside the server for me to add just about anything i wanted to (with a length restriction). This method (as far as i know) will only work with strings, so it might not be a good idea for you crypter nuts out there.
so, uh, i think thats about it, d/l the source and check it out. im not saying that its 100% error proof, but its just another method to add under your belt.
MediaFire Download
enjoy, have fun, and leave me a bit of feedback.
