[Zer0Fact0r]

This is essentially a stripped down version of the code in this thread (with the exception that this will work on .NET assemblies): https://hackforums.net/showthread.php?tid=1191361

I put this together a long time ago. It works and is much more memory efficient than other EoF functions I've seen here.

Code

public static byte[] ReadEoF(string fileName)
{
    byte[] buffer = null;
    using (FileStream fs = new FileStream(fileName, FileMode.Open))
    {
  buffer = new byte[4];
  fs.Position = 0x3C;
  fs.Read(buffer, 0, 4);
  fs.Position = BitConverter.ToInt32(buffer, 0) + 0x6;
  buffer = new byte[2];
  fs.Read(buffer, 0, 2);
  fs.Position += 0x100 + ((BitConverter.ToInt16(buffer, 0) - 1) * 0x28);
  buffer = new byte[8];
  fs.Read(buffer, 0, 8);
  fs.Position = BitConverter.ToInt32(buffer, 0) + BitConverter.ToInt32(buffer, 4);
  buffer = new byte[fs.Length - fs.Position];
  fs.Read(buffer, 0, buffer.Length);
    }
    return buffer;
}

Example Usage:

Code

File.AppendAllText("lol.exe", "123456");
Console.WriteLine(Encoding.ASCII.GetString(ReadEoF("lol.exe")));
// writes "123456" to the console

[Vysse]

Very nice share this is quite the small snippet

[DragQueen]

i tries my code on process explorer and i got 3229 byte[] with urs i got 6008 byte[]
the question is what function is not work my / urs

[no1me]

his code working just fine i check it

[DragQueen]

my mistake work on .net files Omg
and process explorer is not .net file
EDIT :: i liked this code i added it to my class. with source link + right credit.

[mnbv]

Wow thanks very much, this is very short and efficient

But how can I use this in my crypter? First checking EOF and, if there is if then: ???
And also doing something with the EOF in the Stub?

After a quick search (btw Im using CodeDom, but it should be the same)
The steps: read EOF, crypt file, write it back to the file.
And quote of Vorfin
"Well, since EoF Preservation is a Function on the Builder, not the Stub, it doesn't matter if you use CodeDom or not. "

[Zer0Fact0r]

i tries my code on process explorer and i got 3229 byte[] with urs i got 6008 byte[]
the question is what function is not work my / urs

Your (ported) code loads the contents of the executable into memory (File.ReadAllBytes). Mine doesn't.

[mnbv]

Build is crypting the file
Read Bytes, Convert to string, Encrypt, Write with CodeDom

Edit: this is not the good way

Code

//Byte[] norm_file = System.IO.File.ReadAllBytes(i.Text); // Reads all bytes <This worked
    Byte[] norm_file = ReadEoF(i.Text);

Can anyone offer some help?

[DragQueen]

Your (ported) code loads the contents of the executable into memory (File.ReadAllBytes). Mine doesn't.

its still not explain the diffrent in the bytes []
in .net file it work like charm ... in other native files
i see big diffrent [6000 and 3000 its big diffrents]
and string its also weird ... with my class i get readable string
with this func i get unreadable string
ur methood work only on .net files, check it and see
mu methood work only with native with .net it fail

[Zer0Fact0r]

its still not explain the diffrent in the bytes []
in .net file it work like charm ... in other native files
i see big diffrent [6000 and 3000 its big diffrents]
and string its also weird ... with my class i get readable string
with this func i get unreadable string
ur methood work only on .net files, check it and see
mu methood work only with native with .net it fail

I did... and it works fine...
You're testing it wrong.

[mnbv]

Anybody that can refere me or post a writeeof function that belongs to this read function?
Else, Its useless

[no1me]

File.AppendAllText("lol.exe", "123456");

Console.WriteLine(Encoding.ASCII.GetString(ReadEoF("lol.exe")));

// writes "123456" to the console

[mnbv]

This is with a console, but a crypted server for example is different, Actually thats the thing im searching (for days)
Thanks for the unput though ..
Anyone?

[no1me]

write to file
File.AppendAllText("lol.exe", "123456");
read the eof
msgbox(Encoding.ASCII.GetString(ReadEoF("lol.exe")));

the same for any file

[mnbv]

But what you are basically doing now is:
Make a file with name: lol.exe and eof: 123456

Then you read it and show it in a msgbox, console or whatever.

but this is not writing to a crypted file on the desktop for example right?

File.AppendAllText("cryptedfile.exe", "ReadedEofdata");
If its like above , I get it