[iRtehLeet™]

Does this require EOF preservation or what dude?

[0xBB]

I dont see any eof in dc stubs. And you can't load unmanaged bytes in domain.

[ScΛrƒΛc3_]

No problem with darkcomet, i know cybergate needs eof presevation. You can use a RunPE and load the bytes....no problem with that.

[ScΛrƒΛc3_]

No. You'll need a RunPE for unmanaged .exe, and Reflection for managed.

[The-One]

You can use .net reflection to load an unmanged exe. And both DC and CG are both unmanaged.

Lol no, managed means that it relies on a code which is already written such as .NET. Unmanaged doesn't have all those prewritten codes. So .NET reflection only works for managed code, but compiled with .NET.

[salmoneus]

You are selling a crypter. You should know this.

[๖ۣۜMephobia]

I meant to say .net reflection is used with managed code. I was on my phone and didn't proofread. That's why I said DC and CG were both unmanaged.

[n0$f3ratu$]

The answer is simple.
NO, it doesn't need EOF!!!, but either way you will crypt the server, with or without upx, it will work.
At least in my case it doesn't break it.

---

No. You'll need a RunPE for unmanaged .exe, and Reflection for managed.

Not really.
I am using runpe for both.
The only difference is when crypting .Net files i inject in it self.

[0xBB]

The answer is simple.
NO, it doesn't need EOF!!!, but either way you will crypt the server, with or without upx, it will work.
At least in my case it doesn't break it.

---

Not really.
I am using runpe for both.
The only difference is when crypting .Net files i inject in it self.

So what you're saying here is you currently inject managed code ? I mean for managed , don't you use a domain ? 🤝

[n0$f3ratu$]

So what you're saying here is you currently inject managed code ? I mean for managed , don't you use a domain ? 🤝

Exactly.
I never did and as far as i am concern never will.

[0xBB]

Exactly.
I never did and as far as i am concern never will.

Intersting, I guess you inject into a managed process. If you don't mind, which .exe is by default in .NET that is coded in managed ? Or you drop something 😧

Edit :

Nvm I found something 👍 ; http://msdn.microsoft.com/en-us/library/99sz37yh.aspx

[ScΛrƒΛc3_]

The answer is simple.
NO, it doesn't need EOF!!!, but either way you will crypt the server, with or without upx, it will work.
At least in my case it doesn't break it.

---

Not really.
I am using runpe for both.
The only difference is when crypting .Net files i inject in it self.

You are Correct! I actually have too a RunPE that runs managed too. But as you said inject in itself 😅

[iRtehLeet™]

I know you need two different ways to inject managed/native, but my current Native RunPE doesn't seem to run DC servers properly with no settings on the DC server.

[0xBB]

You are Correct! I actually have too a RunPE that runs managed too. But as you said inject in itself 😅

Yeh, and how you guys handle eof ? Copying any eof to the crypted file would trigger avira. 😑

[ScΛrƒΛc3_]

yes, if we talk about well known rat's....only cybergate needs to keep the EOF, anyway, i have my personal rat project that uses EOF only for settings (i'm currently using appendalltext) and it's clean, since the data is really really small. So...if the EOF of cybergate is not so large in size, probably would not be a problem to copy it and append to the stub, but never used cybergate. I can only say for sure that an irrilevant size of data, would probably not be a problem with avira. But for storing the entire file in your stub you can't use EOF obviously, actually i'm using cecil to add it as emebedded resource.