You can use this to get past Avira!
Please credit me if used. I've been slaving over a hot pc for the last few hours trying to get this to work (there is almost no documentation or examples on this)
Write resources to exe:
Read resources:
How can this bypass avira? Simple. Instead of writing data to the EOF, you are writing it to the exe's resources (can be viewed in ResHacker and similar programs)
How do I use it? Put the writer in the builder and the reader in the stub. Get the builder to WRITE the settings to the server after it's written, then get the stub to read the resources, and parse out whatever. You can use this to read the output (if you are using strings)
and to convert to byte array:
Please credit me if used. Thanks.
Please credit me if used. I've been slaving over a hot pc for the last few hours trying to get this to work (there is almost no documentation or examples on this)
Write resources to exe:
Code
Imports System.Runtime.InteropServices
Module ResourceWriter
Private Function ToPtr(ByVal data As Object) As IntPtr
Dim h As GCHandle = GCHandle.Alloc(data, GCHandleType.Pinned)
Dim ptr As IntPtr
Try
ptr = h.AddrOfPinnedObject()
Finally
h.Free()
End Try
Return ptr
End Function
<DllImport("kernel32.dll", SetLastError:=True)> _
Private Function UpdateResource(ByVal hUpdate As IntPtr, ByVal lpType As String, ByVal lpName As String, ByVal wLanguage As UShort, ByVal lpData As IntPtr, ByVal cbData As UInteger) As Boolean
End Function
<DllImport("kernel32.dll", SetLastError:=True)> _
Private Function BeginUpdateResource(ByVal pFileName As String, <MarshalAs(UnmanagedType.Bool)> ByVal bDeleteExistingResources As Boolean) As IntPtr
End Function
<DllImport("kernel32.dll", SetLastError:=True)> _
Private Function EndUpdateResource(ByVal hUpdate As IntPtr, ByVal fDiscard As Boolean) As Boolean
End Function
Public Function WriteResource(ByVal filename As String, ByVal bytes As Byte()) As Boolean
Try
Dim handle As IntPtr = BeginUpdateResource(filename, False)
Dim file1 As Byte() = bytes
Dim fileptr As IntPtr = ToPtr(file1)
Dim res As Boolean = UpdateResource(handle, "RT_RCDATA", "0", 0, fileptr, Convert.ToUInt32(file1.Length))
EndUpdateResource(handle, False)
Catch ex As Exception
Return False
End Try
Return True
End Function
End ModuleRead resources:
Code
Imports System.Runtime.InteropServices
Module ResourceReader
<DllImport("kernel32.dll", SetLastError:=True)> _
Private Function FindResource(ByVal hModule As IntPtr, ByVal lpName As String, ByVal lpType As String) As IntPtr
End Function
Private Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal moduleName As String) As IntPtr
Private Declare Function SizeofResource Lib "kernel32" (ByVal hModule As IntPtr, ByVal hResInfo As IntPtr) As Integer
Private Declare Function LoadResource Lib "kernel32" (ByVal hModule As IntPtr, ByVal hResInfo As IntPtr) As IntPtr
Public Function ReadResource(ByVal filename As String) As Byte()
Dim hModule As IntPtr = GetModuleHandle(filename)
Dim loc As IntPtr = FindResource(hModule, "0", "RT_RCDATA")
Dim x As IntPtr = LoadResource(hModule, loc)
Dim size = SizeofResource(hModule, loc)
Dim bPtr As Byte() = New Byte(size - 1) {}
Marshal.Copy(x, bPtr, 0, CInt(size))
Return bPtr
End Function
End ModuleHow can this bypass avira? Simple. Instead of writing data to the EOF, you are writing it to the exe's resources (can be viewed in ResHacker and similar programs)
How do I use it? Put the writer in the builder and the reader in the stub. Get the builder to WRITE the settings to the server after it's written, then get the stub to read the resources, and parse out whatever. You can use this to read the output (if you are using strings)
Code
System.Text.Encoding.Default.GetString("BYTES!")and to convert to byte array:
Code
System.Text.Encoding.Default.GetBytes("STRING!")Please credit me if used. Thanks.
![[Image: Xtddh8V.png]](https://i.imgur.com/Xtddh8V.png)
