[gigajew]

Finally managed to stabilize my .NET RunPE after researching some. If an exception is thrown when you use it, you're probably running a .NET version lower than the assembly you're trying to run. For Quasar; try .NET 3.5 or .NET 4.0

[Hyperhacktive]

Thank you I'll test it soon 🙂

[ShallowME]

I think you just added 10 more crypters to the market. GL!

[ChainChain]

nice work bro , thnx for sharing

[gigajew]

Thanks for sharing, the only problem i have is, when i try to test it with Quasar (on 4.0) it just open and close itself over and over again, but nothing happens :/

Sounds like your AV is detecting it in memory

[Washi]

Okay so I have a couple of questions about this snippet.

What is the reason behind the thread affinity and critical regions?

PHP Code


<?php 
Thread.BeginThreadAffinity();
Thread.BeginCriticalRegion(); 


Why are we changing the apartment state based on the amount of parameters the entry point has?

PHP Code


<?php 
if (parameters.Length > 0)
{
   assemblyExecuteThread.SetApartmentState(ApartmentState.STA);
}
else
{
   assemblyExecuteThread.SetApartmentState(ApartmentState.MTA);
} 


And what is the purpose of clearing the first 32 bytes of the module?

PHP Code


<?php 
RtlZeroMemory(Marshal.GetHINSTANCE(assembly.ManifestModule), 32); 


Also not sure about the value of the unwrap function to be honest. Couldn't you just use one of the Encoding classes and use GetBytes instead?

[Cyber Satan]

I get this "A first chance exception of type 'System.Reflection.TargetInvocationException' occurred in mscorlib.dll"_____
Visual Basic 2010 Express
.Net 2.0 and .Net 4 (Tried both)
Immnient Monitor

[narc0tic]

Entrypoint.Invoke has been known for a long time.
Its very very detected at runtime and should not be used in a crypter.

Nice source though.

[gigajew]

I accidentally got the SetApartmentState in wrong order, if > 0 set it to MTA, otherwise set it to STA

[ubbelol]

I accidentally got the SetApartmentState in wrong order, if > 0 set it to MTA, otherwise set it to STA

The number of parameters is irrelevant to what thread apartment state you should use. Read Washi's comment.

[RamboII]

another joke ??? get some errors too

[Interallahu]

Dude, your just adding more encouragement to use Assembly.Load Stuff, compared to a Injector or a Unmanaged alternative

Plus, Its hard to obfusacate APIs, Especially RtlZeroMemory, I suggest not using such an Anti-Dump.
AVs detect RtlZeroMemory alot ( Common ) and when it gets to VT, it probably just alreayd got 66/66

At least try using something Like Exception Filters or Int2D, not to be rude and a Delegate for 1/2 method doesnt make much sense.. 😧

[SIM-3947811]

Works perfect for me. Idk why people says : IT'S DETECTED OMGGGG. It's looks like loadpe, very clean, no api calls. Thanks for share!

BTW, i test it now, hollows hunter and runpe hunter doesn't detect this ! VERY NICE !

[Anonz8]

nice work bro , thnx for sharing :)

[xHeaven]

Works perfect for me. Idk why people says : IT'S DETECTED OMGGGG. It's looks like loadpe, very clean, no api calls. Thanks for share!

BTW, i test it now, hollows hunter and runpe hunter doesn't detect this ! VERY NICE !

You make no sense. This is nothing like a LoadPE, I wouldn't even comment the rest of your reply.