Quote:
Originally Posted by Super Aids
I don't think that's a loader problem, but a problem with your packets.
|
here is .cs files which i am using for the loader ...
HTML Code:
public static class WINAPI
{
// Methods
[DllImport("kernel32.dll", SetLastError = true)]
public static extern int CloseHandle(IntPtr hObject);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttribute, IntPtr dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr GetModuleHandle(string lpModuleName);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr GetProcAddress(IntPtr hModule, string lpProcName);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr OpenProcess(uint dwDesiredAccess, int bInheritHandle, uint dwProcessId);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern int WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] buffer, uint size, out IntPtr lpNumberOfBytesWritten);
// Nested Types
public static class VAE_Enums
{
// Nested Types
public enum AllocationType
{
MEM_COMMIT = 0x1000,
MEM_RESERVE = 0x2000,
MEM_RESET = 0x80000
}
public enum ProtectionConstants
{
PAGE_EXECUTE = 0x10,
PAGE_EXECUTE_READ = 0x20,
PAGE_EXECUTE_READWRITE = 0x40,
PAGE_EXECUTE_WRITECOPY = 0x80,
PAGE_NOACCESS = 1
}
}
}
HTML Code:
public static class donttryitathomeion
{
// Methods
//private static byte[] CalcBytes(string sToConvert);
//private static bool CRT(Process pToBedonttryitathomeed, string sDllPath, out string sError, out IntPtr hwnd);
//public static bool donttryitathome(Process pToBedonttryitathomeed, string sDllPath, out string sError);
private static byte[] CalcBytes(string sToConvert)
{
return Encoding.ASCII.GetBytes(sToConvert);
}
private static bool CRT(Process pToBedonttryitathomeed, string sDllPath, out string sError, out IntPtr hwnd)
{
sError = string.Empty;
IntPtr hProcess = WINAPI.OpenProcess(0x43a, 1, (uint)pToBedonttryitathomeed.Id);
hwnd = hProcess;
if (hProcess == IntPtr.Zero)
{
sError = "Unable to attatch to process.\n";
sError = sError + "Error code: " + Marshal.GetLastWin32Error();
return false;
}
IntPtr procAddress = WINAPI.GetProcAddress(WINAPI.GetModuleHandle("kernel32.dll"), "LoadLibraryA");
if (procAddress == IntPtr.Zero)
{
sError = "Unable to find address of \"LoadLibraryA\".\n";
sError = sError + "Error code: " + Marshal.GetLastWin32Error();
return false;
}
IntPtr lpBaseAddress = WINAPI.VirtualAllocEx(hProcess, IntPtr.Zero, (IntPtr)sDllPath.Length, 0x3000, 0x40);
if ((lpBaseAddress == IntPtr.Zero) && (lpBaseAddress == IntPtr.Zero))
{
sError = "Unable to allocate memory to target process.\n";
sError = sError + "Error code: " + Marshal.GetLastWin32Error();
return false;
}
byte[] buffer = CalcBytes(sDllPath);
IntPtr zero = IntPtr.Zero;
WINAPI.WriteProcessMemory(hProcess, lpBaseAddress, buffer, (uint)buffer.Length, out zero);
if (Marshal.GetLastWin32Error() != 0)
{
sError = "Unable to write memory to process.";
sError = sError + "Error code: " + Marshal.GetLastWin32Error();
return false;
}
if (WINAPI.CreateRemoteThread(hProcess, IntPtr.Zero, IntPtr.Zero, procAddress, lpBaseAddress, 0, IntPtr.Zero) == IntPtr.Zero)
{
sError = "Unable to load dll into memory.";
sError = sError + "Error code: " + Marshal.GetLastWin32Error();
return false;
}
return true;
}
public static bool donttryitathome(Process pToBedonttryitathomeed, string sDllPath, out string sError)
{
IntPtr zero = IntPtr.Zero;
if (!CRT(pToBedonttryitathomeed, sDllPath, out sError, out zero))
{
if (zero != IntPtr.Zero)
{
WINAPI.CloseHandle(zero);
}
return false;
}
int num = Marshal.GetLastWin32Error();
return true;
}
// Nested Types
private static class WINAPI
{
// Methods
[DllImport("kernel32.dll", SetLastError = true)]
public static extern int CloseHandle(IntPtr hObject);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttribute, IntPtr dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr GetModuleHandle(string lpModuleName);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr GetProcAddress(IntPtr hModule, string lpProcName);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr OpenProcess(uint dwDesiredAccess, int bInheritHandle, uint dwProcessId);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern int WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] buffer, uint size, out IntPtr lpNumberOfBytesWritten);
// Nested Types
public static class VAE_Enums
{
// Nested Types
public enum AllocationType
{
MEM_COMMIT = 0x1000,
MEM_RESERVE = 0x2000,
MEM_RESET = 0x80000
}
public enum ProtectionConstants
{
PAGE_EXECUTE = 0x10,
PAGE_EXECUTE_READ = 0x20,
PAGE_EXECUTE_READWRITE = 0x40,
PAGE_EXECUTE_WRITECOPY = 0x80,
PAGE_NOACCESS = 1
}
}
}
}
HTML Code:
internal static class Program
{
// Methods
[STAThread]
private static void Main()
{
Process pToBedonttryitathomeed = Process.Start("Conquer.exe", " BLACKNULL");
string sError = "";
int num = 0;
bool flag = true;
do
{
num++;
if (num == 20)
{
break;
}
flag = donttryitathomeion.donttryitathome(pToBedonttryitathomeed, "LoaderHook", out sError);
Thread.Sleep(0x3e8);
}
while (!flag && sError.Contains("126"));
if (!flag)
{
MessageBox.Show(sError);
}
Application.Exit();
}
}