[Release] HP-Tool

11/18/2010 15:13 expo_botter#1

Deutsch:

Spoiler

English:

Spoiler

VT: [Only registered and activated users can see links. Click Here To Register...]

MfG expo_botter

11/18/2010 17:05 WTF-imdoinyamom#2

imo its a waste, if ur running some clients it will directly slow ur pc down

11/18/2010 18:20 expo_botter#3

it don't slow down the PC, it takes like 1-2% more CPU that's all

11/18/2010 18:41 avati#4

That tool needs a lot of investigation. To make an HP tool you need the static pointer of HP address. The only tools on old days that worked for this matter was Cheatengine and some other tools that i cant remember their names. Me and ACE we trie to find a way around to read memory addresses many months now, with no success.If you could share with us your method that would be greatful. Send me pm if you like...
To all of you, who download this tool be careful with what account you log in.
We need some answers first and would be clever not to use it for a while...

Cheers Avati

11/18/2010 20:53 expo_botter#5

This programm isn't a account stealer.
i send you a PN

11/19/2010 01:29 kinq1#6

Well, my avg antivirus find this:
[Only registered and activated users can see links. Click Here To Register...]

...and virustotal find this:
Antivirus Version Last Update Result
AntiVir 7.10.14.38 2010.11.18 TR/Crypt.TPM.Gen
Antiy-AVL 2.0.3.7 2010.11.18 -
Avast 4.8.1351.0 2010.11.18 -
Avast5 5.0.594.0 2010.11.18 -
AVG 9.0.0.851 2010.11.18 Win32/Themida
BitDefender 7.2 2010.11.19 Gen:Trojan.Heur.GM.4000036080
CAT-QuickHeal 11.00 2010.11.09 -
ClamAV 0.96.4.0 2010.11.18 -
Command 5.2.11.5 2010.11.18 -
Comodo 6765 2010.11.18 -
DrWeb 5.0.2.03300 2010.11.19 -
Emsisoft 5.0.0.50 2010.11.18 Gen.Trojan!IK
eSafe 7.0.17.0 2010.11.18 -
eTrust-Vet 36.1.7985 2010.11.18 -
F-Prot 4.6.2.117 2010.11.18 -
F-Secure 9.0.16160.0 2010.11.18 Gen:Trojan.Heur.GM.4000036080
Fortinet 4.2.254.0 2010.11.18 -
Ikarus T3.1.1.90.0 2010.11.18 Gen.Trojan
Jiangmin 13.0.900 2010.11.18 -
K7AntiVirus 9.68.3021 2010.11.18 -
McAfee 5.400.0.1158 2010.11.19 Artemis!95182A336D45
McAfee-GW-Edition 2010.1C 2010.11.18 Artemis!29036CEC034B
NOD32 5631 2010.11.18 Win32/Packed.Themida.AAE
Norman 6.06.10 2010.11.18 -
Panda 10.0.2.7 2010.11.18 Trj/Thed.A
PCTools 7.0.3.5 2010.11.18 -
Prevx 3.0 2010.11.19 -
Rising 22.74.03.05 2010.11.18 -
Sophos 4.59.0 2010.11.19 Mal/Behav-374
SUPERAntiSpyware 4.40.0.1006 2010.11.19 -
TheHacker 6.7.0.1.086 2010.11.18 -
TrendMicro 9.120.0.1004 2010.11.18 -
VIPRE 7347 2010.11.19 Trojan.Win32.Generic!BT
ViRobot 2010.11.18.4155 2010.11.18 -
VirusBuster 13.6.48.0 2010.11.18 -

I dont try to use it

11/19/2010 09:31 ACE-ppc#7

Quote:

Originally Posted by kinq1

Well, my avg antivirus find this:
[Only registered and activated users can see links. Click Here To Register...]

...and virustotal find this:
Antivirus Version Last Update Result
AntiVir 7.10.14.38 2010.11.18 TR/Crypt.TPM.Gen
Antiy-AVL 2.0.3.7 2010.11.18 -
Avast 4.8.1351.0 2010.11.18 -
Avast5 5.0.594.0 2010.11.18 -
AVG 9.0.0.851 2010.11.18 Win32/Themida
BitDefender 7.2 2010.11.19 Gen:Trojan.Heur.GM.4000036080
CAT-QuickHeal 11.00 2010.11.09 -
ClamAV 0.96.4.0 2010.11.18 -
Command 5.2.11.5 2010.11.18 -
Comodo 6765 2010.11.18 -
DrWeb 5.0.2.03300 2010.11.19 -
Emsisoft 5.0.0.50 2010.11.18 Gen.Trojan!IK
eSafe 7.0.17.0 2010.11.18 -
eTrust-Vet 36.1.7985 2010.11.18 -
F-Prot 4.6.2.117 2010.11.18 -
F-Secure 9.0.16160.0 2010.11.18 Gen:Trojan.Heur.GM.4000036080
Fortinet 4.2.254.0 2010.11.18 -
Ikarus T3.1.1.90.0 2010.11.18 Gen.Trojan
Jiangmin 13.0.900 2010.11.18 -
K7AntiVirus 9.68.3021 2010.11.18 -
McAfee 5.400.0.1158 2010.11.19 Artemis!95182A336D45
McAfee-GW-Edition 2010.1C 2010.11.18 Artemis!29036CEC034B
NOD32 5631 2010.11.18 Win32/Packed.Themida.AAE
Norman 6.06.10 2010.11.18 -
Panda 10.0.2.7 2010.11.18 Trj/Thed.A
PCTools 7.0.3.5 2010.11.18 -
Prevx 3.0 2010.11.19 -
Rising 22.74.03.05 2010.11.18 -
Sophos 4.59.0 2010.11.19 Mal/Behav-374
SUPERAntiSpyware 4.40.0.1006 2010.11.19 -
TheHacker 6.7.0.1.086 2010.11.18 -
TrendMicro 9.120.0.1004 2010.11.18 -
VIPRE 7347 2010.11.19 Trojan.Win32.Generic!BT
ViRobot 2010.11.18.4155 2010.11.18 -
VirusBuster 13.6.48.0 2010.11.18 -

I dont try to use it

Hi,
Themida is only a Packer ... so you cant say its an Virus because this.
If i have some time ill decomplie the Autoit Script and check it.

Greez ACE

11/19/2010 12:40 expo_botter#8

The AutoIt GUI isn't that complicate

Spoiler

PHP Code:


			
#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_icon=..\Desktop\small.ico
#AutoIt3Wrapper_outfile=..\Desktop\HP-Tool\HP-Tool.exe
#AutoIt3Wrapper_UseUpx=n
#AutoIt3Wrapper_Res_Comment=HP-Tool
#AutoIt3Wrapper_Res_Description=HP-Tool
#AutoIt3Wrapper_Res_Fileversion=0.0.0.0
#AutoIt3Wrapper_Res_LegalCopyright=expo_botter
#AutoIt3Wrapper_Res_Language=1031
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
Opt("TrayMenuMode",1)
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <StaticConstants.au3>
#include <WindowsConstants.au3>
#include <GuiComboBox.au3>
#include <File.au3>
#include <Array.au3>
#include <WindowsConstants.au3>
#include <GuiConstantsEx.au3>
#include <ButtonConstants.au3>
#include <misc.au3>
$Ja = @ScriptDir & "\Pics\Pic1.jpg"
$Nein = @ScriptDir & "\Pics\Pic2.jpg"
$Check = @ScriptDir & "\Pics\Pic3.jpg"
Global $Weiter = 0
Global $Form1 = GUICreate("Vorbereitung", 354, 530, -1,-1)
GUISetBkColor(0xFFFFFF,$Form1)
$Pic1 = GUICtrlCreatePic($Check, 8, 8, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label1 = GUICtrlCreateLabel("Als Administrator gestartet", 56, 14, 188, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic2 = GUICtrlCreatePic("", 8, 56, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label2 = GUICtrlCreateLabel("Warte auf Archlord-Patcher (Archlord.exe)", 56, 110, 293, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic3 = GUICtrlCreatePic("", 8, 104, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label3 = GUICtrlCreateLabel("Warte auf Client (alefclient.exe)", 56, 158, 219, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic4 = GUICtrlCreatePic("", 8, 152, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label4 = GUICtrlCreateLabel("Injection der DLL (Errorcode = )", 56, 206, 286, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic5 = GUICtrlCreatePic("", 8, 200, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label5 = GUICtrlCreateLabel("Warte auf Antwort der DLL", 56, 254, 188, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic6 = GUICtrlCreatePic("", 8, 248, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label6 = GUICtrlCreateLabel("Teste Kommunikation von DLL und EXE", 56, 302, 283, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic7 = GUICtrlCreatePic("", 8, 296, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label7 = GUICtrlCreateLabel("Warte auf Login", 56, 398, 119, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
Global $Button1 = GUICtrlCreateButton("Suche die Addresse", 184, 396, 115, 25, $WS_GROUP)
$Pic8 = GUICtrlCreatePic("", 8, 344, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label8 = GUICtrlCreateLabel("Warte auf Antwort der DLL", 56, 446, 188, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic9 = GUICtrlCreatePic("", 8, 392, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label9 = GUICtrlCreateLabel("Pr�fe Nutzungsrechte", 56, 350, 226, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic10 = GUICtrlCreatePic("", 8, 440, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label10 = GUICtrlCreateLabel("HP-Tool made by expo_botter", 56, 62, 229, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic11 = GUICtrlCreatePic("", 8, 488, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label11 = GUICtrlCreateLabel("Fertig", 56, 494, 45, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
GUISetState(@SW_SHOW)
GUICtrlSetState($Button1,$GUI_DISABLE)
AdlibEnable("GUI",40)

If Not IsAdmin() Then
    GUICtrlSetImage($Pic1,$Nein)
    While 1
        Sleep(10)
    WEnd
EndIf

GUICtrlSetImage($Pic1,$Ja)
GUICtrlSetImage($Pic2,$Ja)

GUICtrlSetImage($Pic3,$Check)

While Not ProcessExists("Archlord.exe")
    Sleep(10)
WEnd

GUICtrlSetImage($Pic3,$Ja)


GUICtrlSetImage($Pic4,$Check)
If Not FileExists(@WindowsDir & "\system32\d3dx9_43.dll") Then FileCopy(@ScriptDir & "\d3dx9_43.dll",@WindowsDir & "\system32\d3dx9_43.dll",1)

While Not ProcessExists("alefclient.exe")
    Sleep(10)
WEnd

GUICtrlSetImage($Pic4,$Ja)

_INJECTDLL(ProcessExists("alefclient.exe"), @ScriptDir & "\alefclient.dll")
$err = @error
If $err = 0 Then
    $Pfad = @TempDir & "\Dat.dat"
    IniWrite($Pfad,"Status","Start","0")
    IniWrite($Pfad,"Status","Test","1")
    IniWrite($Pfad,"Status","Suchen","0")
    IniWrite($Pfad,"Status","TestEnde","0")
    IniWrite($Pfad,"Status","Login","2")
    Sleep(100)
    GUICtrlSetData($Label4,"Injection der DLL (Errorcode = " & $err & ")")
    GUICtrlSetImage($Pic5,$Ja)
Else
    GUICtrlSetData($Label4,"Injection der DLL (Errorcode = " & $err & ")")
    GUICtrlSetImage($Pic5,$Nein)
    While 1
        Sleep(10)
    WEnd
EndIf

$T = TimerInit()
Do
    Sleep(10)
    $Read = IniRead($Pfad,"Status","Start",0)
Until TimerDiff($T) > 5000 Or $Read = 1

If $Read = 0 Then
    GUICtrlSetImage($Pic6,$Nein)
    While 1
        Sleep(10)
    WEnd
Else
    GUICtrlSetImage($Pic6,$Ja)
    GUICtrlSetImage($Pic7,$Check)
EndIf
$T2 = TimerInit()
Do
    Sleep(10)
Until IniRead($Pfad,"Status","Test","1") = "2" Or TimerDiff($T2) > 6200

Do
    Sleep(10)
    IniWrite($Pfad,"Status","TestEnde","1")
Until IniRead($Pfad,"Status","Test","1") = "3" Or TimerDiff($T2) > 6200

If TimerDiff($T2) > 6100 Then
    GUICtrlSetImage($Pic7,$Nein)
    While 1
        Sleep(10)
    WEnd
Else
    GUICtrlSetImage($Pic7,$Ja)
EndIf

GUICtrlSetImage($Pic8,$Check)

Do
    Sleep(100)
    $Read = IniRead($Pfad,"Status","Login","2")
Until $Read <> "2"

If $Read = "1" Then
    GUICtrlSetImage($Pic8,$Ja)
    GUICtrlSetImage($Pic9,$Check)
Else
    GUICtrlSetImage($Pic8,$Nein)
    While 1
        Sleep(10)
    WEnd
EndIf
GUICtrlSetState($Button1,$GUI_ENABLE)
While $Weiter = 0
    Sleep(10)
WEnd
GUICtrlSetImage($Pic9,$Ja)
GUICtrlSetImage($Pic10,$Check)

IniWrite($Pfad,"Status","Suchen","1")

Do
    $Read = IniRead($Pfad,"Status","Suchen","1")
    Sleep(10)
Until $Read <> "1"

If $Read = "2" Then
    GUICtrlSetImage($Pic10,$Ja)
    GUICtrlSetImage($Pic11,$Check)
    Sleep(3000)
    GUICtrlSetImage($Pic11,$Ja)
Else
    GUICtrlSetImage($Pic10,$Nein)
    While 1
        Sleep(10)
    WEnd
EndIf

Func GUI()
    $nMsg = GUIGetMsg()
    Switch $nMsg
        Case $GUI_EVENT_CLOSE
            Exit
        Case $Button1
            $Weiter = 1
    EndSwitch
EndFunc

Func _INJECTDLL($PID, $DLLPATH)
    If $PID = 0 Then
        SetError(-1)
        Return False
    ElseIf StringLen($DLLPATH) <= 4 Or StringRight($DLLPATH, 4) <> ".dll" Then
        SetError(-2)
        Return False
    EndIf
    If Not FileExists($DLLPATH) Then
        SetError(-3)
        Return False
    EndIf
    Local $PHANDLE, $PLIBREMOTE, $MODHANDLE, $LOADLIBRARYA, $HTHREAD
    Local $KERNEL32 = DllOpen("kernel32.dll")
    $PHANDLE = DllCall($KERNEL32, "int", "OpenProcess", "int", 2035711, "int", 0, "int", $PID)
    If IsArray($PHANDLE) And $PHANDLE[0] > 0 Then
        $PHANDLE = $PHANDLE[0]
    Else
        SetError(-4)
        Return False
    EndIf
    $PLIBREMOTE = DllCall($KERNEL32, "int", "VirtualAllocEx", "int", $PHANDLE, "short", 0, "int", 4096, "int", 4096, "int", 4)
    If IsArray($PLIBREMOTE) Then
        If $PLIBREMOTE[0] > 0 Then
            ConsoleWrite("0x" & Hex($PLIBREMOTE[0], 8) & @CR)
            $PLIBREMOTE = $PLIBREMOTE[0]
        Else
            SetError(-5)
            Return False
        EndIf
    Else
        SetError(-6)
        Return False
    EndIf
    For $I = 0 To StringLen($DLLPATH)
        $RET = DllCall("kernel32.dll", "int", "WriteProcessMemory", "int", $PHANDLE, "int", $PLIBREMOTE + $I, "ptr*", Asc(StringMid($DLLPATH, $I + 1, 1)), "int", 1, "int", 0)
        If IsArray($RET) Then
            If $RET[0] = 0 Then
                SetError(-7)
                Return False
            EndIf
        Else
            SetError(-8)
            Return False
        EndIf
    Next
    $MODHANDLE = DllCall($KERNEL32, "long", "GetModuleHandle", "str", "kernel32.dll")
    If IsArray($MODHANDLE) Then
        If $MODHANDLE[0] > 0 Then
            $MODHANDLE = $MODHANDLE[0]
        Else
            SetError(-9)
            Return False
        EndIf
    Else
        SetError(-10)
        Return False
    EndIf
    $LOADLIBRARYA = DllCall($KERNEL32, "long", "GetProcAddress", "long", $MODHANDLE, "str", "LoadLibraryA")
    If IsArray($LOADLIBRARYA) Then
        If $LOADLIBRARYA[0] > 0 Then
            $LOADLIBRARYA = $LOADLIBRARYA[0]
        Else
            SetError(-11)
            Return False
        EndIf
    Else
        SetError(-12)
        Return False
    EndIf
    $HTHREAD = DllCall($KERNEL32, "int", "CreateRemoteThread", "int", $PHANDLE, "int", 0, "int", 0, "long", $LOADLIBRARYA, "long", $PLIBREMOTE, "int", 0, "int", 0)
    If IsArray($HTHREAD) Then
        ConsoleWrite($HTHREAD[0] & @CR)
        If $HTHREAD[0] > 0 Then
            $HTHREAD = $HTHREAD[0]
        Else
            SetError(-13)
            Return False
        EndIf
    Else
        SetError(-14)
        Return False
    EndIf
    DllCall($KERNEL32, "int", "VirtualFreeEx", "int", $PHANDLE, "int", $PLIBREMOTE, "int", 4096, "int", 32768)
    DllCall($KERNEL32, "int", "CloseHandle", "int", $HTHREAD)
    DllCall($KERNEL32, "int", "CloseHandle", "int", $PHANDLE)
    DllClose($KERNEL32)
    Return True
EndFunc   ;==>_INJECTDLL

11/19/2010 13:08 Stuntman01#9

Expo_botter is that app written just in AutoIT???