(06-04-2021, 12:28 PM)hmzahf كتب : تفضل:

https://drive.google.com/file/d/1kuq_l_BQbtCo3BNlSWqFMWLdwzZa4Ns_/view?usp=sharing

---

creating loader
https://www.youtube.com/watch?v=t0nAECgx7cw

 
https://www.at4re.net/f/thread-561.html 
https://www.at4re.net/f/thread-2510.html?highlight=loader 

(10-04-2021, 06:44 PM)ROZBUD كتب : شكرا جزيلا أخي TeRcO ولكن لا خبرة عندي في دلفي أو الماسم.
كنت أتمني أن أجد الشيئ نفسه ولكن على VB  أو #C

 C++:
#include <iostream>
#include <windows.h>
using namespace std;
int main(){
    STARTUPINFO sinfo; //ستركشر الستارت اب انفورماشين
    PROCESS_INFORMATION pinfo; // ستركشر البروسيس انفورماشين
    HANDLE hproc; // متغير من نوع هاندل ليحمل قيمة المقبض للعملية
    ZeroMemory(&sinfo,sizeof(sinfo)); // تصفير اول ستركشر
    sinfo.cb = sizeof(sinfo); //The size of the structure, in bytes
    ZeroMemory(&pinfo,sizeof(pinfo));  //تصفير ثاني ستركشر
    LPSTR t1 = "example.exe"; //مسار الملف
    int base1 = 0x00403000;  //العنوان الذي نريد الكتابة عنده
    BYTE tr[4] = {0x67,0x6f,0x6f,0x64};  //البايتات التي نريد كتابتها كمصفوفة
    if (CreateProcess(t1,NULL,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&sinfo,&pinfo)){  // انشاء اسشسيلعملية وبداخل شرط بحيث اذا كان هناك خطأ و ادت بصفر سترسل رسالة خطأ و اذا نجحت ستقوم بالكتابة
 
        WriteProcessMemory(pinfo.hProcess,(BYTE*)base1,tr,4,NULL); //دالة الكتابة بالذاكرة
        ResumeThread(pinfo.hThread); //ارجاع العملية للعمل بعد التعديل
        cout << "done" <<endl;
system("pause");
    }else{
    cout << "wrong in creating" <<endl;
system("pause");  
}
 
   return 0;
}

 C#:
Imports System.Runtime.InteropServices

Module Main
    'THE CREATE PROCESS API FUNCTION
    <DllImport("kernel32.dll")> _
    Function CreateProcess( _
    ByVal lpApplicationName As String, _
    ByVal lpCommandLine As String, _
    ByRef lpProcessAttributes As SECURITY_ATTRIBUTES, _
    ByRef lpThreadAttributes As SECURITY_ATTRIBUTES, _
    ByVal bInheritHandles As Boolean, _
    ByVal dwCreationFlags As UInt32, _
    ByVal lpEnvironment As IntPtr, _
    ByVal lpCurrentDirectory As String, _
    <[In]()> ByRef lpStartupInfo As STARTUPINFO, _
    <[Out]()> ByRef lpProcessInformation As PROCESS_INFORMATION) As Boolean
    End Function
    'WRITE PROCESS API FUNCTION
    <DllImport("kernel32.dll", SetLastError:=True)> _
    Public Function WriteProcessMemory(
    ByVal hProcess As IntPtr,
    ByVal lpBaseAddress As IntPtr,
    ByVal lpBuffer As Byte(),
    ByVal nSize As Int32,
    <Out()> ByRef lpNumberOfBytesWritten As IntPtr) As Boolean
    End Function
    'TERMINATE PROCESS API FUNCTION
    Public Function TerminateProcess(ByVal hProcess As IntPtr, _
      ByVal uExitCode As UInteger) As Boolean
    End Function
    'RESUME THREAD API FUNCTION
    <DllImport("kernel32.dll")> _
    Function ResumeThread(ByVal hThread As IntPtr) As UInt32
    End Function


    Sub main()
        'Structures
        Dim proc_info As PROCESS_INFORMATION = New PROCESS_INFORMATION()
        Dim proc_startup As STARTUPINFO = New STARTUPINFO()
        'End of the structures
        Dim file_path As String = System.IO.Directory.GetCurrentDirectory &"\example.exe"'path of the file we want to patch it
        Dimbase() As Integer = {&H403000} 'Address where you want to write// here the address is 0x00403000
        Dim byte_to_write As Byte() = {&H67, &H6F, &H6F, &H64} 'The buffer you want to write
        Dim siz As Integer = byte_to_write.Length 'buffer size
        Dim result As Boolean = CreateProcess(file_path, Nothing, Nothing, Nothing, False, 4, IntPtr.Zero, Nothing, proc_startup, proc_info) 'number 4 hererisforCREATE_SUSBENDED
        If result = False Then
            MsgBox("worng in create process")
        ElseIf result = True Then
            MsgBox("okay let's write something ^_*")

            Dim result1 As Boolean = WriteProcessMemory(proc_info.hProcess,base(0), byte_to_write, siz, 0) '(process handle,the address,the buffer,size of the buffer,the writen buffer)
            If result1 = False Then
                MsgBox("wrong in writing process memory")
                TerminateProcess(proc_info.hProcess, 0)'end every thing and let's runaway 0_o
            End If
            ResumeThread(proc_info.hThread) 'resume thread because we create the process susbended
        End If
    End Sub


End Module
'STARTUP_INFORMATION AND PROCESS_INFORMATION STRUCTURES
<StructLayout(LayoutKind.Sequential)> _
Public Structure PROCESS_INFORMATION          'PROCESS_INFORMATION STRUCTURE
    Public hProcess As IntPtr
    Public hThread As IntPtr
    Public dwProcessID As UInteger
    Public dwThreadID As UInteger
End Structure

<StructLayout(LayoutKind.Sequential)> _
Public Structure STARTUPINFO                    'PROCESS_STARTUP_INFORMATION

    Public cb As UInteger
    Public lpReserved As String
    Public lpDesktop As String
    Public lpTitle As String
    Public dwX As UInteger
    Public dwY As UInteger
    Public dwXSize As UInteger
    Public dwYSize As UInteger
    Public dwXCountChars As UInteger
    Public dwYCountChars As UInteger
    Public dwFillAttribute As UInteger
    Public dwFlags As UInteger
    Public wShowWindow As Short
    Public cbReserved2 As Short
    Public lpReserved2 As IntPtr
    Public hStdInput As IntPtr
    Public hStdOutput As IntPtr
    Public hStdError As IntPtr

End Structure

https://www.dev-point.com/vb/threads/681862/#post-6843201