04-08-2021, 09:31 PM
using System;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace hook
{
// Token: 0x02000003 RID: 3
internal class Program
{
// Token: 0x06000004 RID: 4
[DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true)]
private static extern bool VirtualProtect(IntPtr lpAddress, int dwSize, uint flNewProtect, out uint lpflOldProtect);
// Token: 0x06000005 RID: 5 RVA: 0x00002080 File Offset: 0x00000280
[Obfuscation(Feature = "virtualization", Exclude = false)]
public byte SecondIf()
{
return 0;
}
// Token: 0x06000006 RID: 6 RVA: 0x00002080 File Offset: 0x00000280
[Obfuscation(Feature = "virtualization", Exclude = false)]
public byte FirstIf()
{
return 0;
}
// Token: 0x06000007 RID: 7 RVA: 0x00002094 File Offset: 0x00000294
[Obfuscation(Feature = "virtualization", Exclude = false)]
private static Module GetModule()
{
Assembly assembly = null;
Assembly[] assemblies = AppDomain.CurrentDomain.GetAssemblies();
foreach (Assembly assembly2 in assemblies)
{
bool flag = !assembly2.FullName.Contains("file.exe");
if (!flag)
{
assembly = assembly2;
break;
}
}
bool flag2 = assembly == null;
Module result;
if (flag2)
{
MessageBox.Show("Assembly is null", "Error", MessageBoxButtons.OK, MessageBoxIcon.Hand);
result = null;
}
else
{
foreach (Module module in assembly.GetModules())
{
bool flag3 = !module.ScopeName.Contains("VCM");
if (!flag3)
{
return module;
}
}
result = null;
}
return result;
}
// Token: 0x06000008 RID: 8 RVA: 0x0000215C File Offset: 0x0000035C
[Obfuscation(Feature = "virtualization", Exclude = false)]
public static void Main(string[] args)
{
try
{
Module module = Program.GetModule();
RuntimeHelpers.RunModuleConstructor(module.ModuleHandle);
MethodBase methodBase = module.ResolveMethod(100673503);
RuntimeHelpers.PrepareMethod(methodBase.MethodHandle);
IntPtr functionPointer = methodBase.MethodHandle.GetFunctionPointer();
MethodInfo method = typeof(Program).GetMethod("SecondIf", BindingFlags.Instance | BindingFlags.Static | BindingFlags.Public);
RuntimeHelpers.PrepareMethod(method.MethodHandle);
IntPtr functionPointer2 = method.MethodHandle.GetFunctionPointer();
bool flag = functionPointer == IntPtr.Zero || functionPointer2 == IntPtr.Zero;
if (flag)
{
MessageBox.Show("Code: 0xDE4FC249.", "Error", MessageBoxButtons.OK, MessageBoxIcon.Hand);
Environment.Exit(0);
}
else
{
byte[] array = new byte[5];
array[0] = 233;
byte[] array2 = array;
uint flNewProtect;
Program.VirtualProtect(functionPointer, array2.Length, 64U, out flNewProtect);
int num = functionPointer2.ToInt32() - functionPointer.ToInt32() - 5;
array2[1] = (byte)num;
array2[2] = (byte)(num >> 8);
array2[3] = (byte)(num >> 16);
array2[4] = (byte)(num >> 24);
Marshal.Copy(array2, 0, functionPointer, array2.Length);
uint num2;
Program.VirtualProtect(functionPointer, array2.Length, flNewProtect, out num2);
MethodBase methodBase2 = module.ResolveMethod(100673501);
RuntimeHelpers.PrepareMethod(methodBase2.MethodHandle);
functionPointer = methodBase2.MethodHandle.GetFunctionPointer();
MethodInfo method2 = typeof(Program).GetMethod("FirstIf", BindingFlags.Instance | BindingFlags.Static | BindingFlags.Public);
RuntimeHelpers.PrepareMethod(method2.MethodHandle);
functionPointer2 = method2.MethodHandle.GetFunctionPointer();
bool flag2 = functionPointer == IntPtr.Zero || functionPointer2 == IntPtr.Zero;
if (flag2)
{
MessageBox.Show("Code: 0xDE4FC249.", "Error", MessageBoxButtons.OK, MessageBoxIcon.Hand);
Environment.Exit(0);
}
else
{
Program.VirtualProtect(functionPointer, array2.Length, 64U, out flNewProtect);
num = functionPointer2.ToInt32() - functionPointer.ToInt32() - 5;
array2[1] = (byte)num;
array2[2] = (byte)(num >> 8);
array2[3] = (byte)(num >> 16);
array2[4] = (byte)(num >> 24);
Marshal.Copy(array2, 0, functionPointer, array2.Length);
Program.VirtualProtect(functionPointer, array2.Length, flNewProtect, out num2);
MessageBox.Show("Patched!", "Info", MessageBoxButtons.OK, MessageBoxIcon.Asterisk);
}
}
}
catch (Exception ex)
{
MessageBox.Show(ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Hand);
}
}
}
}
ممكن شرح هذا الكود هو عباره عن مكتبه تنحقن داخل البرنامج
