ALERT!
Click here to register with a few steps and explore all our cool stuff we have to offer!

Jump to content



Photo

//


  • This topic is locked This topic is locked
//

#1

0VERFL0W
0VERFL0W
    Offline

    VETERAN

  • Posts: 5063
  • Joined: Oct 13, 2016
  • Reputation: 418
  • Likes: 2531
  • Credits: 0
  • Leecher level:-5693 5693

Two years registered
#1

//


  • 0

#2

Germany
Germany
    Offline

    Follow instagram - Twitch Raids @beastraids :cooldoge:

  • Posts: 1577
  • Joined: Sep 04, 2015
  • Reputation: 366
  • Likes: 1960
  • Credits: 3
  • Leecher level:-3089 3089

Three years registered
#2

https://github.com/n.../RemoveSignCode

 

Dunno if this will work.. But. :)


  • 0

3 EUR from hentaidev - funding my gambling addiction.

?url=https%3A%2F%2Fi.imgur.com%2Fn332sKT

 

Donate or get banned :dreamy:

?url=https%3A%2F%2Fstatic-cdn.jtvnw.net%


#3

0VERFL0W
0VERFL0W
    Offline

    VETERAN

  • Posts: 5063
  • Joined: Oct 13, 2016
  • Reputation: 418
  • Likes: 2531
  • Credits: 0
  • Leecher level:-5693 5693

Two years registered
#3

https://github.com/n.../RemoveSignCode

 

Dunno if this will work.. But. :)

will take a look at it thanks :D


  • 0

#4

0VERFL0W
0VERFL0W
    Offline

    VETERAN

  • Posts: 5063
  • Joined: Oct 13, 2016
  • Reputation: 418
  • Likes: 2531
  • Credits: 0
  • Leecher level:-5693 5693

Two years registered
#4

https://github.com/n.../RemoveSignCode

 

Dunno if this will work.. But. :)

Doesnt work :(


  • 0

#5

FuseFire
FuseFire
    Online

    Your Friendly Nulled Coder

  • Posts: 393
  • Joined: Feb 01, 2019
  • Reputation: 82
  • Likes: 432
  • Credits: 0
  • Leecher level:-505 505

#5

Doesnt work :(

Do you mean in dnSpy? 

It basically means it's packed. If thats what you mean with PE Headers


  • 0

>> SPOTIFY UPGRADE BOT <<

GIVES REAL ADDRESS

NO KICKS!

ALWAYS ASK FOR DM! I GOT IMPERSONATED!


#6

jamoofromafrica
jamoofromafrica
    Offline

    Member

  • Posts: 57
  • Joined: Jan 01, 2018
  • Reputation: 0
  • Likes: 4
  • Credits: 0
  • Leecher level:-21 21
One year registered
#6

Do you mean in dnSpy? 

It basically means it's packed. If thats what you mean with PE Headers

he is asking how to remove pe headers, not what they are


  • 0

#7

FuseFire
FuseFire
    Online

    Your Friendly Nulled Coder

  • Posts: 393
  • Joined: Feb 01, 2019
  • Reputation: 82
  • Likes: 432
  • Credits: 0
  • Leecher level:-505 505

#7

he is asking how to remove pe headers, not what they are

If he knows what it is he can just unpack in with a tool from github you retard


  • -1

>> SPOTIFY UPGRADE BOT <<

GIVES REAL ADDRESS

NO KICKS!

ALWAYS ASK FOR DM! I GOT IMPERSONATED!


#8

jamoofromafrica
jamoofromafrica
    Offline

    Member

  • Posts: 57
  • Joined: Jan 01, 2018
  • Reputation: 0
  • Likes: 4
  • Credits: 0
  • Leecher level:-21 21
One year registered
#8

If he knows what it is he can just unpack in with a tool from github you retard

not sure why you are getting mad.


  • 0

#9

EliteEmper0r
EliteEmper0r
    Offline

    Releasing a Shop Soon...

  • PipPipPipPipPipPip
  • Posts: 334
  • Joined: Jun 20, 2018
  • Reputation: 8
  • Likes: 14
  • Credits: 0
  • Leecher level:-117 117

Deal with caution
User has an open scam report.
Half year registered
#9

as FuseFire said PE Headers means the program is packed, if you would like to unpack you can most likely unpack it with MegaDump.


  • 0

#10

Navix
Navix
    Offline

    🌿

  • Posts: 57
  • Joined: Mar 09, 2019
  • Reputation: 1
  • Likes: 60
  • Credits: 0
  • Leecher level:-176 176

#10

The amount of bullshit people post here is ridiculous.

 

Either remove PE headers at runtime using RtlZeroMemory like this

[DllImport("Kernel32.dll", EntryPoint="RtlZeroMemory", SetLastError=false)]
public static extern void ZeroMemory(IntPtr dest, IntPtr size);

[DllImport("kernel32.dll", CharSet=CharSet.Auto)]
public static extern IntPtr GetModuleHandle(string lpModuleName);

[StructLayout(LayoutKind.Sequential)]
public struct IMAGE_DOS_HEADER
{
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)]
    public char[] e_magic;       // Magic number
    public UInt16 e_cblp;    // Bytes on last page of file
    public UInt16 e_cp;      // Pages in file
    public UInt16 e_crlc;    // Relocations
    public UInt16 e_cparhdr;     // Size of header in paragraphs
    public UInt16 e_minalloc;    // Minimum extra paragraphs needed
    public UInt16 e_maxalloc;    // Maximum extra paragraphs needed
    public UInt16 e_ss;      // Initial (relative) SS value
    public UInt16 e_sp;      // Initial SP value
    public UInt16 e_csum;    // Checksum
    public UInt16 e_ip;      // Initial IP value
    public UInt16 e_cs;      // Initial (relative) CS value
    public UInt16 e_lfarlc;      // File address of relocation table
    public UInt16 e_ovno;    // Overlay number
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
    public UInt16[] e_res1;    // Reserved words
    public UInt16 e_oemid;       // OEM identifier (for e_oeminfo)
    public UInt16 e_oeminfo;     // OEM information; e_oemid specific
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)]
    public UInt16[] e_res2;    // Reserved words
    public Int32 e_lfanew;      // File address of new exe header

    private string _e_magic
    {
        get { return new string(e_magic); }
    }

    public bool isValid
    {
        get { return _e_magic == "MZ"; }
    }
}

[StructLayout(LayoutKind.Explicit)]
public struct IMAGE_NT_HEADERS32
{
    [FieldOffset(0)]
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
    public char[] Signature;
    [FieldOffset(4)]
    public IMAGE_FILE_HEADER FileHeader;
    [FieldOffset(24)]
    public IMAGE_OPTIONAL_HEADER32 OptionalHeader;

    private string _Signature
    {
        get { return new string(Signature); }
    }

    public bool isValid
    {
        get { return _Signature == "PE\0\0" && (OptionalHeader.Magic == PE.MagicType.IMAGE_NT_OPTIONAL_HDR32_MAGIC || OptionalHeader.Magic == PE.MagicType.IMAGE_NT_OPTIONAL_HDR64_MAGIC); }
    }
}

[StructLayout(LayoutKind.Sequential)]
public struct IMAGE_FILE_HEADER
{
    public UInt16 Machine;
    public UInt16 NumberOfSections;
    public UInt32 TimeDateStamp;
    public UInt32 PointerToSymbolTable;
    public UInt32 NumberOfSymbols;
    public UInt16 SizeOfOptionalHeader;
    public UInt16 Characteristics;
}

static void RemoveHeaders() {
    var moduleBase = (IntPtr)GetModuleHandle(IntPtr.Zero);

    var dosHeader = new IMAGE_DOS_HEADER();
    Marshal.PtrToStructure(moduleBase, dosHeader);

    var ntHeadersPtr = (IntPtr)(moduleBase + dosHeader.e_lfanew);

    var ntHeaders = new IMAGE_NT_HEADERS32();
    Marshal.PtrToStructure(ntHeadersPtr, ntHeaders);

    UInt32 sizeHeaders = ntHeaders.FileHeader.SizeOfOptionalHeader;
    ZeroMemory(moduleBase, sizeHeaders);
}

Or use a file handle and do the same thing.


  • 0


 Users browsing this thread: