Binder (2 exes in one)

[TheLord]

This source of simple binder.
It seek "---HACKERS_CUT_HERE---" and load all bytes past this text. Then xoring it with 0xFF + pos key. When deciphering is done, starts new process, system32/lsass.exe, frozing it, load EP from EAX and clear all process memory. After this, writing deciphered bytes to lsass process and replacing EAX with his own entrypoint address. Dont work when binded exe is non-ASLR on ASLR systems.

This method is called thread inject or something similiar.

 

Hidden Content
You'll be able to see the hidden content once you reply to this topic or

Please Login or Register to see this Hidden Content

.

[rambo 5]

wow nice thanks

[pruned_14736011]

thanks a lot

[m.willys]

thanks a lot

[pruned_1821534]

THANKS

[rer1001]

THANK YOU VERY GOOD

[ggnoobs]

This source of simple binder.
It seek "---HACKERS_CUT_HERE---" and load all bytes past this text. Then xoring it with 0xFF + pos key. When deciphering is done, starts new process, system32/lsass.exe, frozing it, load EP from EAX and clear all process memory. After this, writing deciphered bytes to lsass process and replacing EAX with his own entrypoint address. Dont work when binded exe is non-ASLR on ASLR systems.

This method is called thread inject or something similiar.

 

nice photo

[notcomments]

TNAKS!

[marijuana]

thx

[yoshino]

thanks