Jump to content
Tuts 4 You

All Activity

This stream auto-updates

  1. Today
  2. modz50

    ConfuserEx 1.6.0

    modz50 replied to cipsi's topic in UnPackMe (.NET)

    yes you call it inside a assembly loader app
  3. Don Reverso
    Don Reverso joined the community
  4. CyberGod started following SReg
  5. Samrock
    Samrock joined the community
  6. Ciberrus
    Ciberrus joined the community
  7. watchoutz
    watchoutz joined the community
  8. LCF-AT
    Thanks again but I would like using IDM with my file name instead of using browser download itself. Just bad that its not possible so far. Anyway, I will try to continue testing the code. Thanks for helping @Kanes, I'm pretty sure next questions will come soon. greetz
  9. Kanes
    From what I see it's not possible because IDM captures the download at the network level. you can try using fetch with a Blob to prevent IDM from intercepting <!DOCTYPE html> <html> <body> <script> let link_to_DL = "https://www.w3schools.com/html/mov_bbb.mp4"; let title = "Test Title.mp4"; let input = document.createElement("input"); input.type = "button"; input.value = link_to_DL; input.onclick = () => download(link_to_DL, title); document.body.appendChild(input).style.cursor = "pointer"; function download(fileURL, fileName) { fetch(fileURL) .then(res => res.blob()) .then(blob => { const a = document.createElement('a'); a.href = URL.createObjectURL(blob); a.download = fileName; a.click(); URL.revokeObjectURL(a.href); }) .catch(err => alert("Download error: " + err)); } </script> </body> </html>
  10. LCF-AT
    OK thanks again for checking that. Seems that it works now but I have still a problem. I'm using a download manager IDM and this is not showing my custom name to save it and still uses the path file name "mov_bbb.mp4". If I disable IDM then it works and the browser does download the file with my custom "Test Title.mp4" name. Do you have a clue how to make it work that IDM uses my title name? greetz
  11. Kanes
    Your code is actually correct, the issue isn't in the implementation itself but in the server's security policy. you're trying to download a resource from a different origin (cross-origin), and the server you're requesting it from has CORS restrictions or does not allow forced downloads via the Content-Disposition header Try Here: https://www.w3schools.com/js/tryit.asp?filename=tryjs_intro_inner_html <!DOCTYPE html> <html> <body> <script> let link_to_DL = "https://www.w3schools.com/html/mov_bbb.mp4"; let title = "Test Title.mp4" let input=document.createElement("input"); input.type="button"; input.value=link_to_DL; input.onclick = () => download(link_to_DL, title); document.body.appendChild(input).style.cursor = "pointer"; function download(URL, TITLE) { const a = document.createElement('a'); a.href = URL; a.download = TITLE; a.click(); } </script> </body> </html>
  12. LCF-AT
    @Kanes Thanks for the code examples but it still does not work yet to use my string. Also if I test your code on.. https://jsfiddle.net/ ...then it will use the "mov_bbb.mp4" filename and not "Anystring.mp4". Just test it. My code is like this you can also test... let link_to_DL = "https://www.w3schools.com/html/mov_bbb.mp4"; let title = "Test Title.mp4" let input=document.createElement("input"); input.type="button"; input.value=link_to_DL; input.onclick = () => download(link_to_DL, title); document.body.appendChild(input).style.cursor = "pointer"; function download(URL, TITLE) { const a = document.createElement('a'); a.href = URL; a.download = TITLE; a.click(); } ...just JS code only. Its still using the "mov_bbb.mp4" name and not my title. greetz
  13. Yesterday
  14. Kanes
    @LCF-AT You can use the <a> download attribute <a href="/images/myw3schoolsimage.jpg" download="w3logo"> <button onclick="download()">Download</button> <script> function download() { const a = document.createElement('a'); a.href = "https://www.w3schools.com/images/myw3schoolsimage.jpg"; a.download = "Anystring.jpg"; a.click(); } </script> <source id="file123" src="https://www.w3schools.com/html/mov_bbb.mp4"> <button onclick="download()">Download</button> <script> function download() { const a = document.createElement('a'); a.href = document.getElementById('file123').src; a.download = "Anystring.mp4"; a.click(); } </script> https://www.w3schools.com/tags//att_a_download.asp
  15. LCF-AT
    So I have another small question. I wrote a script to fetch a direct link to a file I can download like this... <source src="https://some_url.com/12345.pdf" ...> ...and if I execute it then it will download the file or download window does popup to save the file with the file name "12345.pdf". My question is how can I customize the file name it should use to download the file? Instead of using the original file name I would give it a other name. DOWNLOAD - BUTTON <-- I made what does execute the src URL and now I want to give it a other file name or tell the button / event using XY file name instead. Is that doable? I'm using the window.open(url) to execute the URL on button click but in API description it seems not doable to set a name for the file itself etc. Do you have any clue how to make it work? greetz
  16. akaded
    akaded joined the community
  17. Booking
    Booking joined the community
  18. Luca91
    Thank you, I’ll definitely read it tonight! RIP Mark Ludwig 🪦 I still have his “The little black book of computer viruses” on my bedside table, bought from Amazon US more than 15 years ago!
  19. lovejoy226 started following Polymorphic Parasite (x86) WriteUp
  20. JMC31337
    i may banter a lil in the opening, but that is how i was taught when i was in highschool learning ASM from the ukranians and russians, bootkits from the chinese You give a short shoutout or point to be made and ya write and code Here, i use the LCRN (LCG) from the GiantBlack Book of Viruses (Physicist Dr. Mark Ludwig) and his 16-bit many hoops and recreated it for x86 (32 bit) VXWriteUp.pdf
  21. jackyjask

    ConfuserEx 1.6.0

    jackyjask replied to cipsi's topic in UnPackMe (.NET)

    loader not enough you need to call dll API
  22. UserNasNasNasNas
    UserNasNasNasNas joined the community
  23. modz50

    ConfuserEx 1.6.0

    modz50 replied to cipsi's topic in UnPackMe (.NET)

    no create an assembly loader to load the dll and then use dnspy and the rest
  24. Luca91
    Nice example @jackyjask Yes, assuming you have a way to load the unsigned driver (by exploiting a signed driver that is not black listed, or by running NT in test mode) and you are calling these APIs from the driver itself, this should work. I never tried it personally tho. So I’m not 100% sure and there could be further hitches.
  25. jackyjask

    ConfuserEx 1.6.0

    jackyjask replied to cipsi's topic in UnPackMe (.NET)

    you can't debug dll find exe that runs you dll
  26. kenvevn

    ConfuserEx 1.6.0

    kenvevn replied to cipsi's topic in UnPackMe (.NET)

    i have file ConfuserEx 1.6.0 . but it not exe only file .dll . how to do dubug
  27. pavisethi
    pavisethi joined the community
  28. nanasi0807 started following dongthuc123
  29. jackyjask
    ZwOpenSection/ZwQuerySection eg
  30. nanasi0807
    nanasi0807 joined the community
  31. lovejoy226 started following ByUndefined Protector V3
  32. lovejoy226 started following ByUndefined Protector V3
  33. Last week
  34. Leopar36

    ByUndefined Protector V3

    Leopar36 posted a topic in UnPackMe (.NET)

    View File ByUndefined Protector V3 ByUndefined Protector V3 Anti Debugger Anti Dump Anti Tamper Anti Memory Anti Dll Inject Anti ILDasm Resources Compress String Encrypt ControlFlow Virtualization Renamer Virtualization Updated Task: Unpack Submitter Leopar36 Submitted 04/03/2025 Category UnPackMe (.NET)  
  35. Luca91 started following [Technical Paper] GanDiao.sys (ancient kernel driver based malware)
  36. Luca91
    Yeah that’s the reason (and this is why I doubt in the first place that exploiting a “bring your own vulnerable driver” attack would succeed on recent NT versions, without at least a way to disable/bypass ASLR). That wasn’t a problem in XP tho, as ASRL have been introduced starting form Vista. Anyway I’m pretty sure that more advanced rootkits of that time, used to dynamically calculate these addresses.
  37. jackyjask
    but it's weird to have the same contant addr even between reboots? seems ASLr was introduced later on... ?
  38. Leopar36

    ByUndefined Protector V3

    Leopar36 posted a file in UnPackMe (.NET)

    More information about "ByUndefined Protector V3"

    4 downloads

    ByUndefined Protector V3 Anti Debugger Anti Dump Anti Tamper Anti Memory Anti Dll Inject Anti ILDasm Resources Compress String Encrypt ControlFlow Virtualization Renamer Virtualization Updated Task: Unpack
  39. Luca91
    Hi Jacky, nope, on my XP sp3 VM the correct base address is 0x7C910000. In fact I had to patch GanDiao to strictly use that address, but eventually I figured out that it still managed to unmap ntdll even using that address (because is still part of the that memory region).
  40. jackyjask
    @Luca91 nice wite up, thanks! quick question: >0x7C920000 is the base address of ntdll.dll! is it the same on all other OSes as well? or just WinXP Sp3 32bit and thats it?
  41. Luca91
    Yeah, it is not a "clean" process termination. The process will just crash. It is more an "instant crash" at the next ntdll memory access. Your code using ZwTerminateProcess is a much cleaner approach. After finishing this paper, I was wondering if such a driver can still be loaded on recent NT using a "bring your own vulnerable driver" attack. I don't have time to test it in one of my VMs right now... @boot may ask you a favor? Since you (apparently) are form China, can you confirm that my translation of the word "GanDiao" is actually accurate? ("Get rid of" / "Kill it"). Many thanks.
  42. al5n0 started following lovejoy226
  43. MrPoison404

    ARTeam Tutorials

    MrPoison404 commented on Teddy Rogers's file in Website Archives

    download link not working
  44. boot
    Except for using MmUnmapViewOfSection to cause other processes to crash. We can also use ZwTerminateProcess to kill a specified process, which may still be effective in some versions of Win10... e.g. Code snippets taken from an old project NTSTATUS ZwKillProcess(HANDLE pid) { HANDLE hProcess = NULL; CLIENT_ID ClientId; OBJECT_ATTRIBUTES oa; NTSTATUS status; ClientId.UniqueProcess = pid; ClientId.UniqueThread = 0; oa.Length = sizeof(oa); oa.RootDirectory = 0; oa.ObjectName = 0; oa.Attributes = 0; oa.SecurityDescriptor = 0; oa.SecurityQualityOfService = 0; status = ZwOpenProcess(&hProcess, 1, &oa, &ClientId); if (NT_SUCCESS(status)) { DbgPrint("OpenProcess success,pid: %d", hProcess); ZwTerminateProcess(hProcess, 0); ZwClose(hProcess); return status; }; DbgPrint("OpenProcess failed,pid: %d", hProcess); return FALSE; }
  1. Load more activity
×
×
  • Create New...