+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: Visual Basic & .NET Framework (https://sinister.li/Forum-Visual-Basic-NET-Framework)
+--- Thread: Anti Avast 5 SandBox Example C++ (/Thread-Anti-Avast-5-SandBox-Example-C)
RE: Anti Avast 5 SandBox Example [VB5/6/C#,VB.NET] - NiTrOwow - 04-14-2013
(04-12-2013, 06:20 AM)Psycho_Coder Wrote: Can you explain this a bit , I didn't get much in my head , but I know its something cool
GetModuleHandle is when it gets the 'handle' of the library being injected in the process itself. This is automatically injected. What means it will ask where it can be injected in what place in the memory etc.
Manual injection is when it injects the library in a randomly chose place or address (Not really 100% sure).
Have a look at this.
http://syprog.blogspot.com/2011/12/executable-code-injection-interesting.html
And as you may know cheats always use manual injection to not get found that easy. That is manually mapped and
Here are a few common ways of injecting.
- Standard(Automatic injection) – This is the injection technique used in nearly every injector out there. It uses CreateRemoteThread and LoadLibrary and is the most reliable injection technique.
- LdrLoadDll Stub – This is similar to the Standard injection technique except it goes 1 level deeper into LoadLibrary.
- Thread Hijacking – This was the “Alt” injection techinique. It is pretty stable and is not used by many injectors.
- Manual Map – This is the most secure injection technique. So secure that even Windows won’t even know about the injected DLL.
This injection technique may have problems with hacks that are packed with a packer so try another method if this doesn’t work.
So for a sandbox that does have to work with like any PE it uses Standard(Automatic injection). They can instead use other methods but they chosen to use the automatic way what makes it possible for us to see what gets injected.
RE: Anti Avast 5 SandBox Example [VB5/6/C#,VB.NET] - NiTrOwow - 04-14-2013
(04-12-2013, 06:20 AM)Psycho_Coder Wrote: Can you explain this a bit , I didn't get much in my head , but I know its something cool
GetModuleHandle is when it gets the 'handle' of the library being injected in the process itself. This is automatically injected. What means it will ask where it can be injected in what place in the memory etc.
Manual injection is when it injects the library in a randomly chose place or address (Not really 100% sure).
Have a look at this.
http://syprog.blogspot.com/2011/12/executable-code-injection-interesting.html
And as you may know cheats always use manual injection to not get found that easy. That is manually mapped and
Here are a few common ways of injecting.
- Standard(Automatic injection) – This is the injection technique used in nearly every injector out there. It uses CreateRemoteThread and LoadLibrary and is the most reliable injection technique.
- LdrLoadDll Stub – This is similar to the Standard injection technique except it goes 1 level deeper into LoadLibrary.
- Thread Hijacking – This was the “Alt” injection techinique. It is pretty stable and is not used by many injectors.
- Manual Map – This is the most secure injection technique. So secure that even Windows won’t even know about the injected DLL.
This injection technique may have problems with hacks that are packed with a packer so try another method if this doesn’t work.
So for a sandbox that does have to work with like any PE it uses Standard(Automatic injection). They can instead use other methods but they chosen to use the automatic way what makes it possible for us to see what gets injected.
RE: Anti Avast 5 SandBox Example [VB5/6/C#,VB.NET] - ArkPhaze - 04-15-2013
@NiTrOwow - You aren't even using the Win32 function for VB.net and C#, you're using the methods wrapped in the System.Diagnostics.Process class, so why put them in the thread?
RE: Anti Avast 5 SandBox Example [VB5/6/C#,VB.NET] - ArkPhaze - 04-15-2013
@NiTrOwow - You aren't even using the Win32 function for VB.net and C#, you're using the methods wrapped in the System.Diagnostics.Process class, so why put them in the thread?
RE: Anti Avast 5 SandBox Example [VB5/6/C#,VB.NET] - NiTrOwow - 04-21-2013
(04-15-2013, 07:30 AM)ArkPhaze Wrote: @NiTrOwow - You aren't even using the Win32 function for VB.net and C#, you're using the methods wrapped in the System.Diagnostics.Process class, so why put them in the thread?
I have not written those functions. A friend did.
VB.NET is crap for such things and don't know about C#.
RE: Anti Avast 5 SandBox Example [VB5/6/C#,VB.NET] - ArkPhaze - 04-22-2013
(04-21-2013, 12:59 PM)NiTrOwow Wrote:(04-15-2013, 07:30 AM)ArkPhaze Wrote: @NiTrOwow - You aren't even using the Win32 function for VB.net and C#, you're using the methods wrapped in the System.Diagnostics.Process class, so why put them in the thread?
I have not wrote those functions. A friend did.
VB.NET is crap for such things and don't know about C#.
VB.NET is the same as C# (and vice versa if you want to word that differently). How is VB.NET crap? It's better than VB6. I have yet to see someone have a good reason for saying VB6 is better than VB.NET (most likely because unfortunately there is none). Less dependencies is not a good reason either, because it's really invalid if people really think about that.
RE: Anti Avast 5 SandBox Example [VB5/6/C#,VB.NET] - Coder-san - 04-22-2013
(04-22-2013, 05:13 AM)ArkPhaze Wrote: [...]
VB.NET is the same as C# (and vice versa if you want to word that differently). How is VB.NET crap? It's better than VB6. I have yet to see someone have a good reason for saying VB6 is better than VB.NET (most likely because unfortunately there is none). Less dependencies is not a good reason either, because it's really invalid if people really think about that.
One good reason I can think of is that it's very useful for Finance students like me because Excel macros use it. Other than that not so much. I was a "hardcore" VB6 programmer, but VB.Net makes life easier. And I'm not even going to multi-threading, etc.
RE: Anti Avast 5 SandBox Example [VB5/6/C#,VB.NET] - ArkPhaze - 04-22-2013
(04-22-2013, 08:21 AM)Coder-san Wrote:(04-22-2013, 05:13 AM)ArkPhaze Wrote: [...]
VB.NET is the same as C# (and vice versa if you want to word that differently). How is VB.NET crap? It's better than VB6. I have yet to see someone have a good reason for saying VB6 is better than VB.NET (most likely because unfortunately there is none). Less dependencies is not a good reason either, because it's really invalid if people really think about that.
One good reason I can think of is that it's very useful for Finance students like me because Excel macros use it. Other than that not so much. I was a "hardcore" VB6 programmer, but VB.Net makes life easier. And I'm not even going to multi-threading, etc.
I noticed it was pretty much the same as VBA. But that's not a reason for VB6 > VB.NET when it comes to desktop software.
RE: Anti Avast 5 SandBox Example [VB5/6/C#,VB.NET] - Fredjes - 04-29-2013
(04-21-2013, 12:59 PM)NiTrOwow Wrote:(04-15-2013, 07:30 AM)ArkPhaze Wrote: @NiTrOwow - You aren't even using the Win32 function for VB.net and C#, you're using the methods wrapped in the System.Diagnostics.Process class, so why put them in the thread?
I have not wrote those functions. A friend did.
VB.NET is crap for such things and don't know about C#.
Do not always blame the programming language. By the way, C# is based on the same framework (.Net) as VB.
RE: Anti Avast 5 SandBox Example [VB5/6/C#,VB.NET] - ArkPhaze - 05-01-2013
(04-29-2013, 08:14 PM)Fredjes Wrote:(04-21-2013, 12:59 PM)NiTrOwow Wrote:(04-15-2013, 07:30 AM)ArkPhaze Wrote: @NiTrOwow - You aren't even using the Win32 function for VB.net and C#, you're using the methods wrapped in the System.Diagnostics.Process class, so why put them in the thread?
I have not wrote those functions. A friend did.
VB.NET is crap for such things and don't know about C#.
Do not always blame the programming language. By the way, C# is based on the same framework (.Net) as VB.
Exactly, and I think the reputation of what people have seen with VB.net (because it's a popular/common choice for beginners) is why it's gotten such a bad reputation, and no other reason. If .NET didn't exist, and people started choosing C or C++, I could only imagine what kind of reputation beginner leechers/skids, and other novice programmers would give to those programming languages.