Sign in to follow this  
Followers 0
Nikolle9203

Is it possible to ShellExecute(RC4encryptedfile) ?

9 posts in this topic

As the thread says , Is it possible to ShellExecute , Execute or Run an exe or compiled autoit script wich is encrypted with RC4 algorithm.So far im receiving errors like "Windows cannot find  '0x10CAE3D......................................andsoon.....' make sure u typed name correctly and try again "

Here is the source

 

Func RC4($Data, $Key)

Local $Opcode = "0xC81001006A006A005356578B551031C989C84989D7F2AE484829C88945F085C00F84DC000000B90001000088C82C0188840DEFFEFFFFE2F38365F4008365FC00817DFC000100007D478B45FC31D2F775F0920345100FB6008B4DFC0FB68C0DF0FEFFFF01C80345F425FF0000008945F48B75FC8A8435F0FEFFFF8B7DF486843DF0FEFFFF888435F0FEFFFFFF45FCEBB08D9DF0FEFFFF31FF89FA39550C76638B85ECFEFFFF4025FF0000008985ECFEFFFF89D80385ECFEFFFF0FB6000385E8FEFFFF25FF0000008985E8FEFFFF89DE03B5ECFEFFFF8A0689DF03BDE8FEFFFF860788060FB60E0FB60701C181E1FF0000008A840DF0FEFFFF8B750801D6300642EB985F5E5BC9C21000"
Local $CodeBuffer = DllStructCreate("byte[" & BinaryLen($Opcode) & "]")
DllStructSetData($CodeBuffer, 1, $Opcode)
Local $Buffer = DllStructCreate("byte[" & BinaryLen($Data) & "]")
DllStructSetData($Buffer, 1, $Data)
DllCall("user32.dll", "none", "CallWindowProc", "ptr", DllStructGetPtr($CodeBuffer), "ptr", DllStructGetPtr($Buffer), "int", BinaryLen($Data), "str", $Key, "int", 0)
Local $Ret = DllStructGetData($Buffer, 1)
$Buffer = 0
$CodeBuffer = 0
Return $Ret
EndFunc   ;==>RC4
 
 
Local $open = FileOpen("MessageBox.exe", 0)
$read=FileRead($open)
fileclose($open)
$rc44=RC4($read,123)
$dirtorc = @ScriptDir&"rc4enc.exe"
FileWrite($dirtorc,$rc44)
sleep(500)
ShellExecute(RC4($dirtorc,123))
 

Thanks.

Share this post


Link to post
Share on other sites



Hi,

It might be possible, but not with the standard Run or ShellExecute functions.

Whatever you're trying to do, you will never be able to protect your code.

Indeed, even your script is encrypted on your hard drive, it will be decrypted on its run and there is no way to prevent memory dumping etc.

Br, FireFox.


 

OS : Win XP SP2 (32 bits) / Win 7 SP1 (64 bits) / Win 8 (64 bits) | Autoit version: latest stable / beta.
Hardware : Intel(R) Core(TM) i5-2400 CPU @ 3.10Ghz / 8 GiB RAM DDR3.

My UDFs : Skype UDF | TrayIconEx UDF | GUI Panel UDF | Excel XML UDF | Is_Pressed_UDF

My Projects : YouTube Multi-downloader | FTP Easy-UP | Lock'n | WinKill | AVICapture | Skype TM | Tap Maker | ShellNew | Scriptner | Const Replacer | FT_Pocket | Chrome theme maker

My Examples : Capture toolIP Camera | Crosshair | Draw Captured Region | Picture Screensaver | Jscreenfix | Drivetemp | Picture viewer

My Snippets : Basic TCP | Systray_GetIconIndex | Intercept End task | Winpcap various | Advanced HotKeySet | Transparent Edit control

 

Share this post


Link to post
Share on other sites

Hi and thanks for answer :) . Well my goal is to have basic code protection (noob proof) .So sad that Run or ShellExecute  cant do it :(

Share this post


Link to post
Share on other sites

Well my goal is to have basic code protection (noob proof) .

There are a few (well more than two..) threads here on this forum that topic on 'code protection'. Just search for them.


- Bruce /*somdcomputerguy */  If you change the way you look at things, the things you look at change.

Share this post


Link to post
Share on other sites

Alright thanks :)

Share this post


Link to post
Share on other sites

You bet. Good luck with your project.


- Bruce /*somdcomputerguy */  If you change the way you look at things, the things you look at change.

Share this post


Link to post
Share on other sites

The problem with your scheme is that you need to provide the key in a separate, "unprotected" program...


This wonderful site allows debugging and testing regular expressions (many flavors available). An absolute must have in your bookmarks.
Another excellent RegExp tutorial. Don't forget downloading your copy of up-to-date pcretest.exe and pcregrep.exe here
RegExp tutorial: enough to get started
PCRE v8.33 regexp documentation latest available release and currently implemented in AutoIt beta.

SQLitespeed is another feature-rich premier SQLite manager (includes import/export). Well worth a try.
SQLite Expert (freeware Personal Edition or payware Pro version) is a very useful SQLite database manager.
An excellent eBook covering almost every aspect of SQLite3: a must-read for anyone doing serious work.
SQL tutorial (covers "generic" SQL, but most of it applies to SQLite as well)
A work-in-progress SQLite3 tutorial. Don't miss other LxyzTHW pages!
SQLite official website with full documentation (may be newer than the SQLite library that comes standard with AutoIt)

Share this post


Link to post
Share on other sites

The problem with your scheme is that you need to provide the key in a separate, "unprotected" program...

What do you mean by this ?

Something like 

 

 

;Unprotected separeted script

Local $open = FileOpen("rc4enc.exe", 0)

$read=FileRead($open)
fileclose($open)
 
sleep(500)
$dirtorc = @ScriptDir&"rc4enc.exe"
ShellExecute(RC4($dirtorc,123))
 
Func RC4($Data, $Key)
......
EndFunc   ;==>RC4

Share this post


Link to post
Share on other sites

RC4($dirtorc,123)


This wonderful site allows debugging and testing regular expressions (many flavors available). An absolute must have in your bookmarks.
Another excellent RegExp tutorial. Don't forget downloading your copy of up-to-date pcretest.exe and pcregrep.exe here
RegExp tutorial: enough to get started
PCRE v8.33 regexp documentation latest available release and currently implemented in AutoIt beta.

SQLitespeed is another feature-rich premier SQLite manager (includes import/export). Well worth a try.
SQLite Expert (freeware Personal Edition or payware Pro version) is a very useful SQLite database manager.
An excellent eBook covering almost every aspect of SQLite3: a must-read for anyone doing serious work.
SQL tutorial (covers "generic" SQL, but most of it applies to SQLite as well)
A work-in-progress SQLite3 tutorial. Don't miss other LxyzTHW pages!
SQLite official website with full documentation (may be newer than the SQLite library that comes standard with AutoIt)

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0