Advertisement
tonti666

Untitled

Dec 17th, 2017
90
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.93 KB | None | 0 0
  1. <DllImport("kernel32.dll")>
  2. Public Shared Function GetModuleHandle(ByVal lpModuleName As String) As IntPtr
  3. End Function
  4.  
  5. <DllImport("kernel32.dll")>
  6. Public Shared Function VirtualProtect(ByVal lpAddress As IntPtr, ByVal dwSize As UIntPtr, ByVal flNewProtect As UInt32, <Out()> ByRef lpflOldProtect As UInt32) As Boolean
  7. End Function
  8.  
  9. <DllImport("kernel32.dll")>
  10. Public Shared Sub ZeroMemory(ByVal addr As IntPtr, ByVal size As IntPtr)
  11. End Sub
  12.  
  13. Public Sub EraseHeader()
  14. Dim PAGE_READWRITE As UInt32 = 4
  15. Dim OldPageProtect As UInt32 = 0
  16. Dim pBaseAddress As IntPtr = GetModuleHandle(Nothing)
  17. VirtualProtect(pBaseAddress, 4096, PAGE_READWRITE, OldPageProtect)
  18. ZeroMemory(pBaseAddress, 4096)
  19. End Sub
  20.  
  21. Public Sub AntiDump()
  22. Try
  23. Dim x(0) As Process
  24. x(0) = Process.GetCurrentProcess
  25. Dim dwOld As UInteger = 0
  26. Dim wNumberOfSections As Integer = 0
  27. Dim dwPEHeader As Integer = 0
  28. Dim SectionTableOffset As Integer = 0
  29. Dim ModuleBaseAddr As Integer = Process.GetCurrentProcess.MainModule.BaseAddress
  30. Dim PEHeaderDwords() As Integer = {&H0, &H8, &HC, &H10, &H16, &H1C, &H20, &H28, &H2C, &H34, &H3C, &H4C, &H50, &H54, &H58, &H60, &H64, &H68, &H6C, &H70, &H74, &H104, &H108, &H10C, &H110, &H114, &H11C}
  31. Dim SectionTableDwords() As Integer = {&H8, &HC, &H10, &H14, &H18, &H1C, &H24}
  32. Dim SectionTableWords() As Integer = {&H20}
  33. Dim PEHeaderWords() As Integer = {&H4, &H16, &H18, &H40, &H42, &H44, &H46, &H48, &H4A, &H4C, &H5C, &H5E}
  34. Dim PEHeaderBytes() As Integer = {&H1A, &H1B}
  35. SectionTableOffset = dwPEHeader + &HFA
  36. VirtualProtect(ModuleBaseAddr, 30, &H40, dwOld)
  37. ZeroMemory(ModuleBaseAddr, 30)
  38. VirtualProtect(ModuleBaseAddr, 30, dwOld, Nothing)
  39. For Each c As Integer In PEHeaderDwords
  40. VirtualProtect((ModuleBaseAddr + dwPEHeader) + c, 4, &H40, dwOld)
  41. ZeroMemory((ModuleBaseAddr + dwPEHeader) + c, 4)
  42. VirtualProtect((ModuleBaseAddr + dwPEHeader) + c, 4, dwOld, Nothing)
  43. Next
  44. For Each c As Integer In PEHeaderWords
  45. VirtualProtect((ModuleBaseAddr + dwPEHeader) + c, 2, &H40, dwOld)
  46. ZeroMemory((ModuleBaseAddr + dwPEHeader) + c, 2)
  47. VirtualProtect((ModuleBaseAddr + dwPEHeader) + c, 2, dwOld, Nothing)
  48. Next
  49. For Each c As Integer In PEHeaderBytes
  50. VirtualProtect((ModuleBaseAddr + dwPEHeader) + c, 1, &H40, dwOld)
  51. ZeroMemory((ModuleBaseAddr + dwPEHeader) + c, 1)
  52. VirtualProtect((ModuleBaseAddr + dwPEHeader) + c, 1, dwOld, Nothing)
  53. Next
  54. Dim i As Integer = 0
  55. Dim i2 As Integer = 0
  56. While i <= wNumberOfSections
  57. If i2 = 0 Then
  58. VirtualProtect((ModuleBaseAddr + dwPEHeader + &HFA + (&H28 * i)) + SectionTableWords(0), 2, &H40, dwOld)
  59. ZeroMemory((ModuleBaseAddr + dwPEHeader + &HFA + (&H28 * i)) + SectionTableWords(0), 2)
  60. VirtualProtect((ModuleBaseAddr + dwPEHeader + &HFA + (&H28 * i)) + SectionTableWords(0), 2, dwOld, Nothing)
  61. End If
  62. VirtualProtect((ModuleBaseAddr + dwPEHeader + &HFA + (&H28 * i)) + SectionTableDwords(i2), 4, &H40, dwOld)
  63. ZeroMemory((ModuleBaseAddr + dwPEHeader + &HFA + (&H28 * i2)) + SectionTableDwords(i2), 4)
  64. VirtualProtect((ModuleBaseAddr + dwPEHeader + &HFA + (&H28 * i)) + SectionTableDwords(i2), 4, dwOld, Nothing)
  65. i2 += 1
  66. If i2 = SectionTableDwords.Length Then
  67. i += 1
  68. i2 = 0
  69. End If
  70. End While
  71. Catch ex As Exception
  72. 'Get error
  73. End Try
  74. End Sub
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement