Locked vb6 crypter on chinese windows

[MasterVb6]

Hello, i found that vb6 crypters doesn't work on chinese windows when there's split function with delimiter, for it to work we need to avoid delimiter. I was tried to modify simple source code of vb6 to make it work on chinese windows but so far failed. I saw some crypters with resource  method but i cant figure out how its work. I Share the source code and if its possible someone to give me advice or modify.

This is the hidden content, please

• Sign In
• or
• Sign Up

 

[dEEpEst]

In Chinese Windows, the problem with the Split function might be related to the way it handles characters. One possible solution is to avoid using the Split function and delimiters altogether. You can store the encrypted content in a resource file and then retrieve it at runtime.

Here's a step-by-step guide to using the resource method in VB6:

Create a new resource file:

a. In the VB6 IDE, go to the "Project" menu and select "Add Resource File".
b. Choose a name and location for the .res file (e.g., "MyResources.res").

Add a resource to the resource file:

a. In the Resource Editor, click the "Add Custom Resource" button (the one with a blue cube).
b. Set the "Resource Type" to a custom type, such as "ENCRYPTED_EXE".
c. Set the "Resource ID" to a unique identifier, like "101".
d. Browse and select the encrypted .exe file to add as a resource.
e. Save the resource file.

Add the resource file to the VB6 project:

In the VB6 IDE, go to the "Project" menu, click "Properties", and on the "Make" tab, add the .res file to the "Resource File" field.

Read the encrypted .exe file from the resource at runtime:

Instead of reading the encrypted .exe file with the Split function, you can use the LoadResData function to read the resource data.

 

This is the hidden content, please

• Sign In
• or
• Sign Up

You can now use the encryptedExe variable in the same way as you did with the Split method. Decrypt the content, and then use the RunPE method to execute the decrypted payload.

By using the resource method, you avoid potential issues with the Split function and character encodings in different Windows versions. This should improve compatibility with Chinese Windows.

[MasterVb6]

On 4/5/2023 at 10:24 PM, dEEpEst said:

In Chinese Windows, the problem with the Split function might be related to the way it handles characters. One possible solution is to avoid using the Split function and delimiters altogether. You can store the encrypted content in a resource file and then retrieve it at runtime.

Here's a step-by-step guide to using the resource method in VB6:

Create a new resource file:

a. In the VB6 IDE, go to the "Project" menu and select "Add Resource File".
b. Choose a name and location for the .res file (e.g., "MyResources.res").

Add a resource to the resource file:

a. In the Resource Editor, click the "Add Custom Resource" button (the one with a blue cube).
b. Set the "Resource Type" to a custom type, such as "ENCRYPTED_EXE".
c. Set the "Resource ID" to a unique identifier, like "101".
d. Browse and select the encrypted .exe file to add as a resource.
e. Save the resource file.

Add the resource file to the VB6 project:

In the VB6 IDE, go to the "Project" menu, click "Properties", and on the "Make" tab, add the .res file to the "Resource File" field.

Read the encrypted .exe file from the resource at runtime:

Instead of reading the encrypted .exe file with the Split function, you can use the LoadResData function to read the resource data.

 

Hidden Content

• Give reaction to this post to see the hidden content.

You can now use the encryptedExe variable in the same way as you did with the Split method. Decrypt the content, and then use the RunPE method to execute the decrypted payload.

By using the resource method, you avoid potential issues with the Split function and character encodings in different Windows versions. This should improve compatibility with Chinese Windows.

Deepest thank you for the answer, i dont know why i missed to read it yesterday,

[MasterVb6]

Deepest

When you talking for all these steps, you talking that everything is happened in the stub, correct? In other words.

1.I load the uncrypted payload in the resources in the stub code, then i modify the code in the stub to read the uncrypted exe from the resources. When the stub is modified to read the uncrypted exe from the resource stub do other things like encrypt runpe etc.

After that, i just compiled the project, where the stub and uncrypted payload are together in already compiled file. No need of builder?

In other words, i just load the uncrypted exe file in the resources  in the stub, then i modify the stub to load the uncrypted file from resources, and then just compiled the stub project where now are both files- the stub and the uncrypted exe. And i dont need of builder, is it correct?

[dEEpEst]

hace 1 hora, MasterVb6 dijo:

Deepest

When you talking for all these steps, you talking that everything is happened in the stub, correct? In other words.

1.I load the uncrypted payload in the resources in the stub code, then i modify the code in the stub to read the uncrypted exe from the resources. When the stub is modified to read the uncrypted exe from the resource stub do other things like encrypt runpe etc.

After that, i just compiled the project, where the stub and uncrypted payload are together in already compiled file. No need of builder?

In other words, i just load the uncrypted exe file in the resources  in the stub, then i modify the stub to load the uncrypted file from resources, and then just compiled the stub project where now are both files- the stub and the uncrypted exe. And i dont need of builder, is it correct?

Yes, that's correct. By embedding the uncrypted payload in the stub as a resource, you eliminate the need for a separate builder to combine the stub and the payload. The steps I provided are for modifying the stub to include the payload as a resource, and then reading that resource at runtime to perform the necessary operations (e.g., encryption, decryption, and execution).

Here's a summary of the process:

Embed the uncrypted payload in the stub project as a resource.

Modify the stub code to read the payload from the resource, and perform encryption, decryption, and execution as needed.

Compile the stub project, which now includes both the stub and the payload.

With this approach, you don't need a separate builder, as the payload is already embedded in the compiled stub. Just make sure that the payload is included in the stub project as a resource, and that the stub code is properly modified to read from the resource and perform the necessary operations.

[MasterVb6]

53 minutes ago, dEEpEst said:

Yes, that's correct. By embedding the uncrypted payload in the stub as a resource, you eliminate the need for a separate builder to combine the stub and the payload. The steps I provided are for modifying the stub to include the payload as a resource, and then reading that resource at runtime to perform the necessary operations (e.g., encryption, decryption, and execution).

Here's a summary of the process:

Embed the uncrypted payload in the stub project as a resource.

Modify the stub code to read the payload from the resource, and perform encryption, decryption, and execution as needed.

Compile the stub project, which now includes both the stub and the payload.

With this approach, you don't need a separate builder, as the payload is already embedded in the compiled stub. Just make sure that the payload is included in the stub project as a resource, and that the stub code is properly modified to read from the resource and perform the necessary operations.

Thank you Deepest, that's sounds great, do you think there's some alternative so i can use this method with some simple builder or it's impossible?
From what i understand, if i  want to use a couple rats, i need to load in the resources, but my idea is, if i can use this method (without split ) with some simple builder, and get each rat i want with app path & exename etc. 
 

[dEEpEst]

why don't you just change the delimiter?

You can use a combination of ASCII characters, this will improve compatibility on different versions of Windows.

This is the hidden content, please

• Sign In
• or
• Sign Up

Some more ASCII delimiter options:

This is the hidden content, please

• Sign In
• or
• Sign Up

 

[MasterVb6]

3 hours ago, dEEpEst said:

why don't you just change the delimiter?

You can use a combination of ASCII characters, this will improve compatibility on different versions of Windows.

Hidden Content

• Give reaction to this post to see the hidden content.

Some more ASCII delimiter options:

Hidden Content

• Give reaction to this post to see the hidden content.

 

I've changed, it's work on Russian Windows Version and similar language, but it doesn't work on Chinese for example.