I don't get decompile ???
|
08-17-2011, 08:15 PM
Post: #1
|
|||
|
|||
I don't get decompile ???
They can help me the decompile?
http://www.megaupload.com/?d=RJ8EOVCS I will be very grateful. *sorry for my english. |
|||
08-18-2011, 05:56 PM
Post: #2
|
|||
|
|||
RE: I don't get decompile ???
(08-17-2011 08:15 PM)eduardowgt Wrote: They can help me the decompile? Please.... |
|||
08-18-2011, 06:33 PM
Post: #3
|
|||
|
|||
RE: I don't get decompile ???
exe virus or trojan
|
|||
08-18-2011, 08:05 PM
Post: #4
|
|||
|
|||
RE: I don't get decompile ??? | |||
08-29-2011, 11:46 AM
(This post was last modified: 08-29-2011 02:14 PM by cw2k.)
Post: #5
|
|||
|
|||
RE: I don't get decompile ???
Dam kiddies - no this is not a trojan or virus.
Well it's a bot compiled with Dot Net. Reflector will decompile it to a certain level. like this for example: YAikaBRBot\YAikaBR.cs PHP Code: private void YAikaBR_Load(object sender, EventArgs e) Of course you can also see and learn from the this code like stringdecoding is done: PHP Code: string[] strArray = "QmxhY2tNYWdpYywgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1udWxs,[z]{6c404f68-91b9-416d-97eb-cd456a035ead},ZmFzbWRsbF9tYW5hZ2VkLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPW51bGw=,[z]{83e240d4-af2b-438a-ab49-ee06a9510bf0},SW50ZXJvcC5BdXRvSXRYM0xpYiwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1udWxs,[z]{0e474cbd-30cf-47f4-9276-40809bc178c4}".Split(new char[] { ',' }); Quote:QmxhY2tNYWdpYywgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1udWxsSo now well know what that strange resources are for: {0e474cbd-30cf-47f4-9276-40809bc178c4} {6c404f68-91b9-416d-97eb-cd456a035ead} {83e240d4-af2b-438a-ab49-ee06a9510bf0} {9db1daf9-8a69-4c94-a395-61fe3ef4ecd5} Anyway that work was already done and there a nice tool that still does that work: Dumbassembly 0.5.5 -> dumbassembly.exe Aikabot.exe Quote: DumbAssembly 0.5.5The new 'Aikabot_.exe' is even runable And now finally the decompiled output looks much more useful: PHP Code: private void YAikaBR_Load(object sender, EventArgs e) and renaming Aikabot_.exe -> AikaBR.exe gets you even more far than just that Messagebox. Aikabot_.exe But beside the 'decompiled source' I really recommend you to load 'Aikabot_.exe' into reflector and and to browse through the source code there. You can also choose if you like to see it as Visual Basic source code instead of C#. (maybe switch to IL if there are problems - the others like Delphi, Oxygene are still to buggy to be useful) |
|||
« Next Oldest | Next Newest »
|
User(s) browsing this thread: 1 Guest(s)