{"id":1424,"date":"2017-03-03T19:48:55","date_gmt":"2017-03-03T19:48:55","guid":{"rendered":"http:\/\/www.gironsec.com\/blog\/?p=1424"},"modified":"2017-04-22T07:32:15","modified_gmt":"2017-04-22T07:32:15","slug":"joecrypter-update-and-more","status":"publish","type":"post","link":"https:\/\/www.gironsec.com\/blog\/2017\/03\/joecrypter-update-and-more\/","title":{"rendered":"JoeCrypter Update and more"},"content":{"rendered":"<p>Hey hey hey! <\/p>\n<p>Been gone a while, but not forever. I&#8217;m back with an update to my crypter. I was on the plane over the Pacific during a long ass flight when it hit me &#8211; 2 new ways to evade analysis. <\/p>\n<ul>\n<li>Date specific checks<\/li>\n<li>Region specific checks<\/li>\n<\/ul>\n<p><a href=\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2017\/03\/crypter_update.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2017\/03\/crypter_update.png\" alt=\"\" width=\"720\" height=\"692\" class=\"alignnone size-full wp-image-1425\" srcset=\"https:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2017\/03\/crypter_update.png 720w, https:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2017\/03\/crypter_update-300x288.png 300w\" sizes=\"(max-width: 720px) 100vw, 720px\" \/><\/a><\/p>\n<p>I&#8217;ve added the functionality to JoeCrypter and have also added a switch to disable the music (help menu). When I think of more evasions, I will add them to the app. <\/p>\n<p>The code is simple enough. Basic std time structures to check for the date and only run for 1 month.<br \/>\n<!-- HTML generated using hilite.me --><\/p>\n<div style=\"background: #ffffff; overflow:auto;width:auto;border:solid gray;border-width:.1em .1em .1em .8em;padding:.2em .6em;\">\n<pre style=\"margin: 0; line-height: 125%\"><span style=\"color: #888888; font-weight: bold\">void<\/span> <span style=\"color: #0066bb; font-weight: bold\">date_specific_check<\/span>(<span style=\"color: #888888; font-weight: bold\">char<\/span> *shortdate)\r\n{\r\n\t<span style=\"color: #888888; font-weight: bold\">time_t<\/span> rawtime;\r\n\t<span style=\"color: #008800; font-weight: bold\">struct<\/span> tm * timeinfo;\r\n  \t<span style=\"color: #888888; font-weight: bold\">char<\/span> currentdate[<span style=\"color: #0000DD; font-weight: bold\">80<\/span>];\r\n  \ttime (&amp;rawtime);\r\n  \ttimeinfo = localtime(&amp;rawtime);\r\n\tstrftime(currentdate,<span style=\"color: #0000DD; font-weight: bold\">80<\/span>,<span style=\"color: #dd2200; background-color: #fff0f0\">&quot;%d\/%m\/%Y&quot;<\/span>,timeinfo);\r\n\r\n\t<span style=\"color: #888888\">\/\/get current date, check against current month<\/span>\r\n\t<span style=\"color: #008800; font-weight: bold\">if<\/span>(strstr(currentdate,shortdate))\r\n\t{\r\n\t\t<span style=\"color: #008800; font-weight: bold\">return<\/span>;\t<span style=\"color: #888888\">\/\/ clean return<\/span>\r\n\t}\r\n\t<span style=\"color: #008800; font-weight: bold\">else<\/span>{\r\n\tPassToNoobs();\r\n\t}\r\n}\r\n<\/pre>\n<\/div>\n<p>The region specific check uses the <a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/dd318123(v=vs.85).aspx\" target=\"_blank\">GetSystemDefaultUILanguage<\/a> api to grab the current language set and checks against the language passed from the main program.<br \/>\nI&#8217;ve omitted some code for space.<\/p>\n<p><!-- HTML generated using hilite.me --><\/p>\n<div style=\"background: #ffffff; overflow:auto;width:auto;border:solid gray;border-width:.1em .1em .1em .8em;padding:.2em .6em;\">\n<pre style=\"margin: 0; line-height: 125%\"><span style=\"color: #888888; font-weight: bold\">void<\/span> <span style=\"color: #0066bb; font-weight: bold\">region_specific_check<\/span>(<span style=\"color: #888888; font-weight: bold\">char<\/span> *region)\r\n{\r\nLANGID id;\r\n<span style=\"color: #888888; font-weight: bold\">char<\/span> *lang = <span style=\"color: #dd2200; background-color: #fff0f0\">&quot;&quot;<\/span>;\r\n\r\n\t  id = GetSystemDefaultUILanguage();\r\n\t  <span style=\"color: #008800; font-weight: bold\">switch<\/span>(id)\r\n\t  {\r\n\t\t<span style=\"color: #008800; font-weight: bold\">case<\/span> <span style=\"color: #0000DD; font-weight: bold\">0x0000<\/span>: lang = <span style=\"color: #dd2200; background-color: #fff0f0\">&quot;Language Neutral&quot;<\/span>; <span style=\"color: #008800; font-weight: bold\">break<\/span>;\r\n\t\t<span style=\"color: #008800; font-weight: bold\">case<\/span> <span style=\"color: #0000DD; font-weight: bold\">0x007f<\/span>: lang = <span style=\"color: #dd2200; background-color: #fff0f0\">&quot;Locale Invariant&quot;<\/span>; <span style=\"color: #008800; font-weight: bold\">break<\/span>;\r\n\t\t<span style=\"color: #008800; font-weight: bold\">case<\/span> <span style=\"color: #0000DD; font-weight: bold\">0x0400<\/span>: lang = <span style=\"color: #dd2200; background-color: #fff0f0\">&quot;User Default Language&quot;<\/span>; <span style=\"color: #008800; font-weight: bold\">break<\/span>;\r\n\t\t<span style=\"color: #008800; font-weight: bold\">case<\/span> <span style=\"color: #0000DD; font-weight: bold\">0x0800<\/span>: lang = <span style=\"color: #dd2200; background-color: #fff0f0\">&quot;System Default Language&quot;<\/span>; <span style=\"color: #008800; font-weight: bold\">break<\/span>;\r\n\t\t<span style=\"color: #008800; font-weight: bold\">case<\/span> <span style=\"color: #0000DD; font-weight: bold\">0x0436<\/span>: lang = <span style=\"color: #dd2200; background-color: #fff0f0\">&quot;Afrikaans&quot;<\/span>; <span style=\"color: #008800; font-weight: bold\">break<\/span>;\r\n\t\t<span style=\"color: #008800; font-weight: bold\">case<\/span> <span style=\"color: #0000DD; font-weight: bold\">0x041c<\/span>: lang = <span style=\"color: #dd2200; background-color: #fff0f0\">&quot;Albanian&quot;<\/span>; <span style=\"color: #008800; font-weight: bold\">break<\/span>;\r\n\t\t<span style=\"color: #008800; font-weight: bold\">case<\/span> <span style=\"color: #0000DD; font-weight: bold\">0x0401<\/span>: lang = <span style=\"color: #dd2200; background-color: #fff0f0\">&quot;Arabic (Saudi Arabia)&quot;<\/span>; <span style=\"color: #008800; font-weight: bold\">break<\/span>;\r\n...\r\n...\r\n...\r\n  }\r\n\t\t<span style=\"color: #008800; font-weight: bold\">if<\/span>(strcmp(lang,region))\r\n\t\t{\r\n\t\t\t\r\n\t\t\t<span style=\"color: #008800; font-weight: bold\">return<\/span> <span style=\"color: #0000DD; font-weight: bold\">1<\/span>;\r\n\r\n\t\t}\r\n\t\t<span style=\"color: #008800; font-weight: bold\">else<\/span>\r\n\t\t{\r\n\t\t\tPassToNoobs();\r\n\t\t}\r\n\t<span style=\"color: #008800; font-weight: bold\">return<\/span> <span style=\"color: #0000DD; font-weight: bold\">0<\/span>;\r\n}\r\n<\/pre>\n<\/div>\n<p>Easy enough right? This ensures our target is only executed in the region we want. The latest version of the crypter is <a href=\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2017\/03\/JoeCrypter.7z\">JoeCrypter<\/a> The password is &#8216;gironsec&#8217;.<\/p>\n<p>I will be doing the PIN stuff next post, but for now, enjoy the crypter.<\/p>\n<p>Happy hacking!<br \/>\n<a href=\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2017\/03\/1488099060762.jpg\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2017\/03\/1488099060762.jpg\" alt=\"\" width=\"640\" height=\"727\" class=\"alignnone size-full wp-image-1427\" srcset=\"https:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2017\/03\/1488099060762.jpg 640w, https:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2017\/03\/1488099060762-264x300.jpg 264w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hey hey hey! Been gone a while, but not forever. I&#8217;m back with an update to my crypter. I was on the plane over the Pacific during a long ass flight when it hit me &#8211; 2 new ways to evade analysis. Date specific checks Region specific checks I&#8217;ve added the functionality to JoeCrypter and [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4,6],"tags":[114],"_links":{"self":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/1424"}],"collection":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/comments?post=1424"}],"version-history":[{"count":3,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/1424\/revisions"}],"predecessor-version":[{"id":1443,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/1424\/revisions\/1443"}],"wp:attachment":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/media?parent=1424"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/categories?post=1424"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/tags?post=1424"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}