Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
goelp14
GitHub Repository: goelp14/easyctf-iv-problems
Path: blob/master/maldropper/source/maldrop/Program.cs
671 views
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using System.Reflection;
using System.IO;
using System.Text;

namespace maldrop
{
    static class Program
    {
        static bool CompareOffset(byte[] arr, int off, byte[] pattern)
        {
            for (int i = 0; i < pattern.Length; ++i)
                if (arr[off + i] != pattern[i])
                    return false;
            return true;
        }

        static byte[][] SplitByteArray(byte[] arr, byte[] splitPattern)
        {
            int offset = 0;
            List<byte[]> collection = new List<byte[]>();

            for (int i = 0; i < arr.Length - splitPattern.Length; ++i)
            {
                if (CompareOffset(arr, i, splitPattern))
                {
                    collection.Add(arr.Skip(offset).Take(i - offset).ToArray());
                    offset = i + splitPattern.Length;
                    i += splitPattern.Length - 1;
                }
            }
            collection.Add(arr.Skip(offset).ToArray());

            return collection.ToArray();
        }

        /// <summary>
        /// The main entry point for the application.
        /// </summary>
        [STAThread]
        static void Main(string[] args)
        {
            Console.WriteLine("All the techniques implemented in this were found in malware samples I analyzed");;
            string s = Assembly.GetEntryAssembly().Location;
            var baseExe = File.ReadAllBytes(s);
            string split = "[SPLIT";
            string erator = "ERATOR]";
            var res = SplitByteArray(baseExe, Encoding.ASCII.GetBytes(split + erator));

            List<string> arg = new List<string>();
            for (int i = 0; i < res[2].Length; ++i)
                arg.Add(res[2][i].ToString());

            Assembly.Load(res[1])
                .EntryPoint.Invoke(null, new object[] {
                    arg.ToArray()
                });
        }
    }
}