A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #25947  by Mr.B34n
 Thu May 28, 2015 4:08 pm
Hi...1st of all i want to thank EP_X0FF for this wonderful creation.. You guys here are so excellent and experts..

i know this sounds funny, I'm a total noob and You are so far and advanced more likely unreachable to me,

I'm a c++ newbie, I have installed VS2013 U4

I modified cmd strings from carberp.c gootkit.c main.c successfully compiled it but

still it launch a cmd console instead of "C:\Users\Mr.B34n\test.exe".. :lol:

but what should I do to really change payload path ? from what source code filename?

I'm just a kid who wants to learn, i asked here since i don't know anybody who can help. Have a good day ...

All credits for EP_X0FF :D

Mr.B34n
 #25975  by EP_X0FF
 Mon Jun 01, 2015 7:18 am
There is no payload path in executable, cmd.exe executed from Fubuki/Hibiki - payload dll, so you need to modify their code, compile them, copy as bytes array inside Akagi project and compile it.
 #26142  by Mr.B34n
 Sat Jun 20, 2015 4:33 am
Thanks for your response master..

it tried to use Hex Workshop 6.7.3 to export bytes array for vb6 app but it won't still work..

what tool do you use to get the bytes array? do i need to use partial bytes array?

here's my binary file:
http://ge.tt/43SoUhI2/v/0

then i loaded that full binary file and export as bytes array .c and here's the result:
http://pastebin.com/SNP1x7uH

still no luck.. hope you can tell me where did i go wrong? thank you very much :)