dr4k0nia

using System;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Reflection;
using System.Threading;

public class Program
{
	private void Main()

dr4k0nia

using System;
using System.Collections;
using System.Collections.Generic;
using System.Linq;
using System.Linq.Expressions;
using System.Reflection;
using System.Text;

GetMethodHash("System.Reflection.Assembly", "Load");

dr4k0nia

Unpacking XorStringsNET

Since AgentTesla started using my XorStringsNET obfuscator to encrypt strings in their malware I decided to write a quick guide on how to decrypt the strings again.

Observed in unpacked child SHA256: d56f2852762f7f9fcb07eaf018e143ab1e4ad46e1f2e943faf13618388ef21a2

Original sample SHA256: e66ffcfe9fb0d0cd80d96dcfd96e4941d3c2389d227f2655391cfdbc3bcd637c

Using de4dot

dr4k0nia

// Deobfuscator for a3x file of sample SHA256: db8eb8347ed084c3ee3707ad032743e350157abcaf2817e5f15777b20c554b7f
using System.Text;
using System.Text.RegularExpressions;

internal class Program
{
    private static void Main(string[] args)
    {
        var strings = new StringBuilder();
        string pattern = @"DoctrineDrama\(""(\w+)"",\s*(\d+)\)";

dr4k0nia

void Main()
{
	Decrypt("bISU^wHNIS").Dump();
	Decrypt("fTTBJEK^").Dump();
	Decrypt("kHFC").Dump();
	
	var file = File.ReadAllBytes("ThomasEdinson.bin");
	
	var result = file.Select(new Func<byte, int, byte>(stageDecryption)).ToArray<byte>();
	

dr4k0nia

using System.Linq;
using System.Reflection;

namespace HashInvoke;

public class HInvoke
{
    public static T InvokeMethod<T>(uint classID, uint methodID, object[]? args = null)
    {
        // Get the System assembly and go trough all its types hash their name

dr4k0nia

// ==UserScript==
// @name         D2 Reaction Farmer
// @namespace    https://github.com/dr4k0nia
// @version      1.0
// @description  Auto click reaction for Destiny 2 Twitch Extension
// @author       drakonia
// @match        https://63i11l5ul8pm3buvheb3j2oyflbhtw.ext-twitch.tv/63i11l5ul8pm3buvheb3j2oyflbhtw/1.61/a2539f7f48a126bb354318161238275c/video_overlay.html*
// @run-at       document-end
// @icon         https://raw.githubusercontent.com/justrealmilk/destiny-icons/8b697d4529262a850d0c987ca78db86d3989850b/factions/faction_osiris.svg
// @grant        none

dr4k0nia

// Simple crackme example by drakonia 

Console.WriteLine("Enter the correct password:");
string? solution = null;
while (solution == null)
{
    string? input = Console.ReadLine();
    solution = Verify(input);
}

dr4k0nia

using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace Code_Projects
{
    public unsafe class Suscall
    {
        [DllImport("kernel32", SetLastError = true)]

dr4k0nia

using System.Diagnostics;
using System.Text;
using System;
using System.Runtime.InteropServices;

namespace Code_Projects
{
    public static class DynamicInvokeExample
    {