Closed ExecutivePrograms closed 1 year ago
If it is scanned even a single time, it would get detected. I cannot prevent people to scan it. Sometimes the victims scan it too.
@Blank-c just use a fud pyinetaller
There is not anything like that.
@Blank-c try cx freeze or nukis py to exe
cxfreeze cannot generate single file executable, nuitka require backend C compiler and manual modifications during conversion and py to exe is just a front end for Pyinstaller (which Blank Grabber currently uses).
if you are looking to make any modifications to pyinstaller, replicate these steps (per executable generated). this method has been proven (for me) to reduce detections significantly.
python.exe -m pip uninstall pyinstaller this removes the public version of pyinstaller which many users just install from pip (blank installs it like this by default)
install c++ build tools from here if you havent already installed them. http://visualstudio.microsoft.com/vs/features/cplusplus/ this is needed for the next step
navigate to the official pyinstaller repo and download as zip http://github.com/pyinstaller/pyinstaller/releases
Unzip this to where you want Pyinstaller to be installed on your machine.
In CMD, cd to the install directory where you unzipped Pyinstaller. cd to the bootloader folder. if you know what you're doing, you can attempt to obfuscate pyinstaller before continuing, which may help your .exe stay undetected for longer)
python.exe ./waf all
cd to root Pyinstaller directory
python.exe setup.py install (make sure you pip install wheel before this step)
the grabber may or may not attempt to update pyinstaller, so for personal use, i recommend removing the pyinstaller value from requirements.txt before you build your exe.
hope this helps temporarily
use mingw instead of C++ build tools. It drops more detections.
would we be able to modify my steps above (using mingw) to automate this process into the grabber?
One can simply install mingw with gcc support (add to path too) and let wafscript handle that.
would we be able to modify my steps above (using mingw) to automate this process into the grabber?
I don't think it woukd be useful, it would take a lot of time.
while it would result in longer build times, it would help with detection status
Atleast it would be fud
not necessarily
@Blank-c and @noahmajors how does other grabbers get (almost) fud?
while it would result in longer build times, it would help with detection status
Also, even if we are compiling the bootloader, the archive appended to it would be the same. So I don't think it would be enough.
Try to do it yourself, see if the detection rate goes down.
@Blank-c and @noahmajors how does other grabbers get (almost) fud?
what are you talking about?
while it would result in longer build times, it would help with detection status
Also, even if we are compiling the bootloader, the archive appended to it would be the same. So I don't think it would be enough.
Try to do it yourself, see if the detection rate goes down.
When I last did this, it reduced detections by 3, including Defender. It was only valid for one VT scan before it became detected. I’m sure if we make some more in depth modifications, and perhaps some slight obfuscation, we could drop detections more
Lets instead make it as a green option in the grabber. It would only work if msvc or gcc is found in PATH.
@Blank-c and @noahmajors how does other grabbers get (almost) fud?
what are you talking about?
Some grabbers i saw have or claim to have fud
If you confirmed it yourself, do you have link for them?
If they just claimed, then there is no proof of it.
Hello,
I have submitted obfuscation error some days ago.
You told me that it gets detected since people scan it in Virus Total etc.
So to make it less detectable you shall create a discord server and create a channel for people who has starred the grabber.
It will make it less detectable because random people won't scan it on virus total and even if these people scan it there, theres much less people who'll scan it on virus total.