KDot227 / SomalifuscatorV2

Most advanced and poorly coded windows batch obfuscator ever made (aka the best)
https://sped.lol
Apache License 2.0
289 stars 41 forks source link

Any way to make bat to exe? #30

Closed jamiekarvans closed 1 year ago

jamiekarvans commented 1 year ago

Hi really nice code, it works pretty fine for bat files but it's still quite obious that it's a virus or something specially when the cmd pops up. so any way to make the cmd console hidden and not poping up as well changing the bat file to exe without flaring any antivurs flag?

github-actions[bot] commented 1 year ago

If you need fast help join the server https://discord.gg/qvkC6kHqer

KDot227 commented 1 year ago

Hi really nice code, it works pretty fine for bat files but it's still quite obious that it's a virus or something specially when the cmd pops up.

so any way to make the cmd console hidden and not poping up as well changing the bat file to exe without flaring any antivurs flag?

1.) look at the settings there is a "hidden" mode 2.) I've already made one that uses pyarmor and pyinstaller but it would be paid. If you want to do it for free then look up how to do it with iexpress. It should only be around 1-2 detections (hopefully)

KDot227 commented 1 year ago

If u have any more questions lmk

jamiekarvans commented 1 year ago

Thanx for the help, but the hidden mode just hides the code in the console and the console still pops up untill the code is finished, the only difference is that it doesn't show the code.

On Mon, Aug 7, 2023, 6:13 AM K.Dot @.***> wrote:

Hi really nice code, it works pretty fine for bat files but it's still quite obious that it's a virus or something specially when the cmd pops up.

so any way to make the cmd console hidden and not poping up as well changing the bat file to exe without flaring any antivurs flag?

1.) look at the settings there is a "hidden" mode 2.) I've already made one that uses pyarmor and pyinstaller but it would be paid. If you want to do it for free then look up how to do it with iexpress. It should only be around 1-2 detections (hopefully)

— Reply to this email directly, view it on GitHub https://github.com/KDot227/SomalifuscatorV2/issues/30#issuecomment-1667103633, or unsubscribe https://github.com/notifications/unsubscribe-auth/AQRGDFEENIOBSTU4IY7OCMTXUBI3LANCNFSM6AAAAAA3GJSEIY . You are receiving this because you authored the thread.Message ID: @.***>

KDot227 commented 1 year ago

Thanx for the help, but the hidden mode just hides the code in the console

and the console still pops up untill the code is finished, the only

difference is that it doesn't show the code.

On Mon, Aug 7, 2023, 6:13 AM K.Dot @.***> wrote:

Hi really nice code, it works pretty fine for bat files but it's still

quite obious that it's a virus or something specially when the cmd pops up.

so any way to make the cmd console hidden and not poping up as well

changing the bat file to exe without flaring any antivurs flag?

1.) look at the settings there is a "hidden" mode

2.) I've already made one that uses pyarmor and pyinstaller but it would

be paid. If you want to do it for free then look up how to do it with

iexpress. It should only be around 1-2 detections (hopefully)

Reply to this email directly, view it on GitHub

https://github.com/KDot227/SomalifuscatorV2/issues/30#issuecomment-1667103633,

or unsubscribe

https://github.com/notifications/unsubscribe-auth/AQRGDFEENIOBSTU4IY7OCMTXUBI3LANCNFSM6AAAAAA3GJSEIY

.

You are receiving this because you authored the thread.Message ID:

@.***>

Oh oops I forgot to fix that. Even if you close the console it will still finish executing. That is happening because it's waiting for the command to finish (new batch instance). I'll fix that tomorrow.

jamiekarvans commented 1 year ago

Thanx in advance. Also anyway to contact you for the paid version?

On Mon, Aug 7, 2023, 6:17 AM K.Dot @.***> wrote:

Thanx for the help, but the hidden mode just hides the code in the console

and the console still pops up untill the code is finished, the only

difference is that it doesn't show the code.

On Mon, Aug 7, 2023, 6:13 AM K.Dot @.***> wrote:

Hi really nice code, it works pretty fine for bat files but it's still

quite obious that it's a virus or something specially when the cmd pops up.

so any way to make the cmd console hidden and not poping up as well

changing the bat file to exe without flaring any antivurs flag?

1.) look at the settings there is a "hidden" mode

2.) I've already made one that uses pyarmor and pyinstaller but it would

be paid. If you want to do it for free then look up how to do it with

iexpress. It should only be around 1-2 detections (hopefully)

Reply to this email directly, view it on GitHub

30 (comment)

https://github.com/KDot227/SomalifuscatorV2/issues/30#issuecomment-1667103633 ,

or unsubscribe

https://github.com/notifications/unsubscribe-auth/AQRGDFEENIOBSTU4IY7OCMTXUBI3LANCNFSM6AAAAAA3GJSEIY

.

You are receiving this because you authored the thread.Message ID:

@.***>

Oh oops I forgot to fix that. Even if you close the console it will still finish executing. That is happening because it's waiting for the command to finish (new batch instance). I'll fix that tomorrow.

— Reply to this email directly, view it on GitHub https://github.com/KDot227/SomalifuscatorV2/issues/30#issuecomment-1667105836, or unsubscribe https://github.com/notifications/unsubscribe-auth/AQRGDFBNFFJ6L7EQGO7AY5DXUBJKHANCNFSM6AAAAAA3GJSEIY . You are receiving this because you authored the thread.Message ID: @.***>

KDot227 commented 1 year ago

Thanx in advance.

Also anyway to contact you for the paid version?

On Mon, Aug 7, 2023, 6:17 AM K.Dot @.***> wrote:

Thanx for the help, but the hidden mode just hides the code in the console

and the console still pops up untill the code is finished, the only

difference is that it doesn't show the code.

On Mon, Aug 7, 2023, 6:13 AM K.Dot @.***> wrote:

Hi really nice code, it works pretty fine for bat files but it's still

quite obious that it's a virus or something specially when the cmd pops up.

so any way to make the cmd console hidden and not poping up as well

changing the bat file to exe without flaring any antivurs flag?

1.) look at the settings there is a "hidden" mode

2.) I've already made one that uses pyarmor and pyinstaller but it would

be paid. If you want to do it for free then look up how to do it with

iexpress. It should only be around 1-2 detections (hopefully)

Reply to this email directly, view it on GitHub

30 (comment)

https://github.com/KDot227/SomalifuscatorV2/issues/30#issuecomment-1667103633

,

or unsubscribe

https://github.com/notifications/unsubscribe-auth/AQRGDFEENIOBSTU4IY7OCMTXUBI3LANCNFSM6AAAAAA3GJSEIY

.

You are receiving this because you authored the thread.Message ID:

@.***>

Oh oops I forgot to fix that. Even if you close the console it will still

finish executing. That is happening because it's waiting for the command to

finish (new batch instance). I'll fix that tomorrow.

Reply to this email directly, view it on GitHub

https://github.com/KDot227/SomalifuscatorV2/issues/30#issuecomment-1667105836,

or unsubscribe

https://github.com/notifications/unsubscribe-auth/AQRGDFBNFFJ6L7EQGO7AY5DXUBJKHANCNFSM6AAAAAA3GJSEIY

.

You are receiving this because you authored the thread.Message ID:

@.***>

Tbh I don't even have the paid version all working yet. Also it would still HAVE to drop a bat file so I might just make a free project and make my own batch interpreter.

jamiekarvans commented 1 year ago

hey how you doing, i did turned the bat file to exe using iexpress as you said but still it has 17 detections and most importantly it gets detected by windows defender which the only one i actually care about since it's preinstalled on all windows these days.

so is there any toturial for it or anything that i'm missing on using iexpress because seems it isn't working.

actually if there is anyway to just bypass defender while it is an exe file it would be great. and still waiting for your update on the hidden console. thanx alot

KDot227 commented 1 year ago

hey how you doing,

i did turned the bat file to exe using iexpress as you said but still it has 17 detections and most importantly it gets detected by windows defender which the only one i actually care about since it's preinstalled on all windows these days.

so is there any toturial for it or anything that i'm missing on using iexpress because seems it isn't working.

actually if there is anyway to just bypass defender while it is an exe file it would be great.

and still waiting for your update on the hidden console. thanx alot

God damn 💀 lemme check when I'm home cause I might have ruined iexpress on virus total

KDot227 commented 1 year ago

If worse comes to worse I'll make a c/c# app that can do it and hopefully will have lower detections

jamiekarvans commented 1 year ago

great i love to see this one let me know about it

KDot227 commented 1 year ago

great i love to see this one let me know about it

ai so I took a look at the iexpress method and this is what I see. I also had to change around somalifuscator to allow me to do this.

https://www.virustotal.com/gui/file/81917c247391605be1622187828915908f0656b551afaa31e6f45ef32c99849d?nocache=1

KDot227 commented 1 year ago

I believe I can fix the detections if I change the command on execute

jamiekarvans commented 1 year ago

great i love to see this one let me know about it

ai so I took a look at the iexpress method and this is what I see. I also had to change around somalifuscator to allow me to do this.

https://www.virustotal.com/gui/file/81917c247391605be1622187828915908f0656b551afaa31e6f45ef32c99849d?nocache=1

how did you exactly packed it and used the iexpress? maybe i'm doing it wrong

i used the simple command for installation in iexpress cmd.exe /c file.bat and it had around like 14 detections and then i used command CERTUTIL -ENCODE file.bat files.txt to encode it and then decode it an then run and i thought maybe that helps but it got even higher detections

KDot227 commented 1 year ago

ok so, the version I have right now is working very well. Here is the link to the py file. https://gofile.io/d/QR4z4j

Using iexpress api with .SED files seems to work A LOT better than using the gui version.

runtime detections: https://scanner.to/result/knKvvxEa0t scantime detections: https://www.virustotal.com/gui/file/b4e2a701c30a07d5e536971cfc016f0b0a9b9b2145afb9ba16835f558511396f?nocache=1

KDot227 commented 1 year ago

I'm going to start working on the different bat2exe methods. Only issue is that a lot of them will have to be compiled with their respected compilers or else it won't work. (might even make it so they get the file from a link then download the data etc but I would rather have it all in one place)

KDot227 commented 1 year ago

I also just pushed the update that will allow you to remove the double click check that way it will work with iexpress and all the other bat2exe methods.

jamiekarvans commented 1 year ago

ah you're amazing bro, thanx a lott

jamiekarvans commented 1 year ago

I'm going to start working on the different bat2exe methods. Only issue is that a lot of them will have to be compiled with their respected compilers or else it won't work. (might even make it so they get the file from a link then download the data etc but I would rather have it all in one place)

yes actually that's what i'm doint for the bat file itself, i just add the exception for windows defender, remove some famous antivirus files and then download the actual stub.exe from internet and run it, but the bat code itself is getting detected and that's where you're code just does an amazing job.

thanx again, if you wanted some help about it let me know, one easy way to bypass is was also to upload basr64 code as text on internet and implent it in batch file to get it online, decode it and run it, this evaded alot of anti-viruses for me

KDot227 commented 1 year ago

I'm going to start working on the different bat2exe methods. Only issue is that a lot of them will have to be compiled with their respected compilers or else it won't work. (might even make it so they get the file from a link then download the data etc but I would rather have it all in one place)

yes actually that's what i'm doint for the bat file itself,

i just add the exception for windows defender, remove some famous antivirus files and then download the actual stub.exe from internet and run it, but the bat code itself is getting detected and that's where you're code just does an amazing job.

thanx again, if you wanted some help about it let me know, one easy way to bypass is was also to upload basr64 code as text on internet and implent it in batch file to get it online, decode it and run it, this evaded alot of anti-viruses for me

Yeah lmk if I got any ideas for more obfuscation too. I tried using certutil to base64 decrypt an obfuscated file but it's so massive that it takes nearly 2 hours to do.

KDot227 commented 1 year ago

I'm also going to work on a crypter for pyinstaller at the same time since I had a few ideas. Idk if that's something you would use but it'll be pretty cool too.

KDot227 commented 1 year ago

And now that I think about it the pyinstaller crypter methods most likely could apply to iexpress too. Either way expect a fud bat2exe soon...

jamiekarvans commented 1 year ago

And now that I think about it the pyinstaller crypter methods most likely could apply to iexpress too. Either way expect a fud bat2exe soon...

love to hear from you maybe think about adding signature cloning aswell, it helps alot with alot of anti viruses.

KDot227 commented 1 year ago

And now that I think about it the pyinstaller crypter methods most likely could apply to iexpress too. Either way expect a fud bat2exe soon...

love to hear from you

maybe think about adding signature cloning aswell, it helps alot with alot of anti viruses.

Already added to my checklist lol

jamiekarvans commented 1 year ago

hey, unfortunelty the code doesn't work since the last update.

it gives me the obf file and it runs fine, but somehow my actual batch code doesn't get executed

KDot227 commented 1 year ago

hey, unfortunelty the code doesn't work since the last update.

it gives me the obf file and it runs fine, but somehow my actual batch code doesn't get executed

Can u try turning on and off some of the settings and also try debug. On top of that turn echo off to echo on and see if it executes anything.l of your actual code.

KDot227 commented 1 year ago

I'll take a look today. I'm working on like 4 dif projects rn and only getting paid for one of them.

KDot227 commented 1 year ago

Also if you dont mind sharing ur bat file that would help a lot.

jamiekarvans commented 1 year ago

hey, unfortunelty the code doesn't work since the last update. it gives me the obf file and it runs fine, but somehow my actual batch code doesn't get executed

Can u try turning on and off some of the settings and also try debug. On top of that turn echo off to echo on and see if it executes anything.l of your actual code.

hey how you doing thanx for the help, yea i did turned off all the settings and turned on debug mode and still no luck i can not even see what is actually happening here is the batch code, https://gofile.io/d/mzh4qp

this is the first batch code i have seperated it to two files just incase since this one looks harmless and would not trigger anti virus, but the second one dismantles defender and would more likely get detected so i can change the file anytime by having the first one pointing at the second file, but for both files the obsfcuted file doesn't work.

i will send you the second batch code just incase maybe becomes useful for you.

https://gofile.io/d/KOyEmT

KDot227 commented 1 year ago

hey, unfortunelty the code doesn't work since the last update. it gives me the obf file and it runs fine, but somehow my actual batch code doesn't get executed

Can u try turning on and off some of the settings and also try debug. On top of that turn echo off to echo on and see if it executes anything.l of your actual code.

hey how you doing thanx for the help, yea i did turned off all the settings and turned on debug mode and still no luck i can not even see what is actually happening here is the batch code, https://gofile.io/d/mzh4qp

this is the first batch code i have seperated it to two files just incase since this one looks harmless and would not trigger anti virus, but the second one dismantles defender and would more likely get detected so i can change the file anytime by having the first one pointing at the second file, but for both files the obsfcuted file doesn't work.

i will send you the second batch code just incase maybe becomes useful for you.

https://gofile.io/d/KOyEmT

are both not working?

KDot227 commented 1 year ago

I need unobfuscated version too

jamiekarvans commented 1 year ago

yes both not working

i only sent you the unobfuscated ones.

here is the obsfcuted one: https://gofile.io/d/uAbXjH

KDot227 commented 1 year ago

yes both not working

i only sent you the unobfuscated ones.

here is the obsfcuted one: https://gofile.io/d/uAbXjH

ok ok there are a few issues that I am now seeing. 1.) for some reason admin cmd is fubar with env vars. 2.) there was an issue with identifying certain vars. I fixed issue 2 but am still working on issue 1

KDot227 commented 1 year ago

lmk if there are still issues. It seems to somewhat be working now? It's being super messed up with pushd and popd when running with admin.

KDot227 commented 1 year ago

0 idea why too

jamiekarvans commented 1 year ago

it's working perfectly now great job thanx, didn't still worked with get admin code inside bat file but i removed the code and just changed the privilage in the exe created by iexpress using VS and gave it admin level and working just fine aswell.

KDot227 commented 1 year ago

it's working perfectly now great job thanx,

didn't still worked with get admin code inside bat file but i removed the code and just changed the privilage in the exe created by iexpress using VS and gave it admin level and working just fine aswell.

Super weird. I'll keep looking into it to figure stuff out. Another issue is that for some reason the bat file is a LOT slower when ran with admin and I can't think of a single reason why that would happen