Closed TheDarkMythos closed 3 years ago
Looks like some injected application is crashing and maybe restarting each time it crashes, causing this "WerFault loop".
Could you check the EventVwr to see which application it is? If you could provide some details on that and the info from EventVwr, I could try to reproduce the issue.
Also, just to keep in mind: If you are implementing r77 in your application, make sure that your application isn't injected by r77. You can do this by using the $77 prefix.
Yes, I know which app it is!! ok, thank you very much! That error comes any time I create a new file with the prefix name. I will now install a new VM and try to reproduce this error and i will let you know.
can I use the old installer C# to install it?
The old installer writes to AppInit_DLLs, but I did not use this technique in the new version, because:
You can use it, thought, but I don't recommend it. I would rather investivate in your issue further.
If the app that's crashing is one of your own projects, then please make sure, that:
If the crashing app is a Windows component, then it is a bug that should be fixed. In this case, I need info about the process, the OS and the EventVwr log entry.
Thank you very much for this info!!
A question: Do you have the errors in your initial post with the old installer, or with the new installer (1.0.x)? I never tested the new DLL's with the old AppInit_DLL installer.
Regarding C#: Yes, it is possible and very trivial. Have a look at Intall.cpp. All it does is this:
(on Windows x86, do each task only once)
Install.cpp has source code comments that explain how the installation is implemented.
I won't port it to C#, but it should be fairly trivial to implement the installer as a C# method in your project. The file InstallStager.exe contains both DLL's and the r77 service. I'd also recommend you to read my documentation as it describes the complete process and what exactly to consider when using the rootkit.
You can basically write a downloader for InstallStub.exe.
Yes, I got the error with the old version of the installer, but the dll's I use is from the new version .!! thank you for taking the time to answer me!! You have done great work here!! I will take a look yes!
Glad to hear everything is working as expected :)
I've also updated the documentation with best practices for implemenation. It's not yet on the website as a PDF. But the dev-branch contains the current Documentation.docx
After installing it, I get these errors on task manager, any idea how to fix this?![Screenshot_1](https://user-images.githubusercontent.com/23459052/112748197-ed253c80-8fc2-11eb-842e-e19c63b75f68.png)