search

bytecode77 / r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.
https://bytecode77.com/r77-rootkit
BSD 2-Clause "Simplified" License
1.55k stars 382 forks source link

Help #88

Open PROMPTYLOL opened 2 weeks ago

PROMPTYLOL commented 2 weeks ago

I tried to edit the 0E 1F BA 0E 00 B4 09 CD 21 B8 to add the helper signiture to my .exe file (already compiled since I'm using someone elses software) and when I go in test console, it doesn't consider it as a helper process. can I get some help on this?

(i changed it to 72 68 BA 0E 00 B4 09 CD 21 B8)

bytecode77 commented 2 weeks ago

This notation is a constant integer literal in C++, which is in human readable big-endian.

R77_HELPER_SIGNATURE = 0x7268

A binary file will always be little endian, so it's 68 72. You can open TestConsole.exe in a hex editor and look at the binary for a reference.

PROMPTYLOL commented 2 weeks ago

Omg ty i felt so dumb