[question] evading firewalls
so i’ve been writing my malware in c++, but i foolishly uploaded my malware on [virustotal.com](http://virustotal.com) which first did not detect anything, but now it does.

does anyone know of a way to evade antivirus’s, i’ve tried encrypting and decrypting the payload using stub method in memory, but it is still detected. …
virustotal shares their data with antivirus vendors or never upload there to check. i m no expert on malware writing but veil evasion payload + cryptor is fud most of the time however if you are trying to learn malware coding i ve seen some good courses, check one of em out
How about in c++?



[http://www.1cplusplusstreet.com/vb/scripts/ShowCode.asp?txtCodeId=6877&lngWId=3](/posts/bad_link/258354?url=http%3A%2F%2Fwww.1cplusplusstreet.com%2Fvb%2Fscripts%2FShowCode.asp%3FtxtCodeId%3D6877%26lngWId%3D3) It' just standard c++ ifstream and ofstream. When the program starts, try to open the file, if it success then read it. Unicode can be a problem, and Perl has its own quirks. Essentially, Perl creates a firewall that surrounds all Unicode I / O capabilities. You must tell Perl if the I / O path is encoded. If so, the DECODE rule for any input and / or ENCODE for any output.


Decoding converts the data from {encoding} to Perl's internal representation, which is probably a combination of bytes and code points.


The coding is just the opposite.


Thus, it is actually possible to "decode into" and "encode" up to two different encodings. You just need to say what it is. Encoding / decoding is usually done with the file I / O layer, but you can use the encoding module (distribution part) to manually convert between encodings.


 [perldocs in Unicode](https://translate.googleusercontent.com/translate_c?depth=1&pto=aue&rurl=translate.google.com&sl=ru&sp=nmt4&tl=en&u=) does not read light.



  




 (adsbygoogle = window.adsbygoogle || []).push({});
 
  

Here's an example that can help visualize it (there are many other ways).



```
use strict;
use warnings;
use Encode;


# This is an internalized string with these UTF-8 codepoints
# 
my $internal_string_1 = "\x{C7}\x{69}\x{64}\x{65}\x{6D}\x{5F}\x{15E}\x{65}\x{6E}\x{65}\x{72}\x{20}\x{48}\x{FC}\x{73}\x{6E}\x{FC}\x{20}\x{54}\x{61}\x{11F}\x{6C}\x{69}\x{70}";


# Open a temp file for writing as UTF-8.
# Output to this file will be automatically encoded from Perl internal to UTF-8 octets.
# Write the internal string.
# Check the file with a UTF-8 editor.
# 
open (my $out, '>:utf8', 'temp.txt') or die "can't open temp.txt for writing $!";
print $out $internal_string_1;
close $out;


# Open the temp file for readin as UTF-8.
# All input from this file will be automatically decoded as UTF-8 octets to Perl internal.
# Read/decode to a different internal string.
# 
open (my $in, '<:utf8', 'temp.txt') or die "can't open temp.txt for reading $!";
$/ = undef;
my $internal_string_2 = <$in>;
close $in;


# Change the binmode of STDOUT to UTF-8.
# Output to STDOUT will now be automatically encoded from Perl internal to UTF-8 octets.
# Capture STDOUT to a file then check with a UTF-8 editor.
# 
binmode STDOUT, ':utf8';
print $internal_string_2, "\n\n";


# Use encode() to convert an internal string to UTF-8 octets
# Format the UTF-8 octets to hex values
# Print to STDOUT
# 
my $octets = encode ("utf8", $internal_string_2);
print "Encoded (out) string -> UTF-8 (octets):\n";
print " length = ".length($octets)."\n";
print " octets = $octets\n";
print " HEX val = ";
for (split //, $octets) {
    printf ("0x%X ", ord($_));
}
print "\n\n";


# Use decode() to convert external UTF-8 octets to an internal string.
# Format the internal string to codepoints (hex values).
# Print to STDOUT.
# 
my $internal_string_3 = decode ("utf8", $octets);
print "Decoded (in) string <- UTF-8 (octets):\n";
print " length = ".length($internal_string_3)."\n";
print " string = $internal\_string\_3\n";
print " code points = ";
for (split //, $internal_string_3) {
    printf ("\\x{%X} ", ord($_));
}

        

        
        
        
 (adsbygoogle = window.adsbygoogle || []).push({});
 
        

    
```

Output



```
Çidem\_Şener Hüsnü Tağlip

Encoded (out) string -> UTF-8 (octets):
   length  =  29
   octets  =  Ãidem\_Åener HÃ¼snÃ¼ TaÄlip
   HEX val = 0xC3 0x87 0x69 0x64 0x65 0x6D 0x5F 0xC5 0x9E 0x65 0x6E 0x65 0x72 0x20 0x48 0xC3 0xBC 0x73 0x6E 0xC3 0xBC 0x20 0x54 0x61 0xC4 0x9F 0x6C 0x69 0x70

Decoded (in) string <- UTF-8 (octets):
   length      =  24
   string      =  Çidem\_Şener Hüsnü Tağlip
   code points = \x{C7} \x{69} \x{64} \x{65} \x{6D} \x{5F} \x{15E} \x{65} \x{6E} \x{65} \x{72} \x{20} \x{48} \x{FC} \x{73} \x{6E} \x{FC} \x{20} \x{54} \x{61} \x{11F} \x{6C} \x{69} \x{70}

        

        
        
        
 (adsbygoogle = window.adsbygoogle || []).push({});
 
        

    
``` Not likely. If a script can't work, then it also can't detect that it's not working... The workaround is to create a warning message that's always visible by default and then use a script to hide it (for example, by making a field that's placed on top of it hidden). If the script executes, the message is hidden when the file is opened. If it's not, the message remains visible. another prevention method i use = fsrminstructions can be found at: http://jpelectron.com/stopcrypto post the hacks.h code, to see if you got any errors there as well 

fix this small syntax mistakes found on hacks.cpp




greets,

voidisalive [image] dueck456:

is there an easy way to detect when new code is flashed to the device so i can reinitialize the retained variables?

below is a link to a post by [@rickkas7](/u/rickkas7) about storing retained data in a struct.

[image] dueck456:

saving a know value to eeprom jumps to mind

there is … you need a macro. a small extract of the four sheets may be uploaded to 
  
www.speedyshare.com without password. more information: [c++ friend functions](http://www.tutorialspoint.com/cplusplus/cpp_friend_functions.htm) this issue is now confirmed fixed by a large percentage of our user base. if you're still having issues, please make sure you on the latest version of malwarebytes (at the time of this article, it's malwarebytes 3.5.1.2522 with component package version 1.0.441).
 


 


 if you continue to have issues after that, please make a new post using the following as a guideline