QuestionBanned on main

Posts 1–6 of 6 · Page 1 of 1
Banned on main
Hello MPGH Staff,

I am Bastamanga my main mpgh account is Joered. I have a question.
Today 27-12-2014 my main was banned after i launched my new injector yesterday. The argument for my ban states that i posted a outside download link. I don't know where this outside download link is/was placed? My thread for my injector has been removed so i guess it has to do something with that.

As far as i know there was no outside download link in that thread. I uploaded the screenshot and the .rar file in the MPGH attachments and posted 2 virusscans. The only outside download link i can think about is in the injector self (let me explain).
My injector searches on a link for current version:
Code:
Dim web As New WebClient
        Dim Update As String = web.DownloadString("Just a link to outside .txt file with the number of the version 1.0.0.0")

        If Update.Contains(Application.ProductVersion) Then
            'MsgBox("No updates found") 
        Else
            MsgBox("New version avaible, you will be redirected")
Is the version posted online diffrent than the user uses it will let him download the new version of the injector. (It will bring the user to the place he can get it from, my folder on the site):
Code:
System.Diagnostics.Process.Start("link to a folder online were people can download the new .exe")
Is this the reason of my lifetime ban?


Thanks for the time to read and have a nice new year.

Joered/Bastamanga
You had a media fire link in your injector @Bastamanga

I didn't download the linked file, though it doesn't matter whether or not it is malicious. Multiple lines also included web protocol related features. Also, when running the injector, there was no button even for an "update" feature like you suggest, so obviously all of the web stuff was not intended for the user to control. Auto-update programs are also not allowed.

All of these are against the rules and each one is considered a perm-ban offense.
Quote Originally Posted by maddoggy00 View Post
You had a media fire link in your injector @Bastamanga

I didn't download the linked file, though it doesn't matter whether or not it is malicious. Multiple lines also included web protocol related features. Also, when running the injector, there was no button even for an "update" feature like you suggest, so obviously all of the web stuff was not intended for the user to control. Auto-update programs are also not allowed.

All of these are against the rules and each one is considered a perm-ban offense.
Do you still have the file with you?
Okay i did not know that, i did not read the rules very well i see. Mm to bad i make a injector that is not a tread to a single person and got rewarded with a lifetime ban, i messed up but still in my opinion i dont deserve that life time ban cause i messed up once after three years on mpgh and a all the releases i did not mess up.

the reason there is no update button is cause if there is no update there is no need for a update button. Here i will show u everything

- - - Updated - - -

Code:
Imports System.Management
Imports System.Net

Public Class Form1
    Dim cpuInfo As String = String.Empty
    Dim mc As New ManagementClass("win32_processor")
    Dim moc As ManagementObjectCollection = mc.GetInstances()

    Private TargetProcessHandle As Integer
    Private pfnStartAddr As Integer
    Private pszLibFileRemote As String
    Private TargetBufferSize As Integer

    Public Const PROCESS_VM_READ = &H10
    Public Const TH32CS_SNAPPROCESS = &H2
    Public Const MEM_COMMIT = 4096
    Public Const PAGE_READWRITE = 4
    Public Const PROCESS_CREATE_THREAD = (&H2)
    Public Const PROCESS_VM_OPERATION = (&H8)
    Public Const PROCESS_VM_WRITE = (&H20)
    Dim DLLFileName As String 'Made by Joered333
    Public Declare Function ReadProcessMemory Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpBaseAddress As Integer, _
    ByVal lpBuffer As String, _
    ByVal nSize As Integer, _
    ByRef lpNumberOfBytesWritten As Integer) As Integer

    Public Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" ( _
    ByVal lpLibFileName As String) As Integer

    Public Declare Function VirtualAllocEx Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpAddress As Integer, _
    ByVal dwSize As Integer, _
    ByVal flAllocationType As Integer, _
    ByVal flProtect As Integer) As Integer

    Public Declare Function WriteProcessMemory Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpBaseAddress As Integer, _
    ByVal lpBuffer As String, _
    ByVal nSize As Integer, _
    ByRef lpNumberOfBytesWritten As Integer) As Integer

    Public Declare Function GetProcAddress Lib "kernel32" ( _
    ByVal hModule As Integer, ByVal lpProcName As String) As Integer

    Private Declare Function GetModuleHandle Lib "Kernel32" Alias "GetModuleHandleA" ( _
    ByVal lpModuleName As String) As Integer
    'Made by Joered333
    Public Declare Function CreateRemoteThread Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpThreadAttributes As Integer, _
    ByVal dwStackSize As Integer, _
    ByVal lpStartAddress As Integer, _
    ByVal lpParameter As Integer, _
    ByVal dwCreationFlags As Integer, _
    ByRef lpThreadId As Integer) As Integer

    Public Declare Function OpenProcess Lib "kernel32" ( _
    ByVal dwDesiredAccess As Integer, _
    ByVal bInheritHandle As Integer, _
    ByVal dwProcessId As Integer) As Integer

    Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" ( _
    ByVal lpClassName As String, _
    ByVal lpWindowName As String) As Integer

    Private Declare Function CloseHandle Lib "kernel32" Alias "CloseHandleA" ( _
    ByVal hObject As Integer) As Integer


    Dim ExeName As String = IO.Path.GetFileNameWithoutExtension(Application.ExecutablePath)

    'Credits to Menalix for the AntiDump method
    Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As IntPtr, ByVal lpBaseAdress As Integer, ByRef lpBuffer As Integer, ByVal nSize As Integer, Optional ByRef lpNumberOfBytesRead As Integer = 0) As Boolean
    Declare Sub ZeroMemory Lib "kernel32" (ByVal handle As IntPtr, ByVal length As UInt32)
    Declare Function VirtualProtect Lib "kernel32" (ByVal lpAddress As IntPtr, ByVal dwSize As Integer, ByVal flNewProtect As Integer, ByRef lpflOldProtect As UInteger) As Boolean

    Public Sub AntiDump()
        Try
            Dim x(0) As Process
            x(0) = Process.GetCurrentProcess
            Dim dwOld As UInteger = 0
            Dim wNumberOfSections As Integer = 0
            Dim dwPEHeader As Integer = 0
            Dim SectionTableOffset As Integer = 0
            Dim ModuleBaseAddr As Integer = Process.GetCurrentProcess.MainModule.BaseAddress
            Dim PEHeaderDwords() As Integer = {&H0, &H8, &HC, &H10, &H16, &H1C, &H20, &H28, &H2C, &H34, &H3C, &H4C, &H50, &H54, &H58, &H60, &H64, &H68, &H6C, &H70, &H74, &H104, &H108, &H10C, &H110, &H114, &H11C}
            Dim SectionTableDwords() As Integer = {&H8, &HC, &H10, &H14, &H18, &H1C, &H24}
            Dim SectionTableWords() As Integer = {&H20}
            Dim PEHeaderWords() As Integer = {&H4, &H16, &H18, &H40, &H42, &H44, &H46, &H48, &H4A, &H4C, &H5C, &H5E}
            Dim PEHeaderBytes() As Integer = {&H1A, &H1B}
            ReadProcessMemory(x(0).Handle, ModuleBaseAddr + &H3C, dwPEHeader, 4)
            SectionTableOffset = dwPEHeader + &HFA
            ReadProcessMemory(x(0).Handle, ModuleBaseAddr + dwPEHeader + &H6, wNumberOfSections, 2)
            VirtualProtect(ModuleBaseAddr, 30, &H40, dwOld)
            ZeroMemory(ModuleBaseAddr, 30)
            VirtualProtect(ModuleBaseAddr, 30, dwOld, Nothing)
            For Each c As Integer In PEHeaderDwords
                VirtualProtect((ModuleBaseAddr + dwPEHeader) + c, 4, &H40, dwOld)
                ZeroMemory((ModuleBaseAddr + dwPEHeader) + c, 4)
                VirtualProtect((ModuleBaseAddr + dwPEHeader) + c, 4, dwOld, Nothing)
            Next
            For Each c As Integer In PEHeaderWords
                VirtualProtect((ModuleBaseAddr + dwPEHeader) + c, 2, &H40, dwOld)
                ZeroMemory((ModuleBaseAddr + dwPEHeader) + c, 2)
                VirtualProtect((ModuleBaseAddr + dwPEHeader) + c, 2, dwOld, Nothing)
            Next
            For Each c As Integer In PEHeaderBytes
                VirtualProtect((ModuleBaseAddr + dwPEHeader) + c, 1, &H40, dwOld)
                ZeroMemory((ModuleBaseAddr + dwPEHeader) + c, 1)
                VirtualProtect((ModuleBaseAddr + dwPEHeader) + c, 1, dwOld, Nothing)
            Next
            Dim i As Integer = 0
            Dim i2 As Integer = 0
            While i <= wNumberOfSections
                If i2 = 0 Then
                    VirtualProtect((ModuleBaseAddr + dwPEHeader + &HFA + (&H28 * i)) + SectionTableWords(0), 2, &H40, dwOld)
                    ZeroMemory((ModuleBaseAddr + dwPEHeader + &HFA + (&H28 * i)) + SectionTableWords(0), 2)
                    VirtualProtect((ModuleBaseAddr + dwPEHeader + &HFA + (&H28 * i)) + SectionTableWords(0), 2, dwOld, Nothing)
                End If
                VirtualProtect((ModuleBaseAddr + dwPEHeader + &HFA + (&H28 * i)) + SectionTableDwords(i2), 4, &H40, dwOld)
                ZeroMemory((ModuleBaseAddr + dwPEHeader + &HFA + (&H28 * i2)) + SectionTableDwords(i2), 4)
                VirtualProtect((ModuleBaseAddr + dwPEHeader + &HFA + (&H28 * i)) + SectionTableDwords(i2), 4, dwOld, Nothing)
                i2 += 1
                If i2 = SectionTableDwords.Length Then
                    i += 1
                    i2 = 0
                End If
            End While
        Catch ex As Exception

        End Try
    End Sub

    Sub Protect()

        Dim TargetProcess1() As Process = Process.GetProcessesByName("Fiddler")
        Dim TargetProcess2() As Process = Process.GetProcessesByName("SimpleAssemblyExplorer")
        Dim TargetProcess3() As Process = Process.GetProcessesByName("Reflector")
        Dim TargetProcess4() As Process = Process.GetProcessesByName("HxD")
        Dim TargetProcess5() As Process = Process.GetProcessesByName("Ollydb")

        If Not TargetProcess1.Length = 0 Then
            TargetProcess1(0).Kill()
            MsgBox("Fiddler Detected!", MsgBoxStyle.Critical, "Close the following program")
            Me.Close()
        End If

        If Not TargetProcess2.Length = 0 Then
            TargetProcess2(0).Kill()
            MsgBox("SimpleAssemblyExplorer Detected!", MsgBoxStyle.Critical, "Close the following program")
            Me.Close()
        End If

        If Not TargetProcess3.Length = 0 Then
            TargetProcess3(0).Kill()
            MsgBox("Reflector Detected!", MsgBoxStyle.Critical, "Close the following program")
            Me.Close()
        End If

        If Not TargetProcess4.Length = 0 Then
            TargetProcess4(0).Kill()
            MsgBox("HxD Detected!", MsgBoxStyle.Critical, "Close the following program")
            Me.Close()
        End If

        If Not TargetProcess5.Length = 0 Then
            TargetProcess5(0).Kill()
            MsgBox("Ollydb Detected!", MsgBoxStyle.Critical, "Close the following program")
            Me.Close()
        End If
    End Sub

    Private Sub Inject()
        On Error GoTo 1
        Timer2.Stop()
        Dim TargetProcess As Process() = Process.GetProcessesByName(TextBox1.Text)
        TargetProcessHandle = OpenProcess(PROCESS_CREATE_THREAD Or PROCESS_VM_OPERATION Or PROCESS_VM_WRITE, False, TargetProcess(0).Id)
        pszLibFileRemote = OpenFileDialog1.FileName
        pfnStartAddr = GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA")
        TargetBufferSize = 1 + Len(pszLibFileRemote)
        Dim Rtn As Integer
        Dim LoadLibParamAdr As Integer
        LoadLibParamAdr = VirtualAllocEx(TargetProcessHandle, 0, TargetBufferSize, MEM_COMMIT, PAGE_READWRITE)
        Rtn = WriteProcessMemory(TargetProcessHandle, LoadLibParamAdr, pszLibFileRemote, TargetBufferSize, 0)
        CreateRemoteThread(TargetProcessHandle, 0, 0, pfnStartAddr, LoadLibParamAdr, 0, 0)
        CloseHandle(TargetProcessHandle)
1:      Me.Show()

        If CheckBox1.Checked = True Then
            Me.Close()

        Else
            Me.Show()
        End If

    End Sub
    Private Sub Form1_Load()
        If App.PrevInstance = True Then Call MsgBox("This program is already running!", vbExclamation)
        Me.Close()
    End Sub


    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Timer1.Start()
        If Connection() = True Then
            For Each mo As ManagementObject In moc
                If cpuInfo = "" Then
                    cpuInfo = mo.Properties("processorID").Value.ToString()
                    Exit For
                End If
            Next

            Dim HWID As String

            HWID = cpuInfo

            Dim wc As New WebClient
            Dim strings As String
            strings = wc.DownloadString(" Pastebin txt file with HWID numbers") 'I dont use this function since i wanted the injector to be tested and to be public 

            wc.Dispose()

            If strings.Contains(HWID) Then
                Me.Show()
                MsgBox("Logged in as registered user", MsgBoxStyle.Information)
            End If
            If strings.Contains(HWID) = False Then 'Public version so dont care about Registered or not
                'MsgBox("Logged in as guest.", MsgBoxStyle.Information)
                'Me.Close() instead of Me.Show() if u want people to disconect by missing HWID number online
            End If
        Else
            MsgBox("There is something wrong with the connection", MsgBoxStyle.Information)
            Me.Close()
        End If


        'Checking for avaible update method 
        Dim web As New WebClient
        Dim Update As String = web.DownloadString("a pastebin file with the text: 1.0.0.0")

        If Update.Contains(Application.ProductVersion) Then
            'MsgBox("No updates found") or do what ever you want. I preffer nothing to show up/ happen when the version of the .exe is correct, pretty anoyying al those msgboxes
        Else
            MsgBox("New version avaible, you will be redirected")
            Me.Opacity = 0.0
            Form2.Show()
        End If
        'End of update check

        Button1.Text = "Browse"
        Label1.Text = "Waiting for .dll"
        Timer2.Interval = 50
        Timer2.Start()

    End Sub

    Public Function Connection() As Boolean 'to check the connection of the user
        Dim sitetocheck As New System.Uri(" i just set it to google link to check for connection")
        Dim checkrequest As System.Net.WebRequest
        checkrequest = System.Net.WebRequest.Create(sitetocheck)
        Dim objResp As System.Net.WebResponse
        Try
            objResp = checkrequest.GetResponse
            objResp.Close()
            checkrequest = Nothing
            Return True
        Catch x As Exception
            Return False
        End Try
    End Function

    Private Sub Timer1_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer1.Tick
        Protect()
    End Sub

    Private Sub Timer2_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer2.Tick
        If IO.File.Exists(OpenFileDialog1.FileName) Then
            Dim TargetProcess As Process() = Process.GetProcessesByName(TextBox1.Text)
            If TargetProcess.Length = 0 Then
                Me.Label1.Text = ("Waiting for " + TextBox1.Text + ".exe")

            Else
                Timer2.Stop()
                Me.Label1.Text = "Successfully Injected!"
                Call Inject()
            End If
        Else

        End If
    End Sub

    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        OpenFileDialog1.Filter = "DLL (*.dll) |*.dll|(*.*) |*.*"
        OpenFileDialog1.ShowDialog()
        Dim FileName As String
        FileName = OpenFileDialog1.FileName.Substring(OpenFileDialog1.FileName.LastIndexOf("\"))
        Dim DllFileName As String = FileName.Replace("\", "")
        Me.TextBox2.Text = (DllFileName)
    End Sub

    Private Function Dlls() As Object
        Throw New NotImplementedException
    End Function

    Private Sub Button2_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button2.Click
        End
    End Sub

    Private Sub Button3_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button3.Click
        MsgBox("Credits: Joered333, Bastamanga, Menalix, BlazeD")
    End Sub

    Private Sub Label1_Click(sender As System.Object, e As System.EventArgs) Handles Label1.Click

    End Sub

    Private Sub TextBox2_TextChanged(sender As System.Object, e As System.EventArgs) Handles TextBox2.TextChanged

    End Sub

    Private Sub TextBox1_TextChanged(sender As System.Object, e As System.EventArgs) Handles TextBox1.TextChanged

    End Sub

    Private Function App() As Object
        Throw New NotImplementedException
    End Function

    Private Sub Label3_Click(sender As System.Object, e As System.EventArgs)
        

    End Sub

    Private Sub CheckBox1_CheckedChanged(sender As System.Object, e As System.EventArgs) Handles CheckBox1.CheckedChanged

    End Sub

    Private Sub Button4_Click(sender As System.Object, e As System.EventArgs) Handles Button4.Click
        If IO.File.Exists(OpenFileDialog1.FileName) Then
            Dim TargetProcess As Process() = Process.GetProcessesByName(TextBox1.Text)
            If TargetProcess.Length = 0 Then
                Me.Label1.Text = ("Waiting for " + TextBox1.Text + ".exe")

            Else
                Timer2.Stop()
                Me.Label1.Text = "Successfully Injected!"
                Call Inject()
            End If
        Else
        End If

    End Sub

    Private Sub CheckBox2_CheckedChanged(sender As System.Object, e As System.EventArgs) Handles CheckBox2.CheckedChanged
        If CheckBox2.Checked Then
            Timer2.Stop()

        else

        End If

    End Sub
End Class
Form2
Code:
Public Class Form2

    Private Sub Form2_Load(sender As System.Object, e As System.EventArgs) Handles MyBase.Load


    End Sub

    Private Sub Button1_Click(sender As System.Object, e As System.EventArgs) Handles Button1.Click

        System.Diagnostics.Process.Start("Link to site to download new update so it should be a new mpgh thread after all")


    End Sub
End Class
Ban lifted. Be sure not to include links again.
Posts 1–6 of 6 · Page 1 of 1
This thread is closed for replies.

Similar Threads

Tags for this Thread

None

Need help?