Convert complied exe to base64 and run it from memry does not work

Question

1.00/5 (1 vote)

See more:

i still get this error when i try to debug the project i dont know why ...

Quote:
'WindowsApplication13.vshost.exe' (CLR v4.0.30319: WindowsApplication13.vshost.exe): Loaded 'c:\users\evilcode1\documents\visual studio 2013\Projects\WindowsApplication13\WindowsApplication13\bin\Debug\WindowsApplication13.exe'. Symbols loaded.
'WindowsApplication13.vshost.exe' (CLR v4.0.30319: WindowsApplication13.vshost.exe): Loaded 'C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll'. Cannot find or open the PDB file.
'WindowsApplication13.vshost.exe' (CLR v4.0.30319: WindowsApplication13.vshost.exe): Loaded 'msgbox'. Symbols loaded.
A first chance exception of type 'System.Reflection.TargetParameterCountException' occurred in mscorlib.dll
The program '[5392] WindowsApplication13.vshost.exe: Program Trace' has exited with code 0 (0x0).
The program '[5392] WindowsApplication13.vshost.exe' has exited with code -1073741819 (0xc0000005) 'Access violation'

What I have tried:

i write this code and compile it to .exe :

VB

Private Sub Form1_Load(sender As Object, e As EventArgs) Handles MyBase.Load
    me.ShowInTaskbar = False
    me.Opacity = 0

    MessageBox.Show("test", "test")

    MyBase.Close()


End Sub

then i convert compiled .exe to base64 code and i wrote this code to run it :

VB

Public Class Form1

Private Sub Form1_Load(sender As Object, e As EventArgs) Handles MyBase.Load
    MyBase.ShowInTaskbar = False
    MyBase.Opacity = 0





    Dim qassam As String = "8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAA"
    Dim lena As Byte() = Convert.FromBase64String(qassam)


    AppDomain.CurrentDomain.Load(lena).EntryPoint.Invoke(Nothing, Nothing)







End Sub

8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAA = compiled msgbox.exe from step 1 ( converted to base64)

the code does not give me any error just not running

Posted 10-Apr-17 21:37pm

evilcode1

Updated 10-Apr-17 22:08pm

Add a Solution

Comments

Jochen Arndt 11-Apr-17 3:47am

A less than 40 character long string is the base64 encoded image of an executable file?
Impossible.

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

OriginalGriff · Answer 1 · 2017-04-10T22:08:00

Solution 1

Your string is not a valid Base64 string: it's length is wrong at 37 bytes, and I don't believe in the least that a minimal Winforms app will come in at under 7.5K of binary, so I'd be looking for a Base64 string of around 10K.
At a guess, you copy and pasted it badly - check your code that reads the exe file and converts it to Base 64.

Posted 10-Apr-17 22:08pm

OriginalGriff

Comments

evilcode1 11-Apr-17 4:19am

I've shortened it this is the complete one :

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEEACX/6VgAAAAAAAAAAOAAAgELAQsAADwAAAA4AAAAAAAADloAAAAgAAAAYAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADgAAAABAAAAAAAAAIAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAALxZAABPAAAAAIAAABgyAAAAAAAAAAAAAAAAAAAAAAAAAMAAAAwAAAAAYAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAFDoAAAAgAAAAPAAAAAQAAAAAAAAAAAAAAAAAACAAAGAuc2RhdGEAADgBAAAAYAAAAAIAAABAAAAAAAAAAAAAAAAAAABAAADALnJzcmMAAAAYMgAAAIAAAAA0AAAAQgAAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAADAAAAADAAAAAAgAAAHYAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBZAAAAAAAASAAAAAIABQBcMAAAYCkAAAEAAAADAAAGUCAAAHABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtAAAAM7K774BAAAAkQAAAGxTeXN0ZW0uUmVzb3VyY2VzLlJlc291cmNlUmVhZGVyLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkjU3lzdGVtLlJlc291cmNlcy5SdW50aW1lUmVzb3VyY2VTZXQCAAAAAAAAAAAAAABQQURQQURQtAAAALQAAADOyu++AQAAAJEAAABsU3lzdGVtLlJlc291cmNlcy5SZXNvdXJjZVJlYWRlciwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5I1N5c3RlbS5SZXNvdXJjZXMuUnVudGltZVJlc291cmNlU2V0AgAAAAAAAAAAAAAAUEFEUEFEULQAAAAqAAIoTgAACgAAKgAbMAIAQwAAABkAABEAAAJvVwAACgwrEQhvWAAACgsHb1kAAAoK3iYACG9aAAAKDQkt5QDeFAgU/gEW/gENCSwHCG8RAAAKAADcFAorAAYqAAEQAAACAAIAJykAFAAAAAAbMAIAQQAAABoAABEAAAJvVwAACgsrEwdvWAAACgoGA29bAAAKAAArCwAHb1oAAAoMCC3jAN4UBxT+ARb+AQwILAcHbxEAAAoAANwAKgAAAAEQAAACAAIAKSsAFAAAAAAbMAIASQAAABsAABEAAAJvVwAACgwrFwhvWAAACgsHA29cAAAKKF0AAAoK3iYACG9aAAAKDQkt3wDeFAgU/gEW/gENCSwHCG8RAAAKAADcFAorAAYqAAAAARAAAAIAAgAtLwAUAAAAABswAwBCAAAAHAAAEQAAAm9XAAAKCysUB29YAAAKCgYDBG9eAAAKAAArCwAHb1oAAAoMCC3iAN4UBxT+ARb+AQwILAcHbxEAAAoAANwAKgAAARAAAAIAAgAqLAAUAAAAABMwAgASAAAAHQAAEQACA29cAAAKKF0AAAoKKwAGKgAAMgACAwRvXgAACgAAKgAAABMwAgAfAAAAHgAAEQADFP4BCwcsBBQKKxAAAgMoDQAACnNfAAAKCisABioAEzACABwAAAAfAAARAAIDb2AAAApzXwAACgoGA29hAAAKAAYLKwAHKhMwBABUAAAAIAAAEQAFFP4BFv4BDQksQQV1CwAAAQsHFP4BFv4BDQksDgIDBAcoKgAABgorKCsgAAV1DwAAAQwIFP4BFv4BDQksDAIDBAgoKQAABgorBwAAAAUKKwAGKhMwBABoAAAAIQAAEQAFFP4BFv4BDAgsVQV1DQAAGwsHFP4BFv4BDAgsHwcCAwRzKwAABiX+BywAAAZzYgAACigFAAArCisrKyMABSgGAAArAgMEcysAAAYl/gctAAAGc2UAAAooBwAAKworBgAABQorAAYqEzACAJgBAAAiAAARAAUU/gEW/gETEBEQOYABAAAFb2YAAAoLOGQBAAAHb2cAAAoMB29oAAAKExAREDlKAQAAB28IAAArDQdvagAACm9rAAAKEwQJFP4BFv4BExAREDklAQAAAiwDAy0DFisBFwATERERLFgCjrcX2hMFFhEFEw4TCCs+AhEImhMHAxEImhMGEQQRB29sAAAKExERESwbCREGKG0AAAoTEBEQLAcHb24AAAoAABQLACsSAAARCBfWEwgRCBEOExIREjG4AAcU/gEW/gETEREROaoAAAAEFP4BFv4BExARECx/BG9vAAAKF9oTCRYRCRMPEw0rYgQRDW9wAAAKEwoRCm9qAAAKb2sAAAoTDBEKbwgAACsTCxELFP4BFv4BExERESwrEQQRDG9sAAAKExARECwbCRELKG0AAAoTExETLAcHb24AAAoAABQLACsTAAAAEQ0X1hMNEQ0RDxMSERIxlAAHFP4BFv4BExMREywPB29uAAAKAAQHb3EAAAoAAAAAAAgLAAcU/gEW/gETExETOoz+//8ABQorAAYqfgACKE4AAAoAAgN9CgAABAIEfQsAAAQCBX0MAAAEACoTMAQAHgAAACMAABEAAnsKAAAEAnsLAAAEAnsMAAAEAygqAAAGCisABioAABMwBAA4AAAAJAAAEQADdQsAAAEKBhT+ARb+AQwILB0CewoAAAQCewsAAAQCewwAAAQGKCoAAAYLKwgrBQADCysBAAcqEzACADsAAAAlAAARAH4PAAAEFChzAAAKDAgsIHLPAABw0AsAAAIoQAAACm90AAAKc3UAAAoLB4APAAAEAH4PAAAECisABioAEzABAAsAAAAmAAARAH4QAAAECisABioAJgACgBAAAAQAKgAAlnM4AAAGKHYAAAp0DAAAAoARAAAEc04AAAooDQAACoATAAAEACoAACYCKHcAAAoAACoAABMwAQAdAAAAJwAAEQAoCQAABm94A

OriginalGriff 11-Apr-17 4:30am

And that's still only 3.5K - way too short.
Look at your code to generate the Base 64 and what you do with it once you have created it...

evilcode1 11-Apr-17 4:39am

this is my code i coded the base64 converter :

Imports System.IO
Public Class Form1

Private Sub Button1_Click(sender As System.Object, e As System.EventArgs) Handles Button1.Click
Dim OpenFileDialog As New OpenFileDialog
With OpenFileDialog
.Title = "Select EXE File"
.Filter = "Exe Files (*.exe)|*.exe"
.ShowDialog()
End With
TextBox1.Text = OpenFileDialog.FileName
End Sub

Private Sub Button2_Click(sender As System.Object, e As System.EventArgs) Handles Button2.Click
RichTextBox1.Text = ConvertFileToBase64(TextBox1.Text)
End Sub
Public Function ConvertFileToBase64(ByVal fileName As String) As String
Return Convert.ToBase64String(System.IO.File.ReadAllBytes(fileName))
End Function

Private Sub RichTextBox1_TextChanged(sender As Object, e As EventArgs) Handles RichTextBox1.TextChanged

End Sub

Private Sub Button5_Click(sender As Object, e As EventArgs) Handles Button5.Click
Clipboard.SetDataObject(RichTextBox1.Text)

End Sub

Private Sub Form1_Load(sender As Object, e As EventArgs) Handles MyBase.Load

End Sub
End Class

OriginalGriff 11-Apr-17 4:59am

So what does the debugger say is in the lena array before you try to load it as an assembly? And why are you doing this?

evilcode1 11-Apr-17 5:11am

how i can know what the debugger say in lena array ? i run the project in debugging mode and this what i got :

'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.HostingProcess.Utilities\12.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.HostingProcess.Utilities.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.HostingProcess.Utilities.Sync\12.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Debugger.Runtime\12.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Debugger.Runtime.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Users\evilcode1\Documents\Visual Studio 2013\Projects\First lesson\First lesson\bin\Debug\First lesson.vshost.exe'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Windows\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
'First lesson.vshost.exe' (CLR v4.0.30319: First lesson.vshost.exe): Loaded 'C:\Windows\Micro

OriginalGriff 11-Apr-17 5:17am

Put a breakpoint on the line
AppDomain.CurrentDomain.Load(lena).EntryPoint.Invoke(Nothing, Nothing)
And look at lena in the debugger when it hits the breakpoint. You know how to set breakpoints, I assume?

evilcode1 11-Apr-17 5:30am

i put a breakpoint but i didn't get error or maybe i didnt understand can we solive it via teamviwer ?

OriginalGriff 11-Apr-17 5:43am

Breakpoints have nothing to do with errors, and absolutely nothing to do with TeamView. Do you know what you are doing, are are you just grabbing words and guessing?
Because if you don't know what you are doing, say so - and we'll answer assuming a lower level of starting knowledge.

evilcode1 11-Apr-17 5:52am

im new at vb.net i dont know how to use it like a pro ... thats why im here

OriginalGriff 11-Apr-17 6:17am

It's not a case of "prop" or "non-pro" - it's just that we don't know what level of expertise you have. If you are a total beginner, then say so - it means we can assume a lack of knowledge instead of assuming you know the basics!
We don't mind newbies here - we all have to start somewhere - but if we assume you know what you are doing, then we respond as to someone who has the same level of experience we do!

So...start this way: In Visual Studio put the cursor on the line I showed above, and select the "Debug" menu. Chose "Toggle breakpoint" from the menu and a red dot will appear at the beginning of the line - remember where it is.
Click the red dot, and it will disappear. click the same location, and it will come back. That's "toggling a breakpoint" - and while you have a red dot there, when you run you code in the debugger and it tries to execute the method, it will stop when it reaches the breakpoint: passing control to you.
Now you can look at what is in your variables (hover the mouse over a variable name and you'll see what I mean), execute your code line-by-line (called "single stepping"), or even make changes while it's running to see what happens!

Start with that, and give it a try - this is the most powerful tool in any developers toolbox, and it's well worth getting familiar with it: you are going to be using it a *lot* :laugh:

Give it a try and tell me what you find.