1+ using System ;
2+ using System . Collections . Generic ;
3+ using System . ComponentModel ;
4+ using System . Data ;
5+ using System . Diagnostics ;
6+ using System . Linq ;
7+ using System . ServiceProcess ;
8+ using System . Text ;
9+ using System . Threading . Tasks ;
10+ using System . Runtime . InteropServices ;
11+ using Microsoft . Win32 ;
12+ using System . IO ;
13+
14+ namespace NoMoreCookiesService
15+ {
16+ public partial class MainService : ServiceBase
17+ {
18+ [ DllImport ( "kernel32.dll" , SetLastError = true ) ]
19+ private static extern bool CloseHandle ( IntPtr Handle ) ;
20+
21+ [ DllImport ( "kernel32.dll" , SetLastError = true ) ]
22+ private static extern IntPtr GetModuleHandle ( string lib ) ;
23+
24+ [ DllImport ( "kernel32.dll" , SetLastError = true ) ]
25+ private static extern IntPtr GetProcAddress ( IntPtr Module , string Function ) ;
26+
27+ [ DllImport ( "kernel32.dll" , SetLastError = true ) ]
28+ private static extern bool WriteProcessMemory ( IntPtr ProcHandle , IntPtr BaseAddress , string Buffer , int size , int NumOfBytes ) ;
29+
30+ [ DllImport ( "kernel32.dll" , SetLastError = true ) ]
31+ private static extern IntPtr VirtualAllocEx ( IntPtr ProcessHandle , IntPtr Address , int Size , uint AllocationType , uint Protection ) ;
32+
33+ [ DllImport ( "kernel32.dll" , SetLastError = true ) ]
34+ private static extern IntPtr CreateRemoteThread ( IntPtr ProcessHandle , IntPtr ThreadAttributes , uint StackSize , IntPtr StartAddress , IntPtr Parameter , uint CreationFlags , [ Out ] uint ThreadID ) ;
35+
36+ [ DllImport ( "kernel32.dll" , SetLastError = true ) ]
37+ private static extern uint WaitForSingleObject ( IntPtr Handle , uint TimeInMilli ) ;
38+
39+ [ DllImport ( "kernel32.dll" , SetLastError = true ) ]
40+ private static extern bool VirtualFreeEx ( IntPtr ProcessHandle , IntPtr Address , int Size , uint FreeType ) ;
41+
42+ public MainService ( )
43+ {
44+ InitializeComponent ( ) ;
45+ }
46+
47+ public static unsafe int strlen ( string s )
48+ {
49+ int length = 0 ;
50+ fixed ( char * pStr = s )
51+ {
52+ length = * ( ( ( int * ) pStr ) - 1 ) ;
53+ }
54+ return length ;
55+ }
56+
57+ protected override void OnStart ( string [ ] args )
58+ {
59+ string Config = File . ReadAllText ( Environment . CurrentDirectory + "\\ NoMoreConfig.txt" ) ;
60+ string DllPath = null ;
61+ if ( Config == "XMode: Disabled" )
62+ {
63+ if ( Environment . Is64BitProcess )
64+ {
65+ DllPath = @"C:\NoMoreCookies_x64.dll" ;
66+ }
67+ else
68+ {
69+ DllPath = @"C:\NoMoreCookies.dll" ;
70+ }
71+ }
72+ else if ( Config == "XMode: Enabled" )
73+ {
74+ if ( Environment . Is64BitProcess )
75+ {
76+ DllPath = @"C:\XNoMoreCookies.dll" ;
77+ }
78+ else
79+ {
80+ DllPath = @"C:\XNoMoreCookies_x64.dll" ;
81+ }
82+ }
83+ if ( DllPath != null )
84+ {
85+ foreach ( Process ProcessInject in Process . GetProcesses ( ) )
86+ {
87+ try
88+ {
89+ if ( ProcessInject . Id != Process . GetCurrentProcess ( ) . Id )
90+ {
91+ bool IsWow64 = false ;
92+ IntPtr LoadLibraryA = GetProcAddress ( GetModuleHandle ( "kernel32.dll" ) , "LoadLibraryA" ) ;
93+ IntPtr Allocation = VirtualAllocEx ( ProcessInject . Handle , IntPtr . Zero , strlen ( DllPath ) , 0x00001000 | 0x00002000 , 0x04 ) ;
94+ WriteProcessMemory ( ProcessInject . Handle , Allocation , DllPath , strlen ( DllPath ) , 0 ) ;
95+ IntPtr RemoteThread = CreateRemoteThread ( ProcessInject . Handle , IntPtr . Zero , 0 , LoadLibraryA , Allocation , 0 , 0 ) ;
96+ WaitForSingleObject ( RemoteThread , 4000 ) ;
97+ VirtualFreeEx ( ProcessInject . Handle , Allocation , strlen ( DllPath ) , 0x00008000 ) ;
98+ CloseHandle ( RemoteThread ) ;
99+ CloseHandle ( ProcessInject . Handle ) ;
100+
101+
102+ }
103+ }
104+ catch
105+ {
106+ continue ;
107+ }
108+ }
109+ }
110+ this . Stop ( ) ;
111+ }
112+
113+ protected override void OnStop ( )
114+ {
115+
116+ }
117+ }
118+ }
0 commit comments