DayZ Key Stealer Checker v1.2

**[MPGH]master131** · 01-23-2013

DayZ Key Stealer Checker v1.2 by master131

DayZ Key Stealer Checker is a tool designed to aid in the detection and identification of possible key stealers as well as analyse their code and hook registry functions that may be used in a live environment. A fake/pretend key stealer is also included. If you think it's real, use your "magic tools" and check it yourself.

Why DayZ and not Arma 2?
Since key stealers are mainly used for the DayZ mod, that's why I called it that instead.

Features:
- Code analysis for .NET assemblies (WebClient/Registry/WebRequest/WebBrowser)
- .NET language detection (C#, VB.NET and C++/CLI)
- .NET project type detection (Console, Class Library, Windows Forms and Windows Presentation Forms)
- Generic obfuscator detection
- Live analysis of code with registry hooks
- Registry hooks are 32-bit and 64-bit compatible
- Works with "Confused" and obfuscated assemblies

Changes:

Code:

Changes since version 1.2 (23rd January 2013):
- Added WebBrowser and Registry (not RegistryKey) support (thanks to some stupid kid)
- Added support for Confused assemblies on Maximum protection
- Renamed from "DayZ Key Protector" to "DayZ Key Stealer Checker"

Changes since version 1.1 (20th January 2013):
- Added string detection for ARMA II registry key
- Added "proxy call" detection for obfuscators which made key stealers come up as clean

Known limitations:
- Native applications are not supported yet (eg. C/C++/Delphi)

What is Live Analysis?
Live Analysis will actually launch the program you are analysing except, the registry functions used by .NET will be intercepted when it finds a registry key containing Bohemia in it and alert you about it. From then, you can allow, deny or terminate the process.

Disclaimer:
I am not responsible if this tool reports that something is clean and you end up with your key stolen. Same thing applies to live analysis too. Like the top of the page says, it's only to AID in the detection of key stealers. It's possible that they can come up clean if some anti-analysis techniques have been employed.

Virus Scans:
https://www.virustotal.com/file/00f0...is/1358936565/
https://virusscan.jotti.org/en/scanre...4a7cd8b8b1880a

Any detections are false positives.

Requirements:
.NET Framework 4 Client Profile

Credits:
@Jason - For being awesome and helping with the live analysis bit.
Marton Anka - For MHook which are used in the registry hooks.
Matt Conover - For creating tDisasm which is used in MHook.
0xd4d - For creating dnlib.

Thread On How To Avoid Key Stealers

**TEAMKILLER** · 01-23-2013

Very nice release! I hope the section will be more safe with v 1.2

Key Protector sounds better though.

**[MPGH]master131** · 01-23-2013

Originally Posted by TEAMKILLER

Very nice release! I hope the section will be more safe with v 1.2

Key Protector sounds better though.

Yeah, but it was causing confusion so I changed the name.

EDIT - Forgot to add the license for dnlib (MIT), I've updated the attachment.

Also, as an added side note, I laughed when I tried sending random data to a key stealer:

I'm sorry whoever you are, but you didn't get my IP.

**nikkin** · 01-23-2013

Nice,master,i like your programms)) new version so good)

**TEAMKILLER** · 01-23-2013

That side looks like chews method right? I were DDoSed because i had a account there, i was only going to see if it actually works and then an idiot ddosed and ratted me. I didnt even have keys in my DB.