The Oven

Tool World => Development and code snippets => Topic started by: bob.omb on November 08, 2017, 01:30:31 AM

Title: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 08, 2017, 01:30:31 AM
So frustrating  :mad: ..... I ran the Malwarebytes 3.3 installer in my PE build, downloaded straight from the site, ---> it ran and installed perfectly <--- performed an update, ran a scan... Started building an Innounp plugin for everyone (Which is way easier than it previously used to be because Malwarebytes now only packages dllname,1.dll and dllname,2.dll - only 32bit and 64bit versions, no more 5/6 diff DLL's for each ver of windows.. Also only 1 .sys file into sys32\drivers instead of 3-4 drivers identified as well...) Went to bed thinking I was going to share it with all of you this morning... Tried to run the installer again to grab the reg keys and  :sad: :sad: :sad: It won't run and is throwing an error...NO CHANGE IN BUILD. The only thing I was playing with were dependencies for another application from inside the same build, tried retracing ->EXACT<- steps no luck. Driving me crazy for the past 24hrs.  Anyone able to get the installer to run to grab the reg keys from within a 10PESE build to generate the correct keys?

[attach=1]

The error is supposedly caused by a certificate error that normally can be fixed with certmgr.msc by deleting untrusted certificates.  Something similar is happening here I have no idea how it ran before  :huh: The applications I was using were password reset applications im not sure if that would reset the untrusted certificates or pave way for installation but I will keep testing in the meantime.
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: RoyM on November 08, 2017, 02:33:25 AM
Shoot me some MWBytes_3.3 links
I Need Winbuilder Version/Build/.ISO info/Arch. etc... INFO
"I'll be glad to help".
I assume you just need Regshot Unicode output.
I will also try to capture running Regshot, Regshot Unicode, and What Changed.
"It sometimes helps to have more info".
Running depends and GetDeps.au3 help immensely.

I'm not sure I get the "NO CHANGE IN BUILD" thing.
"You are booting a Win10PESE in VM:???, and then running the Installer.
It should be a blank slate...

Regards
RoyM
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 08, 2017, 02:44:26 AM
It is crazy I literally was super excited to bring this to TheOven and  :huh: I cannot reproduce what allowed the installer to run...

Link for Malwarebytes:
https://www.malwarebytes.com/mwb-download/thankyou/ (https://www.malwarebytes.com/mwb-download/thankyou/)

Not sure if the correct CLSID etc will populate in the keys unless created during install in PE

-I Never test in VM, although they are quicker they do not always give the same results as the real thing.. which leads to :turtle: but its worth it.

I was working on Heidoc iso downloader and 2 password reset plugins, nothing crazy I didn't even move anything into system32 or run any installers, I just tried to run heidoc and use proc monitor, failed to find anything useful at first glance, used my password resets to ensure they wouldnt crash, then ran mbam3 installer smh I do not know...Almost like it was a bug it ran...so mad I didn't get reg keys I missed my opportunity

Latest winbuilder, win10PESE -  source v1709, x64, net framework full package run from cd, c redist full package(default full package) run from cd as well



Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: Lancelot on November 08, 2017, 12:52:12 PM
net framework full package run from cd,

Run from Ram  :wink:

Reply 5
http://theoven.org/index.php?topic=2260.msg24422#msg24422

:turtle:
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 08, 2017, 04:19:43 PM
I tried rebuilding with "run from ram" for .NET plugin and same error.  Not sure if its a .NET problem.  It may only be for the installer and somehow a bug let me run it once already... I think its a security certificate issue(trust), I extracted setup with innounp to get a copy of the certificates from {tmp} folder, to try to add them to trusted list.  I can get all the dependencies for windows cert system (almost) the cert*.dll/exe/msc from sys32 into my build, and view cert mgr but still cant import(button greyed out).

I think the only issue here is with the installer though.  Once correct keys are able to be copied into plugin and file placement is correct should work great.  Installer is the brick wall..
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 11, 2017, 05:47:39 AM
 :w00t: the hardest part is done!

Still work needs to be done...plugin not complete

In order to get installer working in PE ImRamdisk must used to remove b: or installer will not run.  An error is thrown when using virtual disk for temp location. (This is only needed during install while getting plugin together)

Temp and Tmp environment variables must be changed to something other than b: (create a folder named temp on y:)
Code: [Select]
set temp=y:\temp
set tmp=y:\temp

Then installer will run..  :thumbsup:

[attach=1]

I may still need help with plugin creation  :embarrassed: we will see...



Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 11, 2017, 04:30:16 PM
I am trying to add a download option to this plugin.

When using
Code: [Select]
%FileWeb_x86%=https://downloads.malwarebytes.com/file/mb3

The file is downloaded with no extension?

The above link automatically direct downloads the latest version, wget gets the right file it just doesn't use the correct name, the file thats downloaded can be renamed to .exe  Is this normal for download button? Is there a way to add a name or should I have the script rename it to latestmb3.exe? I currently am renaming the file after download get an error that the download didn't complete correctly however it is working correctly...(this only happens when i rename the file though, i think there is error checking to make sure file is downloaded and im renaming before it can check, i can fix this if this is the best way) Trying to make this correctly for community.
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 12, 2017, 12:45:43 AM
Also after moving everything into place in a new build I get the following error when running mbam.exe and it does not load.  Services are running but application won't open.  If I remove ramdisk and re-run the installer the application will open fine. (If I remove ramdisk and do not rerun the installer it still gives the same error, the ramdisk is not the problem for this only for install.) I am missing something..

ProgramData\MBAMService folder moved into ProgramData in wim / mbae64.sys and mbamswissarmy.sys moved moved into sys32\drivers folder in wim / program lives on y:\programs\malwarebytes (run from cd)

Added starting services to switchtoadmin.ini (mbamservice and mbamswissarmy), services start fine..

mbamtray loads fine if manually run..

These are the keys used(attached, too big to post), w/all files in place
[attach=2]

My post count is getting a little high, sorry about that, but that's everything I got on the topic, the only thing left now is final fix.

**EDIT - I finally found out how I was able to get the installer to run without using ImDisk to remove the ramdrive(b:) - During system startup if you load the installer quickly enough (it seems before the ramdisk has time to load??) the installer will run without issue, all you need to do is quickly navigate to the mb3 installer file and select which language you would like...  once the installer GUI appears you can then wait as long as you'd like to proceed, about 10 seconds after you land on the desktop is all the time you have to do this)
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 19, 2017, 12:45:42 AM
More work has been done. - A plugin which leads us to the final hurdle has been created.  *EDIT

Hopefully this makes it easier for others interested in this plugin to contribute to it.  And also to easier to identify what if anything we are missing.

95% working Plugin attached (Program won't run yet, same error as above post.. this is the last obstacle to overcome for working plugin.)

To get to this point took a decent amount of effort, but we are here at this point because of the value of this tool, I hope others see the value as well and will take a look at this one with us.

BTW - In current state this is hardcoded for "Run from Ram" in a few minor ways.
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: DaPuffer on January 02, 2018, 03:43:40 PM
When i try to run the Plugin then it doesn't work.

it actually says this:
CopyOrExpand - Failed to copy [%BaseDir%\Temp\Win10PESE\TempExtractFolder\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware\mbamext,2.dl_] to: [%BaseDir%\Temp\Win10PESE\TempExtractFolder\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware\mbamext.dll]: Das System kann die angegebene Datei nicht finden.

"Das System kann die angegebene Datei nicht finden."
The translation means: The system can't find the file.

can anyone help me?


I've already tried to rename the path as bob.omb told me:

Change this line inside of your plugin:

%ProgramFolder%=Malwarebytes Anti-Malware

==>

%ProgramFolder%=Malwarebytes

He then told me to post my problem in this thread.
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on January 02, 2018, 06:46:03 PM
Will re-check and reupload plugin tonight so you can at least get to the error we are stuck on and not something else...then we can figure it out together
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on January 03, 2018, 04:21:47 AM
Cannot reproduce the problem on my end.  The plugin executes successfully...

[attach=1]

The plugin gets the setup file from this location: https://data-cdn.mbamupdates.com/web/mb3-setup-consumer/mb3-setup-consumer-3.3.1.2183.exe (https://data-cdn.mbamupdates.com/web/mb3-setup-consumer/mb3-setup-consumer-3.3.1.2183.exe)

Make sure you're not being blocked from accessing it, try to go there with a web browser and see if it serves you the file.  If it does not start a download, you're being blocked.

Anyone else having issues with plugin?

Can you post your log please?
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: DaPuffer on January 03, 2018, 08:55:02 AM
I could download the File without any problems. And i got the same problem with another PC from a buddy. This one is my own PC.

I got the log in the Attachment if it helps. I got it in a Zip file because html isn't allowed here to upload.
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: APT on January 03, 2018, 11:38:53 AM
Hi Bob.omb

I think there might be some confusion about plugin versions , as mbamext,2.dl (file that's failing in CopyR) isn't listed in your plugin as far as i can see, at least not in the last one of yours i tried
regards
APT
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on January 03, 2018, 04:22:40 PM
DaPuffer,

    If you are trying to help finish this plugin that we are developing for ---> Malwarebytes 3 <--- you have to download the plugin attached to replys in this thread,  it is not on the project server because it is not finished. We have to make it work first..

From your log I can see that you are using the OLD Malwarebytes plugin for Malwarebytes 2 - from the project Downloads>AppsY>Security>Anti-Virus>Malwarebytes_Anti-Malware_L plugin. (Try the packed version for MB2 - Thanks APT for testing)

Download the attached file FROM THIS THREAD, which is not fully completed, but will bring you to the error we are stuck on...

Re-Attached Plugin below:

[attach=1]

Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: Lancelot on January 04, 2018, 08:23:57 AM
Hi bob.omb,

sorry for late response.

updated old plugin (Download version) on server, so plugin not usable by new users anymore.
Also added current topic link.

(
+ That is the reason I do not like "Download" plugins for Complex or Frequent Updated applications.
+ That is the reason PC Packed have "FileContainer + Provide File + Download" options to work together.
      (APT might remember on another topic -> If required to be posted on another topic  :wink: )
)

:turtle:
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: DaPuffer on January 04, 2018, 04:09:32 PM
DaPuffer,

    If you are trying to help finish this plugin that we are developing for ---> Malwarebytes 3 <--- you have to download the plugin attached to replys in this thread,  it is not on the project server because it is not finished. We have to make it work first..

From your log I can see that you are using the OLD Malwarebytes plugin for Malwarebytes 2 - from the project Downloads>AppsY>Security>Anti-Virus>Malwarebytes_Anti-Malware_L plugin. (Try the packed version for MB2 - Thanks APT for testing)

Download the attached file FROM THIS THREAD, which is not fully completed, but will bring you to the error we are stuck on...

Re-Attached Plugin below:

(Attachment Link)

No I used the download plugin wich gives me the newest version. from Yomi, the Malwarebytes Anti-Malware (L) (DL).
Because i wanted the newest version of MBAM.
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: DaPuffer on January 04, 2018, 04:13:11 PM
Hi bob.omb,

sorry for late response.

updated old plugin (Download version) on server, so plugin not usable by new users anymore.
Also added current topic link.

(
+ That is the reason I do not like "Download" plugins for Complex or Frequent Updated applications.
+ That is the reason PC Packed have "FileContainer + Provide File + Download" options to work together.
      (APT might remember on another topic -> If required to be posted on another topic  :wink: )
)

:turtle:

Now i get it. I Thought the Download Plugin would be the newest  :grin:
Then i will try the "new" new one.
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on January 06, 2018, 12:43:14 AM
Updated plugin with help... Still stuck on memory error. 

Run from RAM for testing...

[attach=1]

Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: LittlBUGer on March 16, 2018, 02:41:37 PM
Hello,

I've really been trying to find or make a portable version of MalwareBytes 3.x for a while now without much success. This may be the closest thing to actually have something that works. I will test and see if I can help in any way. If you've made any progress since you last posted, please let me know.

Thanks!
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on March 16, 2018, 07:02:27 PM
it looks like the mbamswissarmy is copied to the sdk folder inside the program folder but it needs to be im the system32\drivers folder AS WELL. Along with another driver or two possibly misplaced or missing altogether.. Malwarebytes will install and run but when it tries to load after a boot it always errors, we have file placement or registry wrong somewhere

One reason I feel like its file placement is that its obvious things aren't all where they're supposed to be if you look at a regular install side by side... the ones I noticed most issues are Malwarebytes*\SDK folder and System32\Drivers....

I have the paid version on my host its hard to compare files and keys because there are extra drivers etc for the active protection...
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: James on March 17, 2018, 03:03:19 AM
If you run the MBAM3 installer while in PE, it works....
just takes a few seconds to run the MBAM3 Setup file
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: LittlBUGer on March 19, 2018, 05:37:36 PM
If you run the MBAM3 installer while in PE, it works....
just takes a few seconds to run the MBAM3 Setup file

I don't think it's the installer that's the issue. It's just plain running the program. I personally wouldn't see the need of having the installer to install it while in the PE, I just want the script to run MalwareBytes as if it was installed, which is what most of the scripts do. But, as bob.omb said, it's stuck on a certain error that he's trying to figure out...
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: James on March 19, 2018, 06:48:28 PM
You're right, the installer is not the issue....
So, while you figure out the script, I'll just use the installer to solve the problem.
The nice thing about advice is you do not have to follow it..
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on March 19, 2018, 08:49:13 PM
James,

  Thank you for your workaround, without it we wouldn't be able to run Malwarebytes3 at all.. It is a good temp solution, if it could be made to silently run during boot better, but even better would be if we could get a plugin working and I'm sure you would agree.  We could use the installer for every program in PE....but we don't...because its annoying...

So I'd like to optimistically hope that someone who is also interested in getting this plugin working will contribute, I know James did look at this plugin and so have others and we have all thrown our hands up at it to this point... But I'm sure its possible...

** I did have one question,  how are you able to get around the B:\ issue with the installer without any changes?  The RamDrive (B:\) causes an issue for me unless I run the installer within the first 20seconds of boot or so
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: LittlBUGer on March 20, 2018, 04:17:08 PM
You're right, the installer is not the issue....
So, while you figure out the script, I'll just use the installer to solve the problem.
The nice thing about advice is you do not have to follow it..

I apologize if I misunderstood your previous post or if I came off as rude as that's definitely not what I intended. I was just making a statement of fact is all, but I know that we all appreciate any feedback and help you can give, regardless if it's for the script or installer or anything.  :)
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 11, 2018, 04:11:33 AM
Plugin is 99% complete  :thumbsup:

x86 and x64 compatible

Malwarebytes 3 Plugin v7: [attach=1]

The only problem is that the default scan gives 4 false positives for the basic build.  I need help with this if anyone has time.

(4 separate detections come from only 2 files total)
1) BroadcastEnvChange.exe
2.)BoradcastEnvChange.exe \Run Reg Key
3.) HideRun.exe
4.) HideRun.exe  (without a path)

*Also testing for updates

All located on the X:\  -- I have been trying unsuccessfully to add X:\ and Y:\ as permanent exceptions..  :sad:  Once that can be accomplished or these 2 false positive files getting unflagged somehow the plugin will be perfect  :cool:
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: Lancelot on November 11, 2018, 10:37:25 AM
Hi Bob.Omb

I see hiderun.exe x86 more than 10 years now only 1 AV see as virus
https://www.virustotal.com/#/file/22e7528e56dffaa26cfe722994655686c90824b13eb51184abfe44d4e95d473f/detection

hiderun.exe x64 still more than %50 do not see as virus
https://www.virustotal.com/#/file/85d2c8771aa90f2a92645a9bea70e1a86a0e439f0711dcbea75a056b747c3958/detection

slow progress for AV softwares.

and I see one of old hiderun x86 page closed a while ago (the one we use), I suspect because of AV reports....

**
Maybe we can ask Galapo recompile hiderun.exe x64 with more info on Version:
Current:
Version: 1.1.0.0
Description: hides console window of started program
Copyright: Compiled by Galapo

In addition:
Contact: http://theoven.org/index.php?topic=2040.0


**
Same recompile for BroadcastEnvChang adding Contact link

****
Hopefully, Add a contact to both will make them "none virus" for a while....

:turtle:

Edit:
Galapo, if possible do not use "Original File name" on compile.  :wink:
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: Galapo on November 12, 2018, 01:23:06 AM
Ok, attached are the x64 re-compiles of the two programs. Hopefully this fixes the issue for a while.

Regards,
Galapo.
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: APT on November 12, 2018, 01:30:07 AM
Hi Galapo

Quote
Ok, attached are the x64 re-compiles of the two programs. Hopefully this fixes the issue for a while.

thanks cobber  :smile: :thumbsup:
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 12, 2018, 03:12:18 AM
You are the man Galapo I will let you know status after testing..   :great:
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 12, 2018, 04:28:35 AM
It works perfect with the recompiled files :grin: 0 detections from within PE
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: Galapo on November 12, 2018, 06:04:43 AM
Thanks for testing and reporting back. Good to hear!
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 12, 2018, 06:10:31 AM
Files uploaded to project servers, use Update (Exact and Secure)  :thumbsup:
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: Lancelot on November 12, 2018, 07:08:32 AM
Thanks Galapo.

Can we have a broadcastenv topic around
http://theoven.org/index.php?board=18.0
which we can give reference too.

+
also update to broadcastenv x86 will be good too. just checked with virustotal

:turtle:
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: Galapo on November 12, 2018, 08:46:08 AM
Attached is the re-compile of the x86 version.

Regards,
Galapo.
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: teik on November 12, 2018, 11:56:19 AM
Attached is the re-compile of the x86 version.

Regards,
Galapo.

Thank you very much for carrying broadcast in x86. Waiting also for the x86 version of hiderun  :thumbsup:

Great work.
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: Galapo on November 12, 2018, 12:24:04 PM
Waiting also for the x86 version of hiderun  :thumbsup:

Sure, here you go. I'd personally use the original version, which I simply cannot match in getting mine to compile as small.  :sad:

Regards,
Galapo.
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: James on November 12, 2018, 01:27:12 PM
In the scheme of things overall - a few KB- not a big matter..

Bob you have a lot of time invested to get this one...
But You never gave up...
Great Job...
 :thumbsup:
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: teik on November 12, 2018, 02:10:58 PM
Waiting also for the x86 version of hiderun  :thumbsup:

Sure, here you go. I'd personally use the original version, which I simply cannot match in getting mine to compile as small.  :sad:

Regards,
Galapo.

For my part, weight is not a problem. Thank you so much for sharing it.
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 12, 2018, 03:55:34 PM
In the scheme of things overall - a few KB- not a big matter..

Bob you have a lot of time invested to get this one...
But You never gave up...
Great Job...
 :thumbsup:

Couldn't have done it without you  :wink:
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: Lancelot on November 12, 2018, 04:36:18 PM
Hi Galapo,

Thanks for updates, all relevant plugins updated.
I hope this is the last time we update hiderun and broadcastenvchange.

ps:
I do not see your attachments when I login.  :wink:
To download your attachments, I log out.  :lol:

*
About Hiderun x86, original version not seen by virus anymore at VirusTotal.
I silently revert back to original hiderun-x86 long time ago seeing VirusTotal reports.
 (maybe a year or more ago which did not cause trouble)

ps: Good side, Gena uses small hiderun the way you like.  :cool:

but hiderun-x64 found by AV ..... which is the reason of AV posts about hiderun around.
I feel "Original File name" on compile causing this (same feeling for AutoIT 3381)
We will see.  :wink:

:turtle:



@Bob.Omb

"Autorun.cmd at Root of USB" plugin
on your hands to update BroadCastEnvChange  :thumbsup:

:turtle:
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: James on November 12, 2018, 04:48:05 PM
The Major Change I see is the ServiceConfig.json file...
Although not sure if files "Newly Created by you" ?? - But would assume if existed they would have pointed to C:\\
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: Lancelot on November 13, 2018, 01:00:00 PM
Sure, here you go. I'd personally use the original version, which I simply cannot match in getting mine to compile as small.  :sad:

Hi Galapo,

When writing other topic I remember:
 
Junc.exe from Olof L

http://www.ltr-data.se/opencode.html
Junc.zip - 7.7 KB (32 bit) / junc64.zip - 8.2 KB (64 bit) / junc.zip - 11.0 KB (ARM)
compiled 2018-05-13

Maybe you can get info from Olof L sourcecodes or directly from him via email.

:xmas-beer:

:turtle:
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: Galapo on November 15, 2018, 03:18:17 AM
I found the external drive where I had a virtual machine with Visual Studio installed. The resulting executables are slightly smaller.

Regards,
Galapo.
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 18, 2018, 05:46:46 PM
I have this MB3 plugin working on 2 out of 3 of my test machines. Bugs reported elsewhere about this plugin..

Anyone else having issues with this?

 :mad:

I may be missing something (this one has my head hurting  :lol:)

Maybe importing certificate info? I did not notice this as my two primary machines I have been testing on both work fine...  Until I was notified and then I tested on a third..

I cant seem to pinpoint where the failure is occurring... (Maybe with secureboot or patched winload.exe?)
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 18, 2018, 06:20:22 PM
It looks like the hash at the top of the ServiceConfig.json file does not match something and the self protection mechanism is kicking in and reassigning the paths for data (needed files) to default on the c:\

Code: [Select]
B191577A8A02F3CA15F219FE18AD5C3B5C89075CBC2263D276C51F1C798B7D12
{
   "affiliateId" : "",
   "affiliateName" : "consumer",
   "checkConfig" : true,
   "dataPath" : "X:\\ProgramData\\Malwarebytes\\MBAMService",
   "delayInterval" : 15000,
   "delayStart" : false,
   "installPath" : "Y:\\Programs\\Malwarebytes 3",
   "logFileBackups" : 10,
   "logFilePath" : "X:\\ProgramData\\Malwarebytes\\MBAMService\\logs\\mbamservice.log",
   "logFileSize" : 10485760,
   "maxLogLevel" : "info",
   "productBuild" : "consumer",
   "productCode" : "MBAM-C",
   "productVersion" : "3.6.1.2711"
}

It is a shame too because control of these paths would make it possible to completely make the application portable.. (except the services)

This means if your testing on a machine with Malwarebytes 3 installed on the host the plugin will work when running it from your USB.  If you do not have MB3 on the host the plugin will fail when running it from your USB..

- Back to the drawing board..
Title: Re: Creating Malwarebytes 3 plugin - Development
Post by: bob.omb on November 28, 2018, 06:17:02 AM
What a pain in the rear end this software is to make portable  :tongue:

Instead, for the sake of usability now, I caved into James's method, and am using the installer file as a base.  I created a simple launcher with AutoIT3 that checks to see if the program is already installed at the default /VerySilent path, if it is it only opens the gui and completes(This way you don't reinstall every time you click the shortcut for the launcher), if not it silently installs MB3, removes the public desktop icon after install, then opens the gui.. (This needs to be done because silent install opens the software to tray and does not present the GUI)

It is compiled to MB3Launcher.exe but below is the au3 source
Code: [Select]
#NoTrayIcon
#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Icon=mb3_MAINICON.ico
#AutoIt3Wrapper_Res_Description=Malwarebytes 3
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
Local $sFilePath = "X:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"
Local $iFileExists = FileExists($sFilePath)
If $iFileExists Then
    Run('X:\Program Files\Malwarebytes\Anti-Malware\mbam.exe')
Else
    RunWait('MB3.EXE /VerySilent', @ScriptDir)
    FileDelete ('X:\Users\Public\Desktop\Malwarebytes.lnk')
    Run('X:\Program Files\Malwarebytes\Anti-Malware\mbam.exe')
EndIf
Exit

Res_Description=Malwarebytes 3 - is necessary so that pinned shortcut name displays correctly (as Malwarebytes 3) otherwise the EXE name is used for the pinned item.

The same process of downloading the latest version to the file container is still used in this version.

SE Plugin: [attach=1]