2

I have got a DLL file that I want to modify. Each time the executable file which imports the DLL is executed it performs a self checking process to find out whether the file is valid or not. How can I bypass such security measure? I want to be able to make the patch as same as the valid file by all means except the code itself. In addition, I don't exactly know how the security measure finds out whether the file is valid or not. So consider the security measure a black box in which we are going to implement a pentest on.

  • 1
    I think, the best way is to understand the "security measure" that Your DLL use to ensure it integrity. – Denis Laskov Aug 22 '15 at 15:46
  • But how? probably your answer is to reverse engineer the target file. However, I am looking for some general self check methods used by most programs – FreeMind Aug 22 '15 at 15:55
  • @FreeMind The "general self check" method is usually comparing the hash of some or all bytes of the file to a target value. If the file is digitally signed, your modification will tamper the sign, which can be programmatically detected using WinVerifyTrust Since you say that the check is performed on dll loading, you need to analyze DllMain – 0xec Aug 22 '15 at 17:10
  • @ExtremeCoders How can I find the DllMain? For instance I want to analyze the Enigma.dll - what do you mean by DllMain? – FreeMind Aug 22 '15 at 17:21
  • @FreeMind You need to analyze from the entrypoint of the Dll. This value is stored in the PE headers. See the AddressOfEntryPoint member in IMAGE_OPTIONAL_HEADER struct. – 0xec Aug 22 '15 at 17:34
2

It's not possible to blindly bypass integrity self-checking in a generic "black-box" way. You need to find out what exactly is performed as a check, and then use the according way to bypass it (if existing).

Since you state it's a self-check, you have to reverse the DLL and find out how the check is performed. The good news is that a self-check should always be removable.

0

Depending on when exactly the validation check is made, you might be able to simply rename the DLL and replace the original with your own. In that case, your DLL must load the original DLL, in order to place it in memory. Your DLL must also export the same functions that the original one does, but forward each of them to the original DLL. This is not a trivial undertaking, but it might serve you better than to try to find and disble the check itself.

0

Or maybe you can make a loader instead of "physical" patch. Since your question is quite generic this is a quite generic solution patching bytes in memory is sometimes very useful to bypass integrity checks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.