I have got a DLL file that I want to modify. Each time the executable file which imports the DLL is executed it performs a self checking process to find out whether the file is valid or not. How can I bypass such security measure? I want to be able to make the patch as same as the valid file by all means except the code itself. In addition, I don't exactly know how the security measure finds out whether the file is valid or not. So consider the security measure a black box in which we are going to implement a pentest on.
3 Answers
It's not possible to blindly bypass integrity self-checking in a generic "black-box" way. You need to find out what exactly is performed as a check, and then use the according way to bypass it (if existing).
Since you state it's a self-check, you have to reverse the DLL and find out how the check is performed. The good news is that a self-check should always be removable.
Depending on when exactly the validation check is made, you might be able to simply rename the DLL and replace the original with your own. In that case, your DLL must load the original DLL, in order to place it in memory. Your DLL must also export the same functions that the original one does, but forward each of them to the original DLL. This is not a trivial undertaking, but it might serve you better than to try to find and disble the check itself.
answered Aug 31, 2015 at 22:11
Or maybe you can make a loader instead of "physical" patch. Since your question is quite generic this is a quite generic solution patching bytes in memory is sometimes very useful to bypass integrity checks.
WinVerifyTrustSince you say that the check is performed on dll loading, you need to analyzeDllMainEnigma.dll- what do you mean byDllMain?AddressOfEntryPointmember inIMAGE_OPTIONAL_HEADERstruct.