21

Very easy, if I got you right: Make an Ida project from the DLL, i.e. drag and drop the dll into the blank Ida page. In Menu Debugger, Process Options, put the path to your exe into the textbox "Application", Into "input file" put the path to your DLL. Confirm with OK. Start with menu Debugger, Start Process or F9. Your breakpoint should be hit.


9

One thing you need to keep in mind is that code in your process and the code in the target process reside in different address spaces. So any address in your program is not necessary valid in the target process and vice versa. This means the code that you inject cannot make any assumptions about addresses of functions or variables. Even your inject function'...


6

If you want to use a function in the application the bottom line is that you need to know where it's located. Without ASLR you can hardcode the address of the function into your DLL, and use a function pointer to call it. If you want to modify data from a function in a loaded library then you would need to hook that function, and call your own code for its ...


5

How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle("HackMe.exe"))? A process doesn't have a base offset; I believe you mean the base address of the primary module. To get that address, you would use GetModuleHandle(NULL). Is there a way to see the base offset in OllyDbg (not that useful I ...


5

Is there any way to detect from the driver that this process is protected ? Disclaimer: This following procedure depends on undocmented data structure which is extracted from PDB symbol of combase.dll file. As usual this may not work in future Windows OS version. This is the sample C code to detect protected process. The program accepts a valid process ID ...


5

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE. From the main screen choose PE Editor and select the executable (or DLL) that you wish to modify: Then click Directories: Click the Ellipsis button next to Import Table: Right Click and choose add import: Now add your dll and ...


3

how do i avoid getting detected You can't know how to avoid getting detected if you don't know how the detection works. I'd recommend finding and reverse engineering the detection logic so that you can either disable it (patch it out) or better understand how to avoid detection. That said, if you're looking for a generic alternative to "standard" DLL ...


3

please look at the following: PyDBG - it's a python wrapper around Win Debug API and much more. The framework enables one to literally inspect every aspect of the running process by registering event handlers for BPs, memory executions/reads/writes, stack inspection, etc.. You can change whatever you want in the process you are debugging. PyDBG ...


3

Yes. Executable relocations, whether performed for optimization or security, will only relocate the image (executable, shared object) as a whole. For that reason, to bypass ASLR for example, any single address within a chosen shared object is sufficient. Given, of course, you know the precise version and build of the shared object. Knowing the specific build ...


3

If you compare pseudocode returned by decompiler with your own C code you will notice one very important difference - in decompiler's output it is merely a comment, but it's very important. I'm talking about following lines: int v7; // [sp+10h] [bp-42Ch]@1 char v8; // [sp+14h] [bp-428h]@1 int v9; ...


2

At one particular instance it showed a debug error saying: "The process was not able to resume execution because the ESP value was changed", or something similar. ... typedef void(__cdecl* ChatFunc)(char*); ChatFunc Chat = (ChatFunc)0x00450C60; It sounds like the function at 0x00450C60 is not a __cdecl function and/or it doesn't take exactly one ...


2

Have you considered using the DLL only for providing "stub" methods, that you could call using CreateRemoteThread, and have the DLL methods transform the arguments into what the method you ultimately want to call takes? I know this is not really a solution to how the program detects other threads running. But with some luck, the fact that your threads ...


2

You can certainly hook dlls similarly to how you'd hook any other function. To get the address of a dll function, you'd need to call two windows APIs. First, you'll need to get the address/handle (these are the same when discussing loaded modules) of the module you're trying to hook. A simple method to get that is to call either LoadLibrary or ...


2

One way of doing this : Localize lua_gettop in your target binary with IDA (which should be called very frequently). You can get it by downloading Lua sources, and look for error messages in your target binary. You should be able to reconstruct little by little the Lua runtime by looking at XRefs of lua functions containing error messages. Hook lua_gettop, ...


2

Aphex has demo's written in Delphi with a few code injection examples. Should compile with Delphi 2007...maybe even with Delphi 7. Remote Procedure Injection InjectLibrary InjectLibraryEx CreateProcessEx Inject Executable Most examples rely on Aphex's AfxCodeHook library (with source), and this is where the heavy lifting is done. Even without a copy of ...


2

There are ways to do it without resorting to hooking or drivers. For example alternate data streams (ADS), or creating files with "illegal", i.e. reserved, names (NUL, CON ... trailing ., alternative casing to an existing file). Yep, that's right a trailing dot in a file name is illegal in Win32, but the most frequently used file system (NTFS) has no ...


2

Shortly after posting the question I took a closer look at my code for parsing the exports and came to the realization, that I made an incorrect assumption. In the export directory entries, if a function entry point to the export section, you can find a string there, which depicts the forwarder export name. An example of that is visible in the last screensot ...


2

You can take one of the following approaches: call eax usually means there is an indirect call. try to find what and where eax is defined. Maybe only by looking at it, you will found the problem. If you find the origin but not understand the problem, you can try to patch it, to something like: mov eax, <known_function_address> Maybe you can change a ...


2

Yes, it is possible to perform the necessary loading steps in the injector process (i.e., resolving the import addresses) before injecting the DLL, and some injectors/malware do that. See for example address 0x18007CD00 in my ComRAT IDB. However, doing it that way is more cumbersome, as some of the neccessary DLLs might not already be loaded by the target ...


1

Detouring is more or less a patching of the .text section inside of a program. It's practically more or less hacking, you're rerouting a program to do what you want it to do with your own function. Usually by placing the opcode 0xE9 (known as JMP, also added with some 0x90 which is NOP, for alignment) inside of the memory address you're detouring, that JMPs ...


1

Practical Binary Analysis by Dennis Andriesse is great, the examples are mostly done on Linux but the concept is still the same for Windows.


1

There are plenty of ways to do what you want. I recommend you to export the method you want to call and then use the GetProcAddress function to get the address of it and call it. You can use the code sample from the MSDN; it should work as is in your case. You can get the loading address of your DLL: see StackOverflow post. You need to calculate the offset ...


1

It is possible for an attacker to replace the file on the disk by beating the race condition. When you write the file to disk, there is a delay until when the function you called which loads the DLL actually reads it from disk. An attacker can reverse your application and find out where you place the DLL, then in a no-sleep thread (maybe even multi-threaded) ...


1

As you said, the Lua engine is embedded directly into the game. It's inside plugins/GameManagerVC.dll (or GameManagerVC64.dll in case of 64-bit). So, first step will be finding out, which version of Lua it is. So put this DLL into Ghidra or IDA Pro. The most easiest way of figuring out, what version of Lua it uses, is by searching for "Lua" string ...


1

Calling LoadLibrary twice with the same DLL name only increases the load counter but does not cause DLL entrypoint to be called again. From the doc (emphasis mine): If the specified module is a DLL that is not already loaded for the calling process, the system calls the DLL's DllMain function with the DLL_PROCESS_ATTACH value. If DllMain returns TRUE, ...


1

Since I cannot add a comment I will post it here: @NirIzr : Well it doesn't actually point to the end, does it? It should point to the memory where the actual byte array starts. Note that I first write the testString into the memory of my second program then the bytecode. Then I do remoteCave = (LPVOID)((DWORD)remoteString + stringlen) which should then be ...


1

I ended up placing the required code in the executable: 00C0B500 68 B6B4C000 PUSH ForgedAl.00C0B4B6 ; ASCII "lua-extension.dll" 00C0B505 FF15 88F4C000 CALL DWORD PTR DS:[<&KERNEL32.LoadLibrar> ; kernel32.LoadLibraryA 00C0B50B 68 C9B4C000 PUSH ForgedAl.00C0B4C9 ; ASCII "initialize" 00C0B510 ...


1

Yes, you can. Like this: uint32_t some_value; uint32_t ptr_to_some_value; // eax is always 32-bit void __declspec(naked) hookYCoordASM() { __asm { // #1: to get the value mov eax, [esi + 0x7C]; mov some_value, eax; // #2: to get a pointer to the value lea eax, [esi + 0x7C]; mov ptr_to_some_value, eax; ...


1

Searched the local drive for an unknown binary that uses a dll found calc.exe from gnuwin32 it uses 2 dlls calc2.dll and readline5.dll copied all 3 of them to a test directory e:\GNUWIN32\bin>cp -v calc.exe calc2.dll readline5.dll e:\test\detours\. `calc.exe' -> `e:\\test\\detours\\./calc.exe' `calc2.dll' -> `e:\\test\\detours\\./calc2.dll' `...


Only top voted, non community-wiki answers of a minimum length are eligible