25 votes
Accepted

How to debug the DLL of an EXE using IDA Pro?

Very easy, if I got you right: Make an Ida project from the DLL, i.e. drag and drop the dll into the blank Ida page. In Menu Debugger, Process Options, put the path to your exe into the textbox "...
user avatar
  • 1,804
6 votes
Accepted

DLL Injection search for procedures/variables

If you want to use a function in the application the bottom line is that you need to know where it's located. Without ASLR you can hardcode the address of the function into your DLL, and use a ...
user avatar
  • 211
5 votes
Accepted

Patching a string using DLL injection and OllyDbg

How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle("HackMe.exe"))? A process doesn't have a base offset; I believe you mean the base ...
user avatar
5 votes
Accepted

Microsoft Edge and it's related processes may have turned protected in windows 10 1903

Is there any way to detect from the driver that this process is protected ? Disclaimer: This following procedure depends on undocmented data structure which is extracted from PDB symbol of combase....
user avatar
  • 1,439
5 votes

Permanently load a DLL to an executable

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE. From the main screen choose PE Editor and select the executable (or ...
user avatar
  • 2,908
4 votes
Accepted

How to hook to a system function

Two possibilities: Patch the call instruction to point to a destination of your choosing, such as a "code cave" between the end of the .text section and the subsequent section. Write your ...
user avatar
  • 7,814
3 votes

How to inject a DLL without being detected?

how do i avoid getting detected You can't know how to avoid getting detected if you don't know how the detection works. I'd recommend finding and reverse engineering the detection logic so that you ...
user avatar
3 votes
Accepted

Are offsets within a loaded dll always the same relative to each other?

Yes. Executable relocations, whether performed for optimization or security, will only relocate the image (executable, shared object) as a whole. For that reason, to bypass ASLR for example, any ...
user avatar
  • 11.3k
3 votes

Modifying program using IDA/Hexrays decompilation pseudocode

If you compare pseudocode returned by decompiler with your own C code you will notice one very important difference - in decompiler's output it is merely a comment, but it's very important. I'm ...
user avatar
  • 3,179
2 votes

Avoid program detecting a thread being used

Have you considered using the DLL only for providing "stub" methods, that you could call using CreateRemoteThread, and have the DLL methods transform the arguments into what the method you ultimately ...
user avatar
2 votes
Accepted

How to manipulate game which loads many dll's

You can certainly hook dlls similarly to how you'd hook any other function. To get the address of a dll function, you'd need to call two windows APIs. First, you'll need to get the address/handle (...
user avatar
  • 11.3k
2 votes

Hacking Lua - Introduce new functions into built Lua

One way of doing this : Localize lua_gettop in your target binary with IDA (which should be called very frequently). You can get it by downloading Lua sources, and look for error messages in your ...
user avatar
  • 578
2 votes

In Memory DLL Injection

Aphex has demo's written in Delphi with a few code injection examples. Should compile with Delphi 2007...maybe even with Delphi 7. Remote Procedure Injection InjectLibrary InjectLibraryEx ...
user avatar
  • 7,322
2 votes

Cannot call function (properly) in C++

At one particular instance it showed a debug error saying: "The process was not able to resume execution because the ESP value was changed", or something similar. ... typedef void(__cdecl* ...
user avatar
2 votes

Hiding a file in a Windows operating system

There are ways to do it without resorting to hooking or drivers. For example alternate data streams (ADS), or creating files with "illegal", i.e. reserved, names (NUL, CON ... trailing ., alternative ...
user avatar
  • 10.5k
2 votes

advapi32.dll changes name of function during forwarding of exports

Shortly after posting the question I took a closer look at my code for parsing the exports and came to the realization, that I made an incorrect assumption. In the export directory entries, if a ...
user avatar
2 votes
Accepted

How to decompile "call eax" in IDA Pro?

You can take one of the following approaches: call eax usually means there is an indirect call. try to find what and where eax is defined. Maybe only by looking at it, you will found the problem. If ...
user avatar
2 votes
Accepted

Why does reflective dll injection need to perform loading in the target process?

Yes, it is possible to perform the necessary loading steps in the injector process (i.e., resolving the import addresses) before injecting the DLL, and some injectors/malware do that. See for example ...
user avatar
  • 7,814
1 vote

learning detour and code injection

Detouring is more or less a patching of the .text section inside of a program. It's practically more or less hacking, you're rerouting a program to do what you want it to do with your own function. ...
user avatar
  • 51
1 vote

learning detour and code injection

Practical Binary Analysis by Dennis Andriesse is great, the examples are mostly done on Linux but the concept is still the same for Windows.
user avatar
1 vote

Can't find injected DLL in OllyDbg

After the target process is gone the code should not be running anymore, which makes me suspect you inject into a different process. Try printing your ProcessId. If FindWindow or ...
user avatar
1 vote

DLL Injection Call Address In Target

There are plenty of ways to do what you want. I recommend you to export the method you want to call and then use the GetProcAddress function to get the address of it and call it. You can use the code ...
user avatar
  • 121
1 vote

Is it possible to hijack a C++ DLL after it has been loaded into the memory space? How?

It is possible for an attacker to replace the file on the disk by beating the race condition. When you write the file to disk, there is a delay until when the function you called which loads the DLL ...
user avatar
  • 131
1 vote

Finding lua C functions compiled binary

As you said, the Lua engine is embedded directly into the game. It's inside plugins/GameManagerVC.dll (or GameManagerVC64.dll in case of 64-bit). So, first step will be finding out, which version of ...
user avatar
1 vote
Accepted

DLL Injection does not work twice

Calling LoadLibrary twice with the same DLL name only increases the load counter but does not cause DLL entrypoint to be called again. From the doc (emphasis mine): If the specified module is a DLL ...
user avatar
  • 34.6k
1 vote

Unable to call function with CreateRemoteThread

Since I cannot add a comment I will post it here: @NirIzr : Well it doesn't actually point to the end, does it? It should point to the memory where the actual byte array starts. Note that I first ...
user avatar
1 vote
Accepted

What is the quickest way to run code of my own DLL?

I ended up placing the required code in the executable: 00C0B500 68 B6B4C000 PUSH ForgedAl.00C0B4B6 ; ASCII "lua-extension.dll" 00C0B505 FF15 88F4C000 CALL DWORD PTR DS:...
user avatar
1 vote

Possible to hook an address and directly write to it?

Yes, you can. Like this: uint32_t some_value; uint32_t ptr_to_some_value; // eax is always 32-bit void __declspec(naked) hookYCoordASM() { __asm { // #1: to get the value mov eax, ...
user avatar
  • 428
1 vote
Accepted

Reverse Engineering Exported DLL Function

Searched the local drive for an unknown binary that uses a dll found calc.exe from gnuwin32 it uses 2 dlls calc2.dll and readline5.dll copied all 3 of them to a test directory e:\GNUWIN32\bin>cp ...
user avatar
  • 14.8k

Only top scored, non community-wiki answers of a minimum length are eligible