6
votes
Accepted
Microsoft Edge and it's related processes may have turned protected in windows 10 1903
Is there any way to detect from the driver that this process is protected ?
Disclaimer: This following procedure depends on undocmented data structure which is extracted from PDB symbol of combase....
- 1,589
6
votes
Permanently load a DLL to an executable
An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE.
From the main screen choose PE Editor and select the executable (or ...
- 3,283
4
votes
Accepted
How to hook to a system function
Two possibilities:
Patch the call instruction to point to a destination of your choosing, such as a "code cave" between the end of the .text section and the subsequent section. Write your ...
- 9,218
4
votes
Forcing a legacy Windows application to use an older version of ntdll.dll
A tool like Enigma Virtual Box might help, since it can be used to pack DLL-dependencies into a single executable. I would use it on a system where everything works to pack the system's DLLs (...
- 141
3
votes
Accepted
Are offsets within a loaded dll always the same relative to each other?
Yes.
Executable relocations, whether performed for optimization or security, will only relocate the image (executable, shared object) as a whole.
For that reason, to bypass ASLR for example, any ...
- 11.8k
3
votes
Modifying program using IDA/Hexrays decompilation pseudocode
If you compare pseudocode returned by decompiler with your own C code you will notice one very important difference - in decompiler's output it is merely a comment, but it's very important. I'm ...
- 3,419
3
votes
Hacking Lua - Introduce new functions into built Lua
One way of doing this :
Localize lua_gettop in your target binary with IDA (which should be called very frequently). You can get it by downloading Lua sources, and look for error messages in your ...
- 608
2
votes
In Memory DLL Injection
Aphex has demo's written in Delphi with a few code injection examples. Should compile with Delphi 2007...maybe even with Delphi 7.
Remote Procedure Injection
InjectLibrary
InjectLibraryEx
...
- 7,592
2
votes
Hiding a file in a Windows operating system
There are ways to do it without resorting to hooking or drivers.
For example alternate data streams (ADS), or creating files with "illegal", i.e. reserved, names (NUL, CON ... trailing ., alternative ...
- 10.9k
2
votes
advapi32.dll changes name of function during forwarding of exports
Shortly after posting the question I took a closer look at my code for parsing the exports and came to the realization, that I made an incorrect assumption.
In the export directory entries, if a ...
- 31
2
votes
Accepted
Why does reflective dll injection need to perform loading in the target process?
Yes, it is possible to perform the necessary loading steps in the injector process (i.e., resolving the import addresses) before injecting the DLL, and some injectors/malware do that. See for example ...
- 9,218
2
votes
Accepted
How to decompile "call eax" in IDA Pro?
You can take one of the following approaches:
call eax usually means there is an indirect call. try to find what and where eax is defined. Maybe only by looking at it, you will found the problem. If ...
- 1,858
1
vote
Accepted
How can I view the output of printf calls without a console window?
The approach you outlined seems plausible; I'd probably do something similar to that if I were approaching this problem. If printf is being called via function pointer -- say, it's an import from ...
- 9,218
1
vote
Accepted
Loading a PE32 executable DLL Intel 80386 into a c# program
You can't load 32bit Dlls in 64bit Processes
Solution: build a 32bit App or write an external 32bit prozess(yes a EXE) that loads the DLL and communication with that process using Pipes or TCP/IP ...
- 336
1
vote
Accepted
Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)
Is your binary relocated on load (ASLR)? In that case 14608 points to some random memory (probably unallocated). You need to use a position-independent instruction to load the address of the dlopen ...
- 36.9k
1
vote
Accepted
Call libc functions from the payload statically injected into ELF binary
For any external functions used (e.g. libc functions), there will exist a stub in the binary's PLT for said function. When the program calls the function, it jumps to the PLT stub, which correctly ...
- 619
1
vote
Accepted
best approach to hook function
The first one is much better in my opinion:
It doesn't use deprecated function, that is probably kept only in the Detours library for backward compatibility
It uses pattern scanning, this is much ...
- 696
1
vote
Accepted
dll injection (assembly code)
It is indeed possible, and not that hard to do - providing the game doesn't have any anti-cheat nor integrity checks.
The thing you are looking for is called function hooking. If you don't want to ...
- 696
1
vote
How to decompile "call eax" in IDA Pro?
This problem is not unique to call eax but potentially any indirect call or a call to a function with wrong type information. The possible causes and solutions are described in the Hex-Rays Decompiler ...
- 36.9k
1
vote
Get string from function and pass it to another program
Assuming you're trying to intercept function calls and manipulate / get the input to that function, you are going to need to hook it first.
I'd recommend reading about function hooking (there's a ...
- 121
1
vote
DLL Injection Call Address In Target
There are plenty of ways to do what you want.
I recommend you to export the method you want to call and then use the GetProcAddress function to get the address of it and call it. You can use the code ...
- 121
1
vote
Is it possible to hijack a C++ DLL after it has been loaded into the memory space? How?
It is possible for an attacker to replace the file on the disk by beating the race condition. When you write the file to disk, there is a delay until when the function you called which loads the DLL ...
- 131
1
vote
learning detour and code injection
Detouring is more or less a patching of the .text section inside of a program. It's practically more or less hacking, you're rerouting a program to do what you want it to do with your own function. ...
- 91
1
vote
learning detour and code injection
Practical Binary Analysis by Dennis Andriesse is great, the examples are mostly done on Linux but the concept is still the same for Windows.
- 63
1
vote
Can't find injected DLL in OllyDbg
After the target process is gone the code should not be running anymore, which makes me suspect you inject into a different process.
Try printing your ProcessId.
If FindWindow or ...
- 1,391
1
vote
Finding lua C functions compiled binary
As you said, the Lua engine is embedded directly into the game. It's inside plugins/GameManagerVC.dll (or GameManagerVC64.dll in case of 64-bit).
So, first step will be finding out, which version of ...
- 141
1
vote
Accepted
DLL Injection does not work twice
Calling LoadLibrary twice with the same DLL name only increases the load counter but does not cause DLL entrypoint to be called again. From the doc (emphasis mine):
If the specified module is a DLL ...
- 36.9k
1
vote
Unable to call function with CreateRemoteThread
Since I cannot add a comment I will post it here:
@NirIzr :
Well it doesn't actually point to the end, does it?
It should point to the memory where the actual byte array starts. Note that I first ...
- 15
Only top scored, non community-wiki answers of a minimum length are eligible