Skip to main content
6 votes
Accepted

Microsoft Edge and it's related processes may have turned protected in windows 10 1903

Is there any way to detect from the driver that this process is protected ? Disclaimer: This following procedure depends on undocmented data structure which is extracted from PDB symbol of combase....
Biswapriyo's user avatar
  • 1,569
6 votes

Permanently load a DLL to an executable

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE. From the main screen choose PE Editor and select the executable (or ...
Remko's user avatar
  • 3,273
5 votes
Accepted

Patching a string using DLL injection and OllyDbg

How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle("HackMe.exe"))? A process doesn't have a base offset; I believe you mean the base ...
Jason Geffner's user avatar
4 votes
Accepted

How to hook to a system function

Two possibilities: Patch the call instruction to point to a destination of your choosing, such as a "code cave" between the end of the .text section and the subsequent section. Write your ...
Rolf Rolles's user avatar
  • 9,198
4 votes

Forcing a legacy Windows application to use an older version of ntdll.dll

A tool like Enigma Virtual Box might help, since it can be used to pack DLL-dependencies into a single executable. I would use it on a system where everything works to pack the system's DLLs (...
xamid's user avatar
  • 141
3 votes

Hacking Lua - Introduce new functions into built Lua

One way of doing this : Localize lua_gettop in your target binary with IDA (which should be called very frequently). You can get it by downloading Lua sources, and look for error messages in your ...
Spl3en's user avatar
  • 608
3 votes
Accepted

Are offsets within a loaded dll always the same relative to each other?

Yes. Executable relocations, whether performed for optimization or security, will only relocate the image (executable, shared object) as a whole. For that reason, to bypass ASLR for example, any ...
NirIzr's user avatar
  • 11.8k
3 votes

Modifying program using IDA/Hexrays decompilation pseudocode

If you compare pseudocode returned by decompiler with your own C code you will notice one very important difference - in decompiler's output it is merely a comment, but it's very important. I'm ...
bart1e's user avatar
  • 3,399
2 votes

Avoid program detecting a thread being used

Have you considered using the DLL only for providing "stub" methods, that you could call using CreateRemoteThread, and have the DLL methods transform the arguments into what the method you ultimately ...
Jes Klinke's user avatar
2 votes
Accepted

How to manipulate game which loads many dll's

You can certainly hook dlls similarly to how you'd hook any other function. To get the address of a dll function, you'd need to call two windows APIs. First, you'll need to get the address/handle (...
NirIzr's user avatar
  • 11.8k
2 votes

In Memory DLL Injection

Aphex has demo's written in Delphi with a few code injection examples. Should compile with Delphi 2007...maybe even with Delphi 7. Remote Procedure Injection InjectLibrary InjectLibraryEx ...
Mick's user avatar
  • 7,572
2 votes

Hiding a file in a Windows operating system

There are ways to do it without resorting to hooking or drivers. For example alternate data streams (ADS), or creating files with "illegal", i.e. reserved, names (NUL, CON ... trailing ., alternative ...
0xC0000022L's user avatar
  • 10.9k
2 votes

advapi32.dll changes name of function during forwarding of exports

Shortly after posting the question I took a closer look at my code for parsing the exports and came to the realization, that I made an incorrect assumption. In the export directory entries, if a ...
Burgesstorm's user avatar
2 votes
Accepted

How to decompile "call eax" in IDA Pro?

You can take one of the following approaches: call eax usually means there is an indirect call. try to find what and where eax is defined. Maybe only by looking at it, you will found the problem. If ...
macro_controller's user avatar
2 votes
Accepted

Why does reflective dll injection need to perform loading in the target process?

Yes, it is possible to perform the necessary loading steps in the injector process (i.e., resolving the import addresses) before injecting the DLL, and some injectors/malware do that. See for example ...
Rolf Rolles's user avatar
  • 9,198
1 vote
Accepted

best approach to hook function

The first one is much better in my opinion: It doesn't use deprecated function, that is probably kept only in the Detours library for backward compatibility It uses pattern scanning, this is much ...
morsisko's user avatar
  • 696
1 vote
Accepted

dll injection (assembly code)

It is indeed possible, and not that hard to do - providing the game doesn't have any anti-cheat nor integrity checks. The thing you are looking for is called function hooking. If you don't want to ...
morsisko's user avatar
  • 696
1 vote

How to decompile "call eax" in IDA Pro?

This problem is not unique to call eax but potentially any indirect call or a call to a function with wrong type information. The possible causes and solutions are described in the Hex-Rays Decompiler ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote
Accepted

Loading a PE32 executable DLL Intel 80386 into a c# program

You can't load 32bit Dlls in 64bit Processes Solution: build a 32bit App or write an external 32bit prozess(yes a EXE) that loads the DLL and communication with that process using Pipes or TCP/IP ...
llm's user avatar
  • 336
1 vote

Get string from function and pass it to another program

Assuming you're trying to intercept function calls and manipulate / get the input to that function, you are going to need to hook it first. I'd recommend reading about function hooking (there's a ...
stylo's user avatar
  • 121
1 vote

DLL Injection Call Address In Target

There are plenty of ways to do what you want. I recommend you to export the method you want to call and then use the GetProcAddress function to get the address of it and call it. You can use the code ...
Pagefault's user avatar
  • 121
1 vote

Is it possible to hijack a C++ DLL after it has been loaded into the memory space? How?

It is possible for an attacker to replace the file on the disk by beating the race condition. When you write the file to disk, there is a delay until when the function you called which loads the DLL ...
Rob Gates's user avatar
  • 131
1 vote

learning detour and code injection

Detouring is more or less a patching of the .text section inside of a program. It's practically more or less hacking, you're rerouting a program to do what you want it to do with your own function. ...
Graham's user avatar
  • 91
1 vote

learning detour and code injection

Practical Binary Analysis by Dennis Andriesse is great, the examples are mostly done on Linux but the concept is still the same for Windows.
PotatoDrug's user avatar
1 vote

Can't find injected DLL in OllyDbg

After the target process is gone the code should not be running anymore, which makes me suspect you inject into a different process. Try printing your ProcessId. If FindWindow or ...
Johann Aydinbas's user avatar
1 vote

Finding lua C functions compiled binary

As you said, the Lua engine is embedded directly into the game. It's inside plugins/GameManagerVC.dll (or GameManagerVC64.dll in case of 64-bit). So, first step will be finding out, which version of ...
GAMELASTER's user avatar
1 vote
Accepted

DLL Injection does not work twice

Calling LoadLibrary twice with the same DLL name only increases the load counter but does not cause DLL entrypoint to be called again. From the doc (emphasis mine): If the specified module is a DLL ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote

Unable to call function with CreateRemoteThread

Since I cannot add a comment I will post it here: @NirIzr : Well it doesn't actually point to the end, does it? It should point to the memory where the actual byte array starts. Note that I first ...
user7353965's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible