Hot answers tagged

3

You could create a loader which simply creates your target app in suspended state and loads dll into virtual address space of that process. That way the dll you injected would run before entrypoint of the target app. Example code: STARTUPINFO si; PROCESS_INFORMATION pi; ZeroMemory(&si, sizeof(STARTUPINFO)); ZeroMemory(&pi, sizeof(PROCESS_INFORMATION)...


2

I think this is the reason why there are some WinAPIs that also existing in kernelbase.dll. "As an example of functionality that we moved to low-level binaries, kernelbase.dll gets functionality from kernel32.dll and advapi32.dll. This means that the existing binary now forwards calls down to the new binary rather than handling them directly; the ...


2

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE. From the main screen choose PE Editor and select the executable (or DLL) that you wish to modify: Then click Directories: Click the Ellipsis button next to Import Table: Right Click and choose add import: Now add your dll and ...


2

First, please read this. Essentially the difference is (in both cases) that one - the entry point - refers to the address where the initial code will be located and the other - "main function" - will be the one provided by the (C) runtime, potentially hiding gory details from you. From what I understand, Start is the entry point for an exe and it does ...


1

The easiest way would be just to set a breakpoint where the call instruction is and then perform step into - you will be redirected to the right function. You can also check it statically assuming that you know where the GameLauncher_StartGameW is called. Notice that just before call [eax+8], eax contains *arg0 value. If you know the arguments' values, you ...


1

You can use de4dot, its best to restore a packed assembly, if failed to unpack files try x64dbg and ScyllaHide plugin to dump and restore the dll with following the steps: open the file in x64dbg goto plugins -> Scylla click on "Pick DLL" select dll from the list click on "Dump" save and done! for identify packers and more info check this tools: - ...


1

mov edi, edi is an instruction that is called hotpatch point there are several articles about it on the internet, notable among them are: Raymond Chens old new thing 1 Raymond Chens old new thing 2 Johannas passing's Hot patch walkthrough The main utility for this instruction is to enable a third party app or Windows update to patch an existing ...


Only top voted, non community-wiki answers of a minimum length are eligible