Posted June 2, 20187 yr Hi In this method we're using dlls as loader, Some system files(I'm just tested dll files) can load from outside of system directory so we can use them to patch files !! Most "Delphi" and "Dotnet applications" loads "version.dll" by default so we can use this file as loader for them ! Best Regards, h4sh3m version.rar
June 2, 20187 yr This method is known as proxying. Some other commonly used dll's that are proxied: - d3d8.dll / d3d9.dll (Commonly used in games.) - dinput8.dll (Commonly used in games.) - opengl32.dll (Commonly used in games.) - mscoree.dll (Commonly loaded in .NET applications.) - dxgi.dll (Commonly loaded on Windows 10 in nearly all applications.) - wsock32.dll (Commonly loaded in applications that make internet connections.)
June 2, 20187 yr Author Hi @atom0s, Thank you for information. I released it because I didn't saw any sample before, In addition I'm using following files too:winmm, bcrypt, MSIMG32, ... Best Regards, h4sh3m Edited June 4, 20187 yr by h4sh3m
June 2, 20187 yr you'd have found some if you used the right terms, there's quite a few on github, and what do you mean by using additional files like winmm ? https://www.google.com/search?q=dll+proxy+github 384,000 results.. might also be an idea to look up what loader means too Edited June 2, 20187 yr by evlncrn8
June 2, 20187 yr Author 13 minutes ago, evlncrn8 said: you'd have found some if you used the right terms, there's quite a few on github, and what do you mean by using additional files like winmm ? https://www.google.com/search?q=dll+proxy+github 384,000 results.. might also be an idea to look up what loader means too I'm using this method for 4+ years, maybe I was too lazy to find ready codes !
June 2, 20187 yr Author 1 minute ago, JohnWho said: Those windows .dll files differs between versions and languages even in exported functions ?!
June 2, 20187 yr in the amount of exports.. and you've been using this method for 4 years and only now release src as if you invented the wheel ? come on please, cut the crap Edited June 2, 20187 yr by evlncrn8
June 2, 20187 yr i had a brief look at the code, you should be aware that doing a LoadLibrary inside DllMain is a really bad idea https://msdn.microsoft.com/en-us/library/windows/desktop/ms682583(v=vs.85).aspx https://stackoverflow.com/questions/4370812/calling-loadlibrary-from-dllmain Edited June 2, 20187 yr by evlncrn8
June 2, 20187 yr Author wow, I forgot again that all users are professional and no need simple sources ! I apologize for that and never release anything Have a nice day
June 2, 20187 yr lets not throw a tantrum shall we ?.. i pointed out things you should have been aware of.. you're releasing code others will probably use (hopefully not though), so would it be professional to release it in the state its in ? as for not releasing anything anymore.. thats up to you, but it wasnt the point of my post, so maybe take a little breather, pick up your toys from the floor, put them back in the pram and read what i posted.. especially the part about dllmain and loadlibrary, and i still dont see the part about winmm in your code either.. just version.dll.. then take the points made by me and others, maybe do some research too (or are you too lazy for that as well?) and make your code better, for the benefits of others, also its a good idea to put some comments in your code so others can follow the concept oh, and one more thing - its still not a loader Edited June 2, 20187 yr by evlncrn8
June 3, 20187 yr 8 hours ago, atom0s said: This method is known as proxying. Some other commonly used dll's that are proxied: - d3d8.dll / d3d9.dll (Commonly used in games.) - dinput8.dll (Commonly used in games.) - opengl32.dll (Commonly used in games.) - mscoree.dll (Commonly loaded in .NET applications.) - dxgi.dll (Commonly loaded on Windows 10 in nearly all applications.) - wsock32.dll (Commonly loaded in applications that make internet connections.) themida embed the mscoree.dll ,how to proxy?
June 4, 20187 yr Sorry, there is a problem We could not locate the item you are trying to view. Error code: 2S328/1 Cann't download it.
December 19, 20204 yr Read this for now: https://guidedhacking.com/threads/dll-hijacking-vulkan-hook-tutorial-quake-2-hack.13518/
November 16, 2024Nov 16 Doesn't work in Delphi 7 ....you need to change: function SystemDir: UnicodeString; var dir: array [0..MAX_PATH] of WideChar; function StrPas(const Str: PWideChar): UnicodeString; begin Result := Str; end; begin GetSystemDirectory(dir, MAX_PATH); Result := StrPas(dir); end; to: function SystemDir: string; begin SetLength(Result, MAX_PATH); { Allocate a string large enough to hold the path } GetSystemDirectory(PChar(Result), MAX_PATH); { Fill the string with the system directory } SetLength(Result, lstrlen(PChar(Result))); { Resize the string to the actual length of the result } end; & missing 03 Exports: GetFileVersionInfoExA GetFileVersionInfoSizeExA GetFileVersionInfoW Edited November 16, 2024Nov 16 by TeRcO
December 19, 2024Dec 19 On 12/19/2020 at 9:50 PM, DaGoN said: Read this for now: https://guidedhacking.com/threads/dll-hijacking-vulkan-hook-tutorial-quake-2-hack.13518/ Anyone have a copy of this article? It need to sign up first. Thank you
Create an account or sign in to comment