(Jul 29, 2014 07:39 PM)ibennz Wrote:  When will you stop comming back to HF kingroot? No one want your shitty grabber. You're the only retarded here Mr "how do i hide api callz in cpp ?".

(Jul 29, 2014 10:44 AM)Scripter4ever Wrote:  Hello everyone. It's been a while since I shared something, even something little, so I decided I could share this quick snippet I came up with.

The code:
Spoiler (Click to View)

Code

Declare Function GetProcAddress Lib "kernel32" (ByVal ModuleHandle As Integer, ByVal ProcName As String) As Integer
    Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As IntPtr
    Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As Byte(), ByVal nSize As UInteger, ByRef lpNumberOfBytesWritten As UInt32) As Boolean

    Public Sub ScrewLoadLibrary()
      Dim LoadLibraryA As IntPtr = GetProcAddress(GetModuleHandle("kernel32"), "LoadLibraryA")
      Dim LoadLibraryW As IntPtr = GetProcAddress(GetModuleHandle("kernel32"), "LoadLibraryW")
      If LoadLibraryA <> IntPtr.Zero Then WriteProcessMemory(Process.GetCurrentProcess.Handle, LoadLibraryA, New Byte() {&HC2, &H4, &H0, &H90}, 4, 0)
      If LoadLibraryW <> IntPtr.Zero Then WriteProcessMemory(Process.GetCurrentProcess.Handle, LoadLibraryW, New Byte() {&HC2, &H4, &H0, &H90}, 4, 0)
    End Sub

This, is what either of LoadLibrary entry points look like before execution of the code:
Spoiler (Click to View)



This is LoadLibrary entry point afterwards:
Spoiler (Click to View)



The first statement of LoadLibrary was just replaced by a return statement, causing any dll injector using LoadLibrary to fail (because when LoadLibrary is being called, it just returns without loading the actual dll into the process).

All you have to do is to call "ScrewLoadLibrary()".

Hopefully somebody finds this useful.

Ps. This is easy to reverse though.

(Oct 22, 2015 05:36 AM)samuelrizzo Wrote:  Can you 'translate' this method for Delphi?

Thanks

(Oct 7, 2018 06:44 AM)qabeel1 Wrote:  How do I do a task check on a program if it is an injector or not ؟