[Madara-Uchiha]

Yo, buddy S4E posted some nice stuff there :)
Very useful!

[RKYDA]

Hello, thank you for this.
With option strict:
Dim LoadLibraryA As IntPtr = CType(GetProcAddress(CInt(GetModuleHandle("kernel32")), "LoadLibraryA"), IntPtr)
Dim LoadLibraryW As IntPtr = CType(GetProcAddress(CInt(GetModuleHandle("kernel32")), "LoadLibraryW"), IntPtr)

[Only3]

Hello, thank you for this.
With option strict:
Dim LoadLibraryA As IntPtr = CType(GetProcAddress(CInt(GetModuleHandle("kernel32")), "LoadLibraryA"), IntPtr)
Dim LoadLibraryW As IntPtr = CType(GetProcAddress(CInt(GetModuleHandle("kernel32")), "LoadLibraryW"), IntPtr)

he use the old vb api
change \ use
Declare Function GetProcAddress Lib "kernel32" (ByVal ModuleHandle As IntPtr, ByVal ProcName As String) As IntPtr

[Only3]

This implementation is flawed. Here's why:

1. You're screwing the LoadLibrary function even for the application itself. What if the app tries to load a dll via LoadLibrary at some point?
   


2. A parameter is passed to the function, so it overwritten instruction should be RET 4 instead (4 bytes for the pointer). Your current implementation will mess up the stack and crash the app.
   

😁 simple if check will fix it 🙂

---

'Declare' is old too...

PHP Code


<?php 
<DllImport("kernel32", CharSet:=CharSet.Auto, SetLastError:=True)>
    Private Shared Function GetProcAddress(
      ByVal ModuleHandle As IntPtr,
      ByVal ProcName As String) As IntPtr
    End Function 


its obvious dont u think i even write it in my reply 😊

[Dispersia]

Interesting, you should redirect the loadlib arg to a ptr and check the library loaded. (I mean, what if my application use Loadlib to do stuff ?) and ret/jmp only if it doesn't match a list. Even so, I guess it could be bypassed easly D; !! Anyway nice share OP !

You could also simply just write the instructions back before injecting.

[DeMoNi]

You could also simply just write the instructions back before injecting.

+1, compare the function opcodes, and change them back if they are modified.

[webinject]

Interesting, you should redirect the loadlib arg to a ptr and check the library loaded. (I mean, what if my application use Loadlib to do stuff ?) and ret/jmp only if it doesn't match a list. Even so, I guess it could be bypassed easly D; !! Anyway nice share OP !

'redirect the load lib arg to a ptr'
i loled a little inside the proper term for this is a hook. nothing you .NEt coders would understand

op are you retarded? This will eventually crash once a module tries to import a reference and can't seem to register it into the PEB.
Also this doesn't patch injection at all. They can use ldrloaddll, and several other functions. They can also manually map the dll then call CRT.

And again, many other ways.

[webinject]

When will you stop comming back to HF kingroot? No one want your shitty grabber. You're the only retarded here Mr "how do i hide api callz in cpp ?".

i'm deliberately lost.. i'm not that said person 🤣

[Flatsack]

Hello everyone. It's been a while since I shared something, even something little, so I decided I could share this quick snippet I came up with.

The code:
Spoiler (Click to View)

Code

Declare Function GetProcAddress Lib "kernel32" (ByVal ModuleHandle As Integer, ByVal ProcName As String) As Integer
    Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As IntPtr
    Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As Byte(), ByVal nSize As UInteger, ByRef lpNumberOfBytesWritten As UInt32) As Boolean

    Public Sub ScrewLoadLibrary()
      Dim LoadLibraryA As IntPtr = GetProcAddress(GetModuleHandle("kernel32"), "LoadLibraryA")
      Dim LoadLibraryW As IntPtr = GetProcAddress(GetModuleHandle("kernel32"), "LoadLibraryW")
      If LoadLibraryA <> IntPtr.Zero Then WriteProcessMemory(Process.GetCurrentProcess.Handle, LoadLibraryA, New Byte() {&HC2, &H4, &H0, &H90}, 4, 0)
      If LoadLibraryW <> IntPtr.Zero Then WriteProcessMemory(Process.GetCurrentProcess.Handle, LoadLibraryW, New Byte() {&HC2, &H4, &H0, &H90}, 4, 0)
    End Sub

This, is what either of LoadLibrary entry points look like before execution of the code:
Spoiler (Click to View)



This is LoadLibrary entry point afterwards:
Spoiler (Click to View)



The first statement of LoadLibrary was just replaced by a return statement, causing any dll injector using LoadLibrary to fail (because when LoadLibrary is being called, it just returns without loading the actual dll into the process).

All you have to do is to call "ScrewLoadLibrary()".

Hopefully somebody finds this useful.

Ps. This is easy to reverse though.

Stop trying to do native jobs in a safe environment. Do you even know how the operating system works?