[SIM-478284]

Hello everyone. It's been a while since I shared something, even something little, so I decided I could share this quick snippet I came up with.

The code:
Spoiler (Click to View)

Code

Declare Function GetProcAddress Lib "kernel32" (ByVal ModuleHandle As Integer, ByVal ProcName As String) As Integer
    Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As IntPtr
    Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As Byte(), ByVal nSize As UInteger, ByRef lpNumberOfBytesWritten As UInt32) As Boolean

    Public Sub ScrewLoadLibrary()
      Dim LoadLibraryA As IntPtr = GetProcAddress(GetModuleHandle("kernel32"), "LoadLibraryA")
      Dim LoadLibraryW As IntPtr = GetProcAddress(GetModuleHandle("kernel32"), "LoadLibraryW")
      If LoadLibraryA <> IntPtr.Zero Then WriteProcessMemory(Process.GetCurrentProcess.Handle, LoadLibraryA, New Byte() {&HC2, &H4, &H0, &H90}, 4, 0)
      If LoadLibraryW <> IntPtr.Zero Then WriteProcessMemory(Process.GetCurrentProcess.Handle, LoadLibraryW, New Byte() {&HC2, &H4, &H0, &H90}, 4, 0)
    End Sub

This, is what either of LoadLibrary entry points look like before execution of the code:
Spoiler (Click to View)



This is LoadLibrary entry point afterwards:
Spoiler (Click to View)



The first statement of LoadLibrary was just replaced by a return statement, causing any dll injector using LoadLibrary to fail (because when LoadLibrary is being called, it just returns without loading the actual dll into the process).

All you have to do is to call "ScrewLoadLibrary()".

Hopefully somebody finds this useful.

Ps. This is easy to reverse though.

[Madara-Uchiha]

Yo, buddy S4E posted some nice stuff there :)
Very useful!

[RKYDA]

Hello, thank you for this.
With option strict:
Dim LoadLibraryA As IntPtr = CType(GetProcAddress(CInt(GetModuleHandle("kernel32")), "LoadLibraryA"), IntPtr)
Dim LoadLibraryW As IntPtr = CType(GetProcAddress(CInt(GetModuleHandle("kernel32")), "LoadLibraryW"), IntPtr)

[0xBB]

Interesting, you should redirect the loadlib arg to a ptr and check the library loaded. (I mean, what if my application use Loadlib to do stuff ?) and ret/jmp only if it doesn't match a list. Even so, I guess it could be bypassed easly D; !! Anyway nice share OP !

[Only3]

Hello, thank you for this.
With option strict:
Dim LoadLibraryA As IntPtr = CType(GetProcAddress(CInt(GetModuleHandle("kernel32")), "LoadLibraryA"), IntPtr)
Dim LoadLibraryW As IntPtr = CType(GetProcAddress(CInt(GetModuleHandle("kernel32")), "LoadLibraryW"), IntPtr)

he use the old vb api
change \ use
Declare Function GetProcAddress Lib "kernel32" (ByVal ModuleHandle As IntPtr, ByVal ProcName As String) As IntPtr

[d3c0mpil3r]

This implementation is flawed. Here's why:

1. You're screwing the LoadLibrary function even for the application itself. What if the app tries to load a dll via LoadLibrary at some point?
   


2. A parameter is passed to the function, so it overwritten instruction should be RET 4 instead (4 bytes for the pointer). Your current implementation will mess up the stack and crash the app.
   

[iStalker]

he use the old vb api
change \ use
Declare Function GetProcAddress Lib "kernel32" (ByVal ModuleHandle As IntPtr, ByVal ProcName As String) As IntPtr

'Declare' is old too...

PHP Code


<?php 
<DllImport("kernel32", CharSet:=CharSet.Auto, SetLastError:=True)>
    Private Shared Function GetProcAddress(
            ByVal ModuleHandle As IntPtr,
            ByVal ProcName As String) As IntPtr
    End Function 


[Only3]

This implementation is flawed. Here's why:

1. You're screwing the LoadLibrary function even for the application itself. What if the app tries to load a dll via LoadLibrary at some point?
   


2. A parameter is passed to the function, so it overwritten instruction should be RET 4 instead (4 bytes for the pointer). Your current implementation will mess up the stack and crash the app.
   

😁 simple if check will fix it 🙂

---

'Declare' is old too...

PHP Code


<?php 
<DllImport("kernel32", CharSet:=CharSet.Auto, SetLastError:=True)>
    Private Shared Function GetProcAddress(
      ByVal ModuleHandle As IntPtr,
      ByVal ProcName As String) As IntPtr
    End Function 


its obvious dont u think i even write it in my reply 😊

[SIM-478284]

This implementation is flawed. Here's why:

1. You're screwing the LoadLibrary function even for the application itself. What if the app tries to load a dll via LoadLibrary at some point?
   


2. A parameter is passed to the function, so it overwritten instruction should be RET 4 instead (4 bytes for the pointer). Your current implementation will mess up the stack and crash the app.
   

"You're screwing the LoadLibrary function even for the application itself."

Well, that was obviously point of my code. If the application is using LoadLibrary it's supposed to use it BEFORE screwing up the entry point to make sure only those dll files that are necessary are loaded, and there's no chance to use CreateRemoteThread and inject a dll into the process.

"A parameter is passed to the function, so it overwritten instruction should be RET 4 instead (4 bytes for the pointer). Your current implementation will mess up the stack and crash the app."

Really? My bad then. Thanks for pointing that out. Anyhow, the application does not crash for me when I try to inject a dll file (but neither does the dll get loaded), so how's that then?

Anyhow, the code should be fixed now on that matter.

Interesting, you should redirect the loadlib arg to a ptr and check the library loaded. (I mean, what if my application use Loadlib to do stuff ?) and ret/jmp only if it doesn't match a list. Even so, I guess it could be bypassed easly D; !! Anyway nice share OP !

I see what you mean. :P Well, my code works in case you have loaded all the necessary libraries before screwing the entry point.

[d3c0mpil3r]

About the 2nd point, here's a pseudo code:

Code

push <address of string representing the path>
call LoadLibrary

Now inside the function, you're just returning. What about that pointer which is still lying on the top of the stack? That's where the problem is. You need to clean up the stack your self. So, replace RET with RET 4. You're lucky it didn't crash your app.

Although your method will protect from trivial dll injection attacks, the approach is still flawed for real time applications. They will most likely use LoadLibrary at some point to load dlls at runtime. You're actually limiting the application itself by doing this. Also, one can still use CreateRemoteThread to inject dlls or even inject the code directly, as this implementation is easy to bypass.

You should really consider blocking the creation of new suspicious threads instead of blocking random LoadLibrary calls.

[Dispersia]

Interesting, you should redirect the loadlib arg to a ptr and check the library loaded. (I mean, what if my application use Loadlib to do stuff ?) and ret/jmp only if it doesn't match a list. Even so, I guess it could be bypassed easly D; !! Anyway nice share OP !

You could also simply just write the instructions back before injecting.

[SIM-1456245]

You got some great shit right there bro, good job. But as already mentioned, you are actually blocking yourself from LoadLibrary. But that would be very rare situation, so you will be good.

[DeMoNi]

You could also simply just write the instructions back before injecting.

+1, compare the function opcodes, and change them back if they are modified.

[webinject]

Interesting, you should redirect the loadlib arg to a ptr and check the library loaded. (I mean, what if my application use Loadlib to do stuff ?) and ret/jmp only if it doesn't match a list. Even so, I guess it could be bypassed easly D; !! Anyway nice share OP !

'redirect the load lib arg to a ptr'
i loled a little inside the proper term for this is a hook. nothing you .NEt coders would understand

op are you retarded? This will eventually crash once a module tries to import a reference and can't seem to register it into the PEB.
Also this doesn't patch injection at all. They can use ldrloaddll, and several other functions. They can also manually map the dll then call CRT.

And again, many other ways.

[0xBB]

'redirect the load lib arg to a ptr'
i loled a little inside

op are you retarded? This will eventually crash once a module tries to import a reference and can't seem to register it into the PEB.
Also this doesn't patch injection at all. They can use ldrloaddll, and several other functions. They can also manually map the dll then call CRT.

And again, many other ways.

When will you stop comming back to HF kingroot? No one want your shitty grabber. You're the only retarded here Mr "how do i hide api callz in cpp ?".