[webinject]

When will you stop comming back to HF kingroot? No one want your shitty grabber. You're the only retarded here Mr "how do i hide api callz in cpp ?".

i'm deliberately lost.. i'm not that said person 🤣

[Flatsack]

Hello everyone. It's been a while since I shared something, even something little, so I decided I could share this quick snippet I came up with.

The code:
Spoiler (Click to View)

Code

Declare Function GetProcAddress Lib "kernel32" (ByVal ModuleHandle As Integer, ByVal ProcName As String) As Integer
    Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As IntPtr
    Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As Byte(), ByVal nSize As UInteger, ByRef lpNumberOfBytesWritten As UInt32) As Boolean

    Public Sub ScrewLoadLibrary()
      Dim LoadLibraryA As IntPtr = GetProcAddress(GetModuleHandle("kernel32"), "LoadLibraryA")
      Dim LoadLibraryW As IntPtr = GetProcAddress(GetModuleHandle("kernel32"), "LoadLibraryW")
      If LoadLibraryA <> IntPtr.Zero Then WriteProcessMemory(Process.GetCurrentProcess.Handle, LoadLibraryA, New Byte() {&HC2, &H4, &H0, &H90}, 4, 0)
      If LoadLibraryW <> IntPtr.Zero Then WriteProcessMemory(Process.GetCurrentProcess.Handle, LoadLibraryW, New Byte() {&HC2, &H4, &H0, &H90}, 4, 0)
    End Sub

This, is what either of LoadLibrary entry points look like before execution of the code:
Spoiler (Click to View)



This is LoadLibrary entry point afterwards:
Spoiler (Click to View)



The first statement of LoadLibrary was just replaced by a return statement, causing any dll injector using LoadLibrary to fail (because when LoadLibrary is being called, it just returns without loading the actual dll into the process).

All you have to do is to call "ScrewLoadLibrary()".

Hopefully somebody finds this useful.

Ps. This is easy to reverse though.

Stop trying to do native jobs in a safe environment. Do you even know how the operating system works?

[samuelrizzo]

Can you 'translate' this method for Delphi?

Thanks

[Vrekt]

Can you 'translate' this method for Delphi?

Thanks

This is a year old thread.
But nice tutorial very useful.

[qabeel1]

How do I do a task check on a program if it is an injector or not ؟

[Vyxn]

How do I do a task check on a program if it is an injector or not ؟

Loop on active process, then do the checking for each process (there's a lot of method for checking injector).