[Release] How To Load .DLL With Dekaron.exe

=Seph= · 02/18/2012, 11:10

Put a jump to a code cave in the ep of dekaron.exe
Orginal

Code:

CPU Disasm
Address   Hex dump          Command                                           Comments
00800A62  /.  6A 60         PUSH 60
00800A64  |.  68 A861A000   PUSH OFFSET 00A061A8

Patched

Code:

CPU Disasm
Address   Hex dump          Command                                  Comments
00800A62   .  E9 29353800   JMP 00B83F90
00800A67      90            NOP
00800A68      90            NOP

Location is the locations of the text string with the name of your dll.

Code:

CPU Disasm
Address   Hex dump          Command                                  Comments
00B83F90   \68 303FB800     PUSH OFFSET Location                     ; ASCII "somthing.dll"
00B83F95    FF15 0CC39900   CALL DWORD PTR DS:[99C30C] <--- LoadLibrary
00B83F9B    6A 60           PUSH 60 <--The code we replaced the jump with.
00B83F9D    68 A861A000     PUSH OFFSET 00A061A8<---The code we replaced the jump with.
00B83FA2  ^ E9 C2CAC7FF     JMP 00800A69 <--Jump back to orginal code :S

dezinho1 · 02/18/2012, 19:58

= Seph =

would not be much faster to use LordPE ?