Hey
iam trying to learn some stuff about this filecheck function..... My dll gets after ~5 min detected by filecheck(3 subfrunctions) - so iam trying to hook the function
For Example now GetFileVersionInfoSizeA
Code:
.text:006AC976 ; DWORD __stdcall GetFileVersionInfoSizeA(LPSTR lptstrFilename, LPDWORD lpdwHandle)
.text:006AC976 GetFileVersionInfoSizeA proc near ; CODE XREF: [COLOR="Red"]sub_47BD00[/COLOR]+24p
.text:006AC976 ; [COLOR="Lime"]WinMain(x,x,x,x)[/COLOR]+B81p ...
.text:006AC976 jmp ds:__imp_GetFileVersionInfoSizeA
.text:006AC976 GetFileVersionInfoSizeA endp
Means - GetFileVersionInfoSizeA is a function with 2 parameters(first parameter return of sub_47BD00 , second parameter return of WinMain(x,x,x,x)) and with a return of DWORD - Right?
Well then i checked the function
sub_47BD00
Code:
text:0047BD00 ; int __cdecl sub_47BD00(LPSTR lptstrFilename, int)
.text:0047BD00 sub_47BD00 proc near ; CODE XREF: sub_47AA40+109p
.text:0047BD00 ; sub_47AA40+34Ep ...
.text:0047BD00
.text:0047BD00 var_1C = dword ptr -1Ch
.text:0047BD00 Memory = dword ptr -18h
.text:0047BD00 var_14 = dword ptr -14h
.text:0047BD00 lpBuffer = dword ptr -10h
.text:0047BD00 pBlock = dword ptr -0Ch
.text:0047BD00 puLen = dword ptr -8
.text:0047BD00 dwHandle = dword ptr -4
.text:0047BD00 lptstrFilename = dword ptr 8
.text:0047BD00 arg_4 = dword ptr 0Ch
.text:0047BD00
.text:0047BD00 push ebp
.text:0047BD01 mov ebp, esp
.text:0047BD03 sub esp, 1Ch
.text:0047BD06 cmp [ebp+lptstrFilename], 0
.text:0047BD0A jz short loc_47BD12
.text:0047BD0C cmp [ebp+arg_4], 0
.text:0047BD10 jnz short loc_47BD1C
.text:0047BD12
.text:0047BD12 loc_47BD12: ; CODE XREF: sub_47BD00+Aj
.text:0047BD12 mov eax, 80070057h
.text:0047BD17
.text:0047BD17 loc_47BD17:
.text:0047BD17 jmp loc_47BDDD
and
WinMain(x,x,x,x)
Code:
; int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
.text:006595C0 _WinMain@16 proc near ; CODE XREF: start+17Fp
.text:006595C0
.text:006595C0 var_8 = dword ptr -8
.text:006595C0 hInstance = dword ptr 4
.text:006595C0 hPrevInstance = dword ptr 8
.text:006595C0 lpCmdLine = dword ptr 0Ch
.text:006595C0 nShowCmd = dword ptr 10h
.text:006595C0
.text:006595C0 push ebx
.text:006595C1 mov ebx, esp
.text:006595C3 sub esp, 8
.text:006595C6 and esp, 0FFFFFFF0h
.text:006595C9 add esp, 4
.text:006595CC push ebp
.text:006595CD mov ebp, [ebx+4]
.text:006595D0 mov [esp+0Ch+var_8], ebp
.text:006595D4 mov ebp, esp
.text:006595D6 mov eax, 1238h
.text:006595DB call __alloca_probe
.text:006595E0 mov eax, dword_782188
.text:006595E5 mov [ebp-4], eax
.text:006595E8 push esi
.text:006595E9 push edi
.text:006595EA mov dword ptr [ebp-8], 0
.text:006595F1 mov dword ptr [ebp-0Ch], 64h
.text:006595F8 push offset dword_78DC78
.text:006595FD call sub_659560
.text:00659602 add esp, 4
.text:00659605 mov eax, [ebx+8]
.text:00659608 mov hInstance, eax
.text:0065960D call ds:InitCommonControls
.text:00659613 call __initp_misc_winxfltr
.text:00659618 mov dword ptr [ebp-10h], 0
.text:0065961F push 1
.text:00659621 lea ecx, [ebp-10h]
.text:00659624 push ecx
.text:00659625 push 0FFF0h
.text:0065962A call sub_5D0B50
.text:0065962F add esp, 0Ch
.text:00659632 mov dword_877530, eax
.text:00659637 mov dword ptr [ebp-10h], 0
.text:0065963E push 1
.text:00659640 lea edx, [ebp-10h]
.text:00659643 push edx
.text:00659644 push 0FFBFh
.text:00659649 call sub_5D0B50
.text:0065964E add esp, 0Ch
.text:00659651 mov dword_877534, eax
.text:00659656 mov dword ptr [ebp-0A8h], 94h
.text:00659660 lea eax, [ebp-0A8h]
.text:00659666 push eax ; lpVersionInformation
.text:00659667 call ds:GetVersionExA
.text:0065966D test eax, eax
.text:0065966F jz loc_659B7A
.text:00659675 mov ecx, [ebp-0A0h]
.text:0065967B push ecx
.text:0065967C mov edx, [ebp-0A4h]
.text:00659682 push edx
.text:00659683 push offset aOsMajorDMinorD ; "OS : Major %d, Minor %d, Name "
.text:00659688 push 104h ; Count
.text:0065968D push offset aOsUnknown ; "OS : unknown\r\n"
.text:00659692 call __snprintf
.text:00659697 add esp, 14h
.text:0065969A mov eax, [ebp-0A4h]
.text:006596A0 shl eax, 10h
.text:006596A3 or eax, [ebp-0A0h]
.text:006596A9 mov [ebp-0ACh], eax
.text:006596AF cmp dword ptr [ebp-0ACh], 4005Ah
.text:006596B9 ja short loc_6596FC
.text:006596BB cmp dword ptr [ebp-0ACh], 4005Ah
.text:006596C5 jz loc_659850
.text:006596CB cmp dword ptr [ebp-0ACh], 30033h
.text:006596D5 jz loc_6598AB
.text:006596DB cmp dword ptr [ebp-0ACh], 40000h
.text:006596E5 jz short loc_659731
.text:006596E7 cmp dword ptr [ebp-0ACh], 4000Ah
.text:006596F1 jz loc_6597F5
.text:006596F7 jmp loc_6599FC
and now ....
i dont know if iam on the right way ...
Are sub_47BD00 and WinMain(x,x,x,x) parameters of the GetFileVersionInfoSizeA function? - ahh thats wrong because sub_47BD00 and WinMain(x,x,x,x) are int functins and GetFileVersionInfoSizeA need LPSTR lptstrFilename LPDWORD lpdwHandle.
Where can i find the real function code of GetFileVersionInfoSizeA ?
Can i hook the GetFileVersionInfoSizeA function with a constant -"everything is fine" argument?!
What are sub_47BD00 and WinMain(x,x,x,x) doing?
Dont worry i know my speech is realy denglish !!
Thanks for any help
