so today I wanna release some kind of tool which I have made in the past.Maybe you have sometimes trouble to unpack some packer | protections which you want to patch and in this case you can use some usually other tools like loader's etc which have limited skills where you just can patch some single addresses etc and in many cases are loader's not working or get detected or you get trouble with some CRC checks etc.So this was also a reason for me to create this new tool which is just a small exe with some code created directly in Olly.So the main tool is the InLine Hooker_Full.exe which has enabled 10 diffrent API hook's.
How does it work? ---------------------- InLine Hooker_Full.exe + Victim file [Add file as new section on the InLine Hooker_Full.exe] + User Patch [Write your patch into InLine Hooker_Full.exe at IBase+0DCDE]
Adding of the real app is better to prevent file manipulation so the file will always creates new if you execute your InLine Hooker.The new created file is like the original file so it's untouched and you will see the diffrent if you start the new created alone.
START OF USER PATCH --------------------- 0040DCB0 PUSHAD ; START OF USER PATCH! 0040DCB1 PUSHAD 0040DCB2 CALL 0040DCB7 ; InLine_H.0040DCB7 0040DCB7 POP EAX ; 0040DCB8 SUB EAX,3F07 ; Memsection START in EAX! 0040DCBD MOV EDI,EAX ; Memsection START to EDI,ESI,EBP,EBX! 0040DCBF MOV ESI,EAX 0040DCC1 MOV EBP,EAX 0040DCC3 MOV EBX,EAX 0040DCC5 MOV EDI,DWORD PTR DS:[EDI+68] 0040DCC8 ADD ESI,5C ; MEM START+5C = Free Address for VP old protect! 0040DCCB MOV EBP,DWORD PTR FS:[18] ; TEB to EBP 0040DCD2 MOV EBP,DWORD PTR DS:[EBP+30] ; PEB to EBP 0040DCD6 MOV EBP,DWORD PTR DS:[EBP+8] ; ImageBase to EBP 0040DCDA NOP ; ImageBase in EBP 0040DCDB NOP ; MemStart+5C in ESI 0040DCDC NOP ; VirtualProtect in EDI 0040DCDD NOP ; EBP ESI EDI Keep the same! 0040DCDE MOV EBX,EBP ; ImageBase to EBX 0040DCE0 ADD EBX,1000 ; Add EBX 1000 = Codesection Start 0040DCE6 CMP DWORD PTR DS:[EBX],0FFFFFF ; CMP [Codesection] for XXX 0040DCEC JNZ SHORT 0040DCFC ; Jump if not equal 0040DCEE PUSH ESI ; Push MEMSEC+5C = Free DWORD Store! 0040DCEF PUSH 40 ; Push PageExeCute Read | Write! NewProtect 0040DCF1 PUSH 10 ; Push Bytes to New Protect! 0040DCF3 PUSH EBX ; Push Address Start to protect! 0040DCF4 CALL EDI ; Call VirtualProtect 0040DCF6 MOV DWORD PTR DS:[EBX],0FFFFFF ; Mov Patch to [Codesection]! 0040DCFC NOP 0040DCFD NOP ---------------- -------- Keep same --- EBP 01000000 ImageBase ESI 0009005C Mem START + 5C EDI 7C801AD0 kernel32.VirtualProtect <--- VP API ----------------- ---------- MemoryBlock+5c in ESI ----------------------- 0009005C 00000000 <-- location for VP old access store 00090060 7C800000 kernel32.7C800000 00090064 7C80AC28 kernel32.GetProcAddress 00090068 7C801AD0 kernel32.VirtualProtect 0009006C 7C801D77 kernel32.LoadLibraryA 00090070 77D10000 USER32.77D10000 00090074 66000000 MSVBVM60.66000000 00090078 77BE0000 msvcrt.77BE0000 0009007C 5F1A0000 olepro32.5F1A0000 <------- is ntdll.dll in ZW InLine Hooker! 00090080 7C80B529 kernel32.GetModuleHandleA 00090084 77C16F70 msvcrt.memcpy <--- Not hooked 00090088 7C812C8D kernel32.GetCommandLineA 0009008C 7C801EEE kernel32.GetStartupInfoA 00090090 7C8114AB kernel32.GetVersion 00090094 7C8017E5 kernel32.GetSystemTimeAsFileTime <------- is ntdll.ZwDelayExecution in ZW InLine Hooker! 00090098 6600357C MSVBVM60.ThunRTMain <--- Not hooked 0009009C 77C0537C msvcrt.__set_app_type 000900A0 77D288E1 USER32.DialogBoxParamA
The code above is just a small exsample Template so you can set any InLines you want from this address into.Also you can add many other patches too if you need till the end which here....
If you need more free space then jsut move this code deeper in the exe.The double EBFE bytes are the end marker of reading your patches.So I have test it with diffrent protections and its working with the most.I have also creates four exsample files with four diffrent protections + patches where you can see the diffrent and for you to test and check them.
The script which I have written for this tool can you use if you want to disable one till nine API hook's and if you want to change the created exe file name of your file which will created and as always I have also made three movies where you can see how it works.Maybe this tool will help you with some of your files where other tools give up.Just test it if you want and if something is not clear then you can ask on this topic of course.
PS: Read also the info files to get more infos. Note: The file will maybe detected by your Anti Virus app,no fear so its a false alert.
Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха
and here again a new file with a other patch.Just test with win7 and tell whether it works or not.Remember,file + regkey.dat must be together in the same folder.
Thanks
Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха
ok now I have craeted a new file for a quick test again.So I found a copy bug inside for APIs which use jump & calls directly from the first commands like GetCommandLineA & GetVersion [thanks ragdog for this infos ] for exsample for Win7 (EB) and now I added a better read & correct patch of the API adresses EB | E9 | E8.
Ok and now it should work.So here the new file.Just unrar it + regkey.dat together and then double click the InLine Hooker_ZW_Dynamic_WL_DAT_XP_win7_5.exe and see what happend.So if you use win7 then test this file and tell me whether all is working fine and the app starts with the safengine Licensor UnpackMe NAG.So it takes just a minute for you to test it.Would be very nice if you can test it now on your win7.
Thank you
Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха
