Exetools  

Go Back   Exetools > General > Source Code

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 03-10-2020, 01:03
ionioni ionioni is offline
Friend
 
Join Date: Jul 2016
Posts: 80
Rept. Given: 8
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 124
Thanks Rcvd at 154 Times in 49 Posts
ionioni Reputation: 3
https://github.com/zeffy/proxydll_template latest commit to date 70b8764
x64 dll hijacker made using this might cause errors on some Windows flavours & build configs due to wrong stack alignment in the "PRX_EXPORT64 macro procname:req, ordinal:req" defined in each asm file, causing a #GP fault on instructions needing 16 byte boundary (movaps), it happened some dozen chained calls from the unaligned stack place, in system area.

Fix:
alloc_stack 20h to alloc_stack 28h
....
add rsp, 20h to add rsp, 28h
in the macro function definition of the asm file
Reply With Quote
The Following 3 Users Say Thank You to ionioni For This Useful Post:
copyleft (03-10-2020), niculaita (03-14-2020), zeffy (03-12-2020)
  #2  
Old 03-12-2020, 10:40
zeffy zeffy is offline
Friend
 
Join Date: Jul 2017
Posts: 44
Rept. Given: 3
Rept. Rcvd 7 Times in 6 Posts
Thanks Given: 212
Thanks Rcvd at 163 Times in 47 Posts
zeffy Reputation: 7
Quote:
Originally Posted by ionioni View Post
https://github.com/zeffy/proxydll_template latest commit to date 70b8764
x64 dll hijacker made using this might cause errors on some Windows flavours & build configs due to wrong stack alignment in the "PRX_EXPORT64 macro procname:req, ordinal:req" defined in each asm file, causing a #GP fault on instructions needing 16 byte boundary (movaps), it happened some dozen chained calls from the unaligned stack place, in system area.

Fix:
alloc_stack 20h to alloc_stack 28h
....
add rsp, 20h to add rsp, 28h
in the macro function definition of the asm file
Thanks, I have committed the changes you suggested. I don't have time to test it, but I'm sure it works fine.

Just fyi, I haven't been maintaining these templates recently, because I switched to using __pfnDliNotifyHook2 to implement DLL proxying on my personal projects, and haven't had time to create new templates for all the DLLs supported by this project.
Reply With Quote
The Following 3 Users Say Thank You to zeffy For This Useful Post:
copyleft (03-14-2020), ionioni (03-12-2020), niculaita (03-14-2020)
Reply

Tags
dll, hijacking

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On


Similar Threads
Thread Thread Starter Forum Replies Last Post
Windows Handle Hijacking TechLord General Discussion 2 05-15-2017 20:11


All times are GMT +8. The time now is 11:30.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )