Erase DLL PE Header

[Kenshin13]

Sometimes you want to make it impossible for people to dump a DLL in a process or want the program to not detect it.
Well since I'm bored, I decided to make a simple way to do it.

 

[DllImport("kernel32.dll")]
public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll", SetLastError = true)]
static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress,[Out] byte[] lpBuffer, int dwSize, out IntPtr lpNumberOfBytesRead);
[DllImport("kernel32.dll",SetLastError = true)]
static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte [] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesWritten);

private int ErasePEHeader(IntPtr hModule, string procName) // hModule = Handle to the module, procName = Process name (eg. "notepad")
{
	byte[] imagentheaderptr = new byte[4];
	byte[] Stub = new byte[120];
	byte[] Stub2 = new byte[0x108];
	int Out = 0, Out2;

	IntPtr proc = OpenProcess(0x001F0FFF, false, Process.GetProcessesByName(procName)[0].Id);
	IntPtr IMAGE_NT_HEADER = new IntPtr((hModule.ToInt32() + 60)), out2 = IntPtr.Zero;
	ReadProcessMemory(proc, IMAGE_NT_HEADER, imagentheaderptr, 4, out out2);
	if ((WriteProcessMemory(proc, hModule, Stub, 120, out Out) == true) && (WriteProcessMemory(proc, hModule, Stub2, 0x100, out Out2) == true)) return Out+Out2;
	else return 0;
}

 

bool ErasePEHeader( HMODULE hModule ) // hModule = handle to DLL
{
        if((DWORD)hModule == 0) return 0;
        DWORD IMAGE_NT_HEADER = *(int*)((DWORD)hModule + 60);
        for(int i=0; i<0x108; i++)
                *(BYTE*)(IMAGE_NT_HEADER+i) = 0;
        for(int i=0; i<120; i++)
                *(BYTE*)((DWORD)hModule+i) = 0;
        return 1;
}

Now I know there's much better ways to do this but this is the ... simplest way. It erases the IMAGE_DOS_HEADER and IMAGE_NT_HEADER with a few pointers to other structures.

Some limitations:

- GetProcAddress will not work after you do this
- DLLs can still be dumped ( But terribly disorganized making it near impossible to restore fully )

[COD3RIN]

nice releasing of source code.....for now i cannot create trainer or d3d hack my pc have a virus i need to reinstall my pc soon...

[Lovroman]

Thanks, Zach!

[Kenshin13[Backup]]

Thanks, Zach!

You're incredibly funny with all this controversy going on with the other "Zach".
But you're welcome.

Please feel to post any other solutions you have for making it harder to dump/detect Dlls.

[The Conjurer]

How about in VB bro ?

[hkKenshin]

How about in VB bro ?

Just use an online C# to VB converter.

[The Conjurer]

Just use an online C# to VB converter.

What should i edit to make a checkbox out of it?

[hkKenshin]

What should i edit to make a checkbox out of it?

Just check if the checkbox is checked and call the function