HelpPacking DLL In Executable
Packing DLL In Executable
Hello guys.
I know it's possible to pack a DLL file into an EXE file, just not sure how to do it and what I need.
The exe file is an injector, and I want it to inject the DLL.
I need to pack it the binary way. So when I want to retrieve it I wouldn't have problems.
And also because I don't have the DLL source code.
I know it's possible to pack a DLL file into an EXE file, just not sure how to do it and what I need.
The exe file is an injector, and I want it to inject the DLL.
I need to pack it the binary way. So when I want to retrieve it I wouldn't have problems.
And also because I don't have the DLL source code.
VC++ 2010 express ships without a resource editor (which is what you need.) You'll need to find a third-party resource editor:
ResEdit Resource Editor - free resource editor for Win32
Once you do, it will generate a resource script (.rc). When you compile it will generate a resource header which you can include in to your source files (the header just defines the IDs for all the resources you include). You'll need to use the resource IDs to find the resource using the windows resource APIs found here:
Resource Functions
Try to work it out yourself, if you can't, just say and I will try and figure it out for you (it looks pretty straight forward though.) I haven't done this yet with the latest version of visual studios express edition.
ResEdit Resource Editor - free resource editor for Win32
Once you do, it will generate a resource script (.rc). When you compile it will generate a resource header which you can include in to your source files (the header just defines the IDs for all the resources you include). You'll need to use the resource IDs to find the resource using the windows resource APIs found here:
Resource Functions
Try to work it out yourself, if you can't, just say and I will try and figure it out for you (it looks pretty straight forward though.) I haven't done this yet with the latest version of visual studios express edition.
You can also use a byte array.
Unless you want to extract it later to the disk you wont be able to load it from memory with any common api's. You will have to make your own PE Loader to map the dll into the process ( resolve sections, load dependencies, TLS callbacks, etc... ) really a pain in the ass.
Unless you want to extract it later to the disk you wont be able to load it from memory with any common api's. You will have to make your own PE Loader to map the dll into the process ( resolve sections, load dependencies, TLS callbacks, etc... ) really a pain in the ass.
I don't have the VC++ 2010 express edition, I have the professional one. I don't know where to edit the resource code, I have the already made templates which are adding icon or changing file's version etc.
EDIT: found out how to edit it.
The main reason for doing this is TO NOT extract the DLL to the disk, so this way it won't be leechable. But I guess it's difficult to do so?
I found this on the web:
http://stackoverflow.com/questions/9...l-in-mfc-c-exe
But does this make the DLL on the hard disk?
Cause when I try, it makes a DLL who weighs 0KB.
EDIT: I managed to make it work, but this is not what I'm looking for, as I said above, I don't want it to write the file to the disk.
EDIT: Maybe if there is some way to remove the DLL after I inject? I can't do it normally cause it says it's opened by the process.
EDIT: found out how to edit it.
The main reason for doing this is TO NOT extract the DLL to the disk, so this way it won't be leechable. But I guess it's difficult to do so?
I found this on the web:
http://stackoverflow.com/questions/9...l-in-mfc-c-exe
But does this make the DLL on the hard disk?
Cause when I try, it makes a DLL who weighs 0KB.
EDIT: I managed to make it work, but this is not what I'm looking for, as I said above, I don't want it to write the file to the disk.
EDIT: Maybe if there is some way to remove the DLL after I inject? I can't do it normally cause it says it's opened by the process.
Originally Posted by Jabberwock
I don't have the VC++ 2010 express edition, I have the professional one. I don't know where to edit the resource code, I have the already made templates which are adding icon or changing file's version etc.
EDIT: found out how to edit it.
The main reason for doing this is TO NOT extract the DLL to the disk, so this way it won't be leechable. But I guess it's difficult to do so?
I found this on the web:
embed DLL in MFC C++ EXE? - Stack Overflow
But does this make the DLL on the hard disk?
Cause when I try, it makes a DLL who weighs 0KB.
EDIT: I managed to make it work, but this is not what I'm looking for, as I said above, I don't want it to write the file to the disk.
EDIT: Maybe if there is some way to remove the DLL after I inject? I can't do it normally cause it says it's opened by the process.
EDIT: found out how to edit it.
The main reason for doing this is TO NOT extract the DLL to the disk, so this way it won't be leechable. But I guess it's difficult to do so?
I found this on the web:
embed DLL in MFC C++ EXE? - Stack Overflow
But does this make the DLL on the hard disk?
Cause when I try, it makes a DLL who weighs 0KB.
EDIT: I managed to make it work, but this is not what I'm looking for, as I said above, I don't want it to write the file to the disk.
EDIT: Maybe if there is some way to remove the DLL after I inject? I can't do it normally cause it says it's opened by the process.
1) Use a named pipe and try and detour the PE loader's checks for a path on disk rather than a path to a named pipe.
2) Catch a call to CreateFile and return a handle to your named pipe instead of whatever file it would otherwise open. (Might not work, this is a slippery slope if you choose this path.)
3) Create your own PE loader (probably your best bet, but ofc it is a bit of work.) Tbh it would probably take you a day or two to get done if you are willing to invest some time.
I would try #2 first :S Then if that doesn't work, go to #3.
Sorry for the nooby question, what does PE loader stands for?
And there isn't a way to just unload the DLL after I inject it so I can delete the DLL?
(Still looking for the easier methods)
And there isn't a way to just unload the DLL after I inject it so I can delete the DLL?
(Still looking for the easier methods)
Originally Posted by Jabberwock
Sorry for the nooby question, what does PE loader stands for?
And there isn't a way to just unload the DLL after I inject it so I can delete the DLL?
(Still looking for the easier methods)
And there isn't a way to just unload the DLL after I inject it so I can delete the DLL?
(Still looking for the easier methods)
Most anti-viruses will FREAK OUT if you try to use your own PE loader to inject code from memory anyway (a lot of malware used a very similar method to launch an executable from memory before windows 7 & vista.) You can free a library after it has been loaded by using FreeLibrary API.
However, most hacks aren't designed to just be released (well, I'm not sure what the DLL does, so it may or may not work.)
Thanks for the quick reply.
The DLL is designed to create some threads in the process, change some memory addresses and they are in infinity loops.
I guess I can't free the DLL if the script within it is infinity am I right?
The DLL is designed to create some threads in the process, change some memory addresses and they are in infinity loops.
I guess I can't free the DLL if the script within it is infinity am I right?
Originally Posted by Jabberwock
Thanks for the quick reply.
The DLL is designed to create some threads in the process, change some memory addresses and they are in infinity loops.
I guess I can't free the DLL if the script within it is infinity am I right?
The DLL is designed to create some threads in the process, change some memory addresses and they are in infinity loops.
I guess I can't free the DLL if the script within it is infinity am I right?
It probably does install a detour; so you'll have to leave it installed.
About the PE Loader, can you give me a link where I can learn how to do it?
Are you sure I won't need to have the DLL source code to use it?
Are you sure I won't need to have the DLL source code to use it?
I've gone through the liberty of writing a PE loader for you, however at the momment it still has a few bugs I will need to pan out (I am going to bed now, but when I wake up I'll take another look at it.) I will post it in the MPGH C++ section when I'm done.
Regards to a tutorial of how to write one, you're probably better off looking reading the win internals docs on the PE file format or going through MSDN. The PE file format is poorly documented by Microsoft (some whole structures defined in the winnt header are missing a description in the MSDN doc.) However, they're usually documented if you look at reverse engineering websites.
Regards to a tutorial of how to write one, you're probably better off looking reading the win internals docs on the PE file format or going through MSDN. The PE file format is poorly documented by Microsoft (some whole structures defined in the winnt header are missing a description in the MSDN doc.) However, they're usually documented if you look at reverse engineering websites.
Originally Posted by radnomguywfq3
The PE file format is poorly documented by Microsoft (some whole structures defined in the winnt header are missing a description in the MSDN doc.) However, they're usually documented if you look at reverse engineering websites.
Originally Posted by radnomguywfq3
I've gone through the liberty of writing a PE loader for you, however at the momment it still has a few bugs I will need to pan out (I am going to bed now, but when I wake up I'll take another look at it.) I will post it in the MPGH C++ section when I'm done.
Regards to a tutorial of how to write one, you're probably better off looking reading the win internals docs on the PE file format or going through MSDN. The PE file format is poorly documented by Microsoft (some whole structures defined in the winnt header are missing a description in the MSDN doc.) However, they're usually documented if you look at reverse engineering websites.
Regards to a tutorial of how to write one, you're probably better off looking reading the win internals docs on the PE file format or going through MSDN. The PE file format is poorly documented by Microsoft (some whole structures defined in the winnt header are missing a description in the MSDN doc.) However, they're usually documented if you look at reverse engineering websites.
"You must spread some Reputation around before giving it to Jetamay again."
If you are going to release it then I'm going to release the signature scanning I built for AVA, as a gratitude for this community. I'll release it at AVA's Source Code section.
Originally Posted by Jason
Most of it is really well documented (the 98-odd page PE/COFF specification document available from microsoft details a hell of a lot of the PE). I managed to write a Manual Map (Pe loader) function of my own using .NET, but never got around to properly porting it to C++. It sure is fun dealing with dynamic linkage to Windows SxS modules!
At least relative to how MSDN documents their other APIs, the documentation of the PE format is poor.
create a resource file and add the following:
resource_type resource_id resource_path
then later, use something like this code:
Using Resources
but instead of updating, just write it to a file.
resource_type resource_id resource_path
then later, use something like this code:
Using Resources
but instead of updating, just write it to a file.