Converting Dynamically linked library to executable.
Converting Dynamically linked library to executable.
I had to do this to unpack one of my target library as it wasn't working out well while loading the library via the executable. And a friend wanted me to show them how to do it, thus I made a video and I don't see any harm in sharing it with you guys :O
First you need to understand, while an executable has a EP, a dll has a defined RVA that is called when it has been loaded(known to most programmers as dllmain). Thus, the goal would be to have code injected into our target. What this code will do is call the dllmain of library, we'll set the executables EP to this point. You could say, we're createing an executable around the dll. It's a fairly simple process and hopefully you'll all find it helpful at later times. However, when we call dllmain we have to provide valid parameters, defined so here:
dllmain - MSDN Search
( I can't provide a direct link, only one that performs a search query, as MSDN is constantly changing their web-page's URLs to prevent direct-linking. Thus a direct link would be unreliable)
In the tutorial I use this webpage, however, I use it backwards D: Since the stack is LIFO. :X I just want to state I remembered the push order was 0,1,0 because I've done it before. I was simply trying to deminstrate how to use the MSN refference page as many people don't know how, and wasn't paying attention to it :S.
View in HD if you want to see anything:
First you need to understand, while an executable has a EP, a dll has a defined RVA that is called when it has been loaded(known to most programmers as dllmain). Thus, the goal would be to have code injected into our target. What this code will do is call the dllmain of library, we'll set the executables EP to this point. You could say, we're createing an executable around the dll. It's a fairly simple process and hopefully you'll all find it helpful at later times. However, when we call dllmain we have to provide valid parameters, defined so here:
dllmain - MSDN Search
( I can't provide a direct link, only one that performs a search query, as MSDN is constantly changing their web-page's URLs to prevent direct-linking. Thus a direct link would be unreliable)
In the tutorial I use this webpage, however, I use it backwards D: Since the stack is LIFO. :X I just want to state I remembered the push order was 0,1,0 because I've done it before. I was simply trying to deminstrate how to use the MSN refference page as many people don't know how, and wasn't paying attention to it :S.
View in HD if you want to see anything:
thanks jeremy wildsmith. i think i nao understand.
Oh, hawt post guy.
