Erase DLL PE Header
Sometimes you want to make it impossible for people to dump a DLL in a process or want the program to not detect it.
Well since I'm bored, I decided to make a simple way to do it.
Now I know there's much better ways to do this but this is the ... simplest way. It erases the IMAGE_DOS_HEADER and IMAGE_NT_HEADER with a few pointers to other structures.
Some limitations:
Well since I'm bored, I decided to make a simple way to do it.
C# (External)
Code:
[DllImport("kernel32.dll")]
public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll", SetLastError = true)]
static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress,[Out] byte[] lpBuffer, int dwSize, out IntPtr lpNumberOfBytesRead);
[DllImport("kernel32.dll",SetLastError = true)]
static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte [] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesWritten);
private int ErasePEHeader(IntPtr hModule, string procName) // hModule = Handle to the module, procName = Process name (eg. "notepad")
{
byte[] imagentheaderptr = new byte[4];
byte[] Stub = new byte[120];
byte[] Stub2 = new byte[0x108];
int Out = 0, Out2;
IntPtr proc = OpenProcess(0x001F0FFF, false, Process.GetProcessesByName(procName)[0].Id);
IntPtr IMAGE_NT_HEADER = new IntPtr((hModule.ToInt32() + 60)), out2 = IntPtr.Zero;
ReadProcessMemory(proc, IMAGE_NT_HEADER, imagentheaderptr, 4, out out2);
if ((WriteProcessMemory(proc, hModule, Stub, 120, out Out) == true) && (WriteProcessMemory(proc, hModule, Stub2, 0x100, out Out2) == true)) return Out+Out2;
else return 0;
}
C++ (Internal)
Code:
bool ErasePEHeader( HMODULE hModule ) // hModule = handle to DLL
{
if((DWORD)hModule == 0) return 0;
DWORD IMAGE_NT_HEADER = *(int*)((DWORD)hModule + 60);
for(int i=0; i<0x108; i++)
*(BYTE*)(IMAGE_NT_HEADER+i) = 0;
for(int i=0; i<120; i++)
*(BYTE*)((DWORD)hModule+i) = 0;
return 1;
}
Now I know there's much better ways to do this but this is the ... simplest way. It erases the IMAGE_DOS_HEADER and IMAGE_NT_HEADER with a few pointers to other structures.
Some limitations:
Code:
- GetProcAddress will not work after you do this - DLLs can still be dumped ( But terribly disorganized making it near impossible to restore fully )
