DLL Universal Patcher is a flexible and convenient code patcher that doesn’t touch the files on disk.
It can be used for replacing any tasks that you’d otherwise achieve with on-disk patching, such as fixing old software on modern machines, or fixing bugs in others’ software.
In addition, due to more control over when the patching happens, it is possible to patch packed executables.
version.dll
dll-proxy-generator.exe --import-dll "dll_universal_patcher.dll" --import "dummy" "C:\Windows\System32\version.dll"
to generate a suitable proxy dllpatches.json
(more on this later)dll_universal_patcher.dll
, and patches.json
in target directory to perform dll hijackingversion.dll
dll-proxy-generator.exe --import-dll "dll_universal_patcher.dll" --import "dummy" "C:\Windows\System32\version.dll"
to generate a suitable proxy dllpatches.json
(more on this later)RCDATA
resource with ID 1
and neutral language to dll_universal_patcher.dll
dll_universal_patcher.dll
in target directory to perform dll hijacking[
{
"modules": [ "winver.exe", "{exe}" ],
"pattern": "01 02 03 04 05 ? 06 ?? 07",
"replacement": "90 90 90 90 C3",
"min_matches": 1,
"max_matches": 3,
"on_initialize": false,
"on_process_initialized": true,
"on_before_dllmain": false,
"is_code": true,
"allowed_to_fail": false,
"multishot": false
}
]
For more info on the options, check out the schema
Cybersecurity tools play a critical role in safeguarding digital assets, systems, and networks from malicious…
MODeflattener is a specialized tool designed to reverse OLLVM's control flow flattening obfuscation through static…
"My Awesome List" is a curated collection of tools, libraries, and resources spanning various domains…
CVE-2018-17463, a type confusion vulnerability in Chrome’s V8 JavaScript engine, allowed attackers to execute arbitrary…
The blog post "Chrome Browser Exploitation, Part 1: Introduction to V8 and JavaScript Internals" provides…
The exploitation of CVE-2018-17463, a type confusion vulnerability in Chrome’s V8 JavaScript engine, relies on…