New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Environment] Document DLL Hijacking Approach #45

Open

Sewer56 opened this issue Aug 19, 2024 · 0 comments

Member

Sewer56 commented Aug 19, 2024 •

edited

Loading

Preferred Approach:

Patch RVA of Exports to New (Original) DLL (if loading new (original) DLL in range is possible)
Use https://github.com/Sewer56/min-pe-parser to get address of RVA.

Fallback Approach if Loading new in Range is Not Possible:

Reloaded-Project/Reloaded-II#308 (comment)

See 'Resolution' section.
In this case we'd alloc in range, and point the RVA at that location.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment