Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

win10 vs2019 x64 需要修改代码后才能使用 #2

Closed
yves-yl opened this issue Apr 9, 2019 · 2 comments
Closed

win10 vs2019 x64 需要修改代码后才能使用 #2

yves-yl opened this issue Apr 9, 2019 · 2 comments

Comments

@yves-yl
Copy link

yves-yl commented Apr 9, 2019

vs2019 下测试得到:
win10 x86运行良好.

win10 x64 无法使用 void* NtCurrentPeb().
需要将 return (void*)__readgsqword(0x30)
改成 return (void*)__readgsqword(0x60)
win10 x64 无法根据dll.def导出文件.需要加"__declspec(dllexport)"进行导出

@kiwings
Copy link

kiwings commented Apr 10, 2019

vs2019 下测试得到:
win10 x86运行良好.

win10 x64 无法使用 void* NtCurrentPeb().
需要将 return (void*)__readgsqword(0x30)
改成 return (void*)__readgsqword(0x60)
win10 x64 无法根据dll.def导出文件.需要加"__declspec(dllexport)"进行导出

感谢鸭,但是我测试发现
返回值为0x30时,win10 x64下使用x86编译的程序第一次运行会崩溃,但是之后运行均正常,但是使用x64编译的程序则在调用原始dll的导出函数时就崩溃。
修改返回值为0x60,win10 x64下使用x86编译的程序第一次运行会崩溃,但是之后运行均正常,但是使用x64编译的程序则在程序结束后崩溃。

@6769
Copy link

6769 commented Nov 8, 2019

win7 x64 x86, proved ^_^

What I do :

  • modify export function to automatically add dll export IAT
#define EXPORT __declspec(dllexport)
extern "C" {
	EXPORT
	int TestExport(int a, int b)
	{
		return a + b;
	}
}
  • replace return (void*)__readgsqword(0x30) to return (void*)__readgsqword(0x60)

anhkgg added a commit that referenced this issue Apr 4, 2020
@anhkgg anhkgg closed this as completed Apr 4, 2020
fengjixuchui added a commit to fengjixuchui/SuperDllHijack that referenced this issue Jun 5, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants