#16
|
||||
|
||||
And that's the reason why nobody want to make sources public anymore. Just because of ungratefull guys who not to be able to get enough. And because of bloodsucking vultures
__________________
Haters gonna hate
|
Sponsored Links |
#17
|
|||
|
|||
Quote:
Of course you can do all that if you have knowledge else it'd turn up to be a disaster. |
The Following User Says Thank You to ravencrow For This Useful Post: | ||
78372 (19-11-2017) |
#20
|
|||
|
|||
You are talking about creating a decoy dll, right?
__________________
NOT AVAILABLE |
#22
|
|||
|
|||
Sure? Because rz somehow loads a windows dll afaik
__________________
NOT AVAILABLE |
#23
|
|||
|
|||
When we use decoy DLL, we exploit the fact that loadlibrary first looks for the DLL in the directory where the exe is and then looks up in windows index, but in razor's case it different.
|
The Following User Says Thank You to ravencrow For This Useful Post: | ||
78372 (19-11-2017) |
#24
|
||||
|
||||
I tested this a few days ago and it works and I don't think it matters whether implicit or explicit method of linking a library was used, might be wrong but method works.
|
#25
|
|||
|
|||
Would be nice if it worked, will save the trouble of using asm to patch it, did you try it for the library which exports CreatefileW? (Or whichever one it uses)
|
#26
|
||||
|
||||
Well it worked alright and asm is not for all of us, I'm pascal based.
Code:
C:\Users\Zee\Desktop\razor>arc.exe x -w.\ -dpunpacked\ data.arc FreeArc 0.67 (March 15 2014) extracting archive: data.arc Extracting 1 file, 86,347,072 bytes. Processed 0% Overwrite unpacked\UI.sb? (Y)es / (N)o / (A)lways / (S)kip all / (U)pdate all / (Q)uit? a Extracted 1 file, 13,722,028 => 86,347,072 bytes. Ratio 15.89% Extraction time: cpu 0.30 sec/real 1.07 sec = 28%. Speed 80.35 mB/s All OK C:\Users\Zee\Desktop\razor>pause Press any key to continue . . . Code:
[External compressor:razor] header = 0 packcmd = rz a -y -d {option} $stdio$ <stdin> <stdout> unpackcmd = rz e -y $stdio$ <stdin> <stdout> |
#27
|
|||
|
|||
Quote:
![]() am i missed something ? |
#28
|
|||
|
|||
This only works when you managed to create a decoy dll for rz, else not.
__________________
NOT AVAILABLE |
#29
|
|||
|
|||
ok ,thanks ,but how can i create/use one ?
im totally noob for this. :/ |
![]() |
Thread Tools | Search this Thread |
Display Modes | |
|
|