From 114862fec45e5632cd6a2e715ec99111e171dd3c Mon Sep 17 00:00:00 2001 From: nastys <@> Date: Wed, 31 Jul 2019 00:01:28 +0200 Subject: [PATCH] Add RTFM --- dnsapi.dll | Bin 36864 -> 37376 bytes source-code/source/fakedll/dllmain.cpp | 1 + 2 files changed, 1 insertion(+) diff --git a/dnsapi.dll b/dnsapi.dll index fa691fbb65863692681d4e79fc707bd4fa015a7c..3c680c145cbe0d377040791591664794436eccf9 100644 GIT binary patch delta 8479 zcmeHLdsvj^wtv451_$IaAVWZa1CD?;^;AX`CY8 zF6i#!ahF>=R_0U(&Gwm&6u6_Z+lgI0g*$7HVMgsPWbMB5Ti<-+A=uE^(K1wJDlu<%DUg<`wO{gLKVK|DO$eP+~pK|EOLo)8=( ziitDb=FuBQi_d1dpN+Xm6z5Liv2izv-G%O*arptFb|!x*;f(M(Z%uqG{$FP>wx-0< zocPvYWW+OGtFt0Pa?ZcOyD5=pB^8OaGx(OI7*U_-b|h5`;*v@Hqp=N<0h1Vuc=4>{ ztjLsd`n(CLyx6c-JRHT38@A~VPlHFt8b>{>XrkVoOybAWjCRSf)EFx{Y(~QZ zsr_=6u0Hd64$x&iVmz;~WR`kjsO^TPC-%8GR&0Quer{w%e*8en8=Qlk}GN za3*6V&Jv@+l5-ArP|5la6pL_a_c>dER)7lqriOP#&m zcTyP3@kov!$uU<8($O@gQ%469Da=x1wdAy6V%xj3mYIzlIi8`2=fXbUhBe%Mg*uF3wt7DwmgR^Ao*s*?wtjBK-y`f6kJMwgoQDCEdMvRr zKFr}M+ST6ONof3xS8_>#k^_d0iu00dzQQ%k!+Mc!rPArs;a?h3?cB-aDR4nk+ItdD|vx5t)Xb~P-OT>F#?SzkYs z*G@1l`juAKRgX2n4r!A0KR~9<(sY_aTV0y%bI1U#AjCw8o|KguoKGEi zUDkKP*`Or367Orl7T;^5WAXZFofgZr>_fg{(v*xBr;{l*{8wO<{U_^BQgfGnTp>2& zIa&XE#T%yda6UgXX?bk&O{k^?uwY;7mux2EiXm^jJ7@AGL2N4GNf{ZFTQ)*HQ@;gZ zGe$&;5s_uOH4&RNM@@`jhhaL_U|(lR?HbEQ-kMP^uA9bR&6r~};(F@yHrz-~=i^$b z=rX>#byY~G z=|GjZiVG!Y*b(Sty#Xb*;el+PI5l4U$5cLJs#$k3hq`ew78e?#?V82!nOY(?=J4}V zYlP7}CA&vH+JocF}9vv^T%tadxrOxE{g zx|io#1aWVs`$%4&ka&6u0?^rV)Ef;}=bLnIeKA_`BIoh@rq_v!U*{L6CyP~6_^AA} z(7RWm|8(u;?OMeP^3%nYt9Wz%UxRn7RC<5YN?tYNKJk+kd|*ap^4%+-#7#F3vwRnL z?<|ZO1Kvb>r~Z}|ysDtKWQ-!+f!oZH7eTxuOh?e(z0kbe+}OATciT!6|GjDBF&5% zWyQsI?j?cYjxRa8SMy^z-z?1#&y@40q=c#?*fY&rNEy8uiUFS>E0%tqL6yI+GcGlceyn`< z^cN&*d}p29>(Cqn@4b9gmhb7`TVl*_pH&5gxV^;7evxJG?ON1+iK2b{bcrWf*JQ?` z+CD1Bb7=@&a}~?&!@?~V?9w(0j_C`*U7bbKJQ$5NisNo;vtHw?v*FS6TFyJA&Np#W z#PZ1%}?mRP>IV$=8!^e~}o`ByNqzFHA`PX`Awk1~&v zJpQttizT_xrlG~;Ekbq3g*thRq!V&&a?gS-*Y^zr8wNaBy9XKKKOPL@v!EF+8It zChUP2>Ze%?&8;!KrY2sP0;>dZt*^T2zpE`uwfMH4N7h7V4+l`c&-!+2Umuzuqsey& zQu`~~O9QCwqi2?u9+C#sI`!OLGgk=US8K+`uE*6&T{C!BDu(U1YN<;Jd}?h{`1dC4 zF`ABZJ(|x=d|7R!c*w+`t}W2d!a|tadxa8*CL8SFs1m1U0{^8pBlap5!W?n>v*>Lt zJ(^(EL60VY7uV%vyjz4V+NqQ-OP75B)79HL}5qNxfq^ZQW z`FK}_!6y$y@QnHy_V;H~gQZ4E`tdyW)t^YjXC5R}{tT{*cCFF-1u`la5$)5@((F&IBAXF2p13EO8qaD23`R-L07;9>6gT0p zj$f%C7q`S$U4O0GS9^wPW4LL4uy}hEFQ1=cFG82(@sUaypp;=s8KIODl=7o+vau-q z^bz`P3cp<`_bBD9N;yd>rzmBnQchLM9Hq=t$_V(xPIq6PuMxEEVHDuiF!xUlZwkp@ z;q^xM`ZA=_OW?gvd`?f@u=h#t)PGWp?3&8M7eyp+Xy~Jhn0RHrFbAXI+g)?lNrCGE zEcTZBeO7m?*s0=i6}wb?Q^k)}{8mNneqZ}o6*E*UR42{zdIr zzlvX|=x_1F13oTQ4P2|r1u8C8(WYXSim8N%&vdHdUcZ6r$RFUg2YpxWc1 zRGm4airFd_swk;=w`$)Br1-2%RlKL-NfrG8qEz`m)eidg-(4r?``f8F*)OXNeo$xj z3l;l0!##knS5=%=@ra6QJ63R=+_H?d38)<4rmc}$ux6*yEaaz!d?mhl6zT7qpIbT&#kQ5D%BfQ@3{QqJ%3U>W>tBnCT z$4tkku0Gq~|BFe4rXI8lGrwy+7<~RZJgitWs2_Fx*VW+?VEMSgFQe}AwK{j%n%M!m z_^{xdeOvchyY8%dVcqZI@8O;6TBdpG7|XD&ZnYUVZbDmjeidT|pkHUq%3?#%9m3dr zx>nY)+CBT`Uj<7Gl6pp~@9(SgPR8g>xnmZ@P=%lT8z&$YTdQ-lKYC%{+c{wxV7O^7`p)4ptMK7peLP1QSwtQW9>AcSPZCE9Z;Lv;eF}=I)OBxCsg@_ zif4c{pk9*c=OVt{K>BJ5e3NkrNNwY0`koOBfh2zkq{+%IWSPo;pgZw1pA>%slGC4n zLBP>C=p>6pz5uC3{GKgIv~o{vNtr!!CHBv4zM27agT8+=`!MoGExWNklHHK2W25(v z8ql-^Hj#ZV?CIM*hlgyPRykC{SfPcn(7iOl*uU?Ax`XkD0bcy|I`-Rogd1TWH#Ugr zgfT352=1E#v(T%1x5ktmn#b4`&<4dNM$wH|k1Z1JqS$Ziu%07q;|xJ867E8Vv;#q& zKCZn^QTp7eFb7QBo(C>6C5c7Nj4p;?a zdsQbRW#2?avfzPH9$E()*|zw&rb;Xqs84NjP3FnAF?qC|l}L-VY%zjV;yj05j6|>~ zX2My15EP9wn~b>EWWLTeHpYyWw3z}L@RJG@w3?7VX3Mry6()uCE?{i>LdKF%Mc+a2 zPmYiyLjqYyZV(H}4r=kYc?b31fb!HfV;AASd5~WYjt^q-IJ5CvV+NvI#x(i6u>v-w zi*YDc<0)ObnAdLKAJWw5i#z1xSGLD!wEJ*x@!%b4f{nkjV+=3Z5j}gdYT`5WmHuX} zu)qEbfT9z6#n-<3lVkYt9nr#h_`5MK9~Ujn2==x@Ub2HOoqxY$T;d#Xb)eOtTR=|G zLC|5)(>(7MZl~+m|NWWXF)c`<_xUx9g&@%ywjf!I&}BfUgRV(^@sV{IbceR$0v}=5 z3EeRKrH`-+e1NgFuwxxcjGL9R8%h%#4)~Oct^sco0}O{p=ypJt51n>|!%pZV=$b~@ zbwPIs{@O<9`uTIMWB>WM{paKM|MPL1s%-85^Kt9ma{GQQevIkd0lWSp+8@RzXvw&5gi@T72fd68` zvDt$3 z5IiB}$fe*%=1R)1d8Ozy^n`__b{Ie?gis7R1O8g31Wy@sHuB^}@Ps9xKnHAq{`^V! z4#)sK;k%$*@Pr?NO27{QzXj1CnH8f45pS@A@h4Hj1E3}}AUqCg1wS$;Qm(8)@;d}Q z;R4VZ@Yj+ccuJ1h)d&EdFdr0%ly@!Nfu}TBSc_j|lOYgO46=f60`3GgfyYlBR$qt5 z0C>VXK-6o(E)dpF!EaRkcfj;|pAF$Gl{W#`syyNERKBeq>puXY69EWy^L>p8jVe#L z5k$dSfIqAJFTe*HphH{2E|Ah8;02Yx2uwoGCcS}jH;4vc0(K}o)}NRoNYKaO=qPX! z60aBhWZ-fn-~=aT1NbP&3jPrAJrFr1d~yjk8uUkjaZ52<;Eljd%g{OSHsA>m*`Ei7 zB102TnYz)g3iu((UIfupcLDoBZD>q5tn#7D8Qar@Lje5~!0Hv4ISK&04@4vD1il9% zKZH8GT!<&6cPs^_C(;EF+1oFIDO!cm!x6pd{~h!^_yOQwK}W&Uj}-cWV!)ZE2Q$5l uh$p0{PzM4K(vybtgm|_nJmDTt3H)>bgV*>1;~db(LjqoMhwu9~;J*Ozv{o7b delta 8250 zcmeHLeOQ#$w%_jy0|SZ-$RHrXfP>%{A_E92I3S}hFdzcr7byyU<=3dAVqc)BIgS{% z`!FlBn?1+d?U*)wsA18;1U*z{R+e3*vhJvybEv#Z=Tz_ct#{t>qW6#c=l$or&$IS# zt+m%)Ywxu`XBrNQ4F|*{IwAhno96qN`t`7QLqBmqIIDzWibvTzo2Lr%0?zGXtQVRN z{)|wcku?LX4n&5&pgy00vFhZtwF~SE7%NOdg$*4aniNaRC0p)hSALTB7T1@00 zh@mc7^cDP%S1@)he+m!u{YKm~j{n8?uy`h)Kd+f6x+b|UX|4$3`D|B<|8hY*TkIMh z5H56UypATx0?9sp+@n`SpMYD`^81WxL}+q^yjmUqs3c6e21|xG&WW7VUMo6p~c|b z*Y*6WF;|?F;7UyRP!MfH`K@8)!eCyQSTW#qJoT`+ntJ!`5dLbSvEJ(ZdWPiemKwWl zl2ens0tTj2lEcz_T)@PcT6=s% zv|HXNv*hNtTaFc5lI`u5mO6VfJ8fxYQoF^Cc7z==KJ@T-2xND440WZq9*W#!q>-9t z9Fd$I?mfxG&kvE_O}YJonK~hjykc!acATH)9y62d{7BY6JORmdVtT%S=&nSge5a+y zVmbpe#h?lXlJgDY4yDC&#s%Se(*tS-CbZ%2+mDIFL zsgU)?i9CLUarQ?O$+`lo0~1{>>rX?r5_^I=XKm70^2q?LAj!Tr}ky&!sjrr~QMk`vtX*Sf( zi?aSRt{s_Z8ciXbAIkdfEQ)-0tcJ<|JJxfP`NEOo#aUT=|Hv5e*m(Z#$iZUcC4OmS z%CIl7%_QfaW&KjbxFJbRL*}o+wCu1Olb}AK(_-33U*cm&jZWUKn0_qlPl8canylZV zbV2_!x@0;d>z9*ADP5bzca54K@#7N6%F-;AocfVCS|ltA_jQ-g=xc(QV&;EMP99}m z1@#1dF2HUK4iSSx3U!NvS8M8W8T&c79_d)@s4}KVjT-$bE{!P?v&Qi!$4oZf%wVk3 zT{)PX&cHq_Zg$7{GuDhq%T_8b?_bG(9WzQat>hz8rVgL0*q@9-SI@&*=f3}fEH^7$ zt4K~t1qvHx=KE4Ag|GRKDOF;9I-fSSNK8%V&y9`9l1z-zOqCqc*$btnpx)cq9r~Tn zVy#Oj=w!`r%9|)TgEl}X>wB=xvHF&o_+Q3Gi65r&fYe;w7MvfQ?yC_v0T8VshtEmP z7n9TYfz;{3CH_-tq2T7(rX+FW0=~pl9MFPO3+v^0IzMT8K+H<#S!ox<_r~(z^a!m5 zb0+JbPH~M%w+P~_6xW7~PGQJS?5j>}QOQwZG+3P<(P{TXKgG+(8GL?bxj3SezmXXy z#wPPGG86k()}sH;pCo5`MJ*4^N)l6Rd0N)D0aI#}-jA!{vEv^T4=?0L#+SrZE`)O1 z8T(XZxeUBJ8>7a6b4c&hPhH4kCzR!Xw}7OFjHQwz{R;7ppe};OQ?qjC=gylqw@ucM z8%cS{Me|OaXXTZ-mANyqWA`G7$l37Ot~V!a5yU5l^Q`QVV%<#F;_Nko@ZbDm&Tmn- zhoO<@!x@-_nOHf7GI1qANz22E@E!#7>*C-FzCJI}b=^Ev5Z^QM;JjLKS($5nUacVf z%)gqvNpzI*#o5DMkL1r)G!}=rse~_@GPZu$H1gR>XI@j#>^KshRSv+5(ze$1dMI}( z%I$ZQ_Ik|J(@-iqYM#h_lKn5o%O3t%GaeUw;1R%(V>@RRjNhw$}Nmy6LQ{M)G)#j`QIMM@K+ zi}_E|gwQXnIM~j-BOs;0`E5Hi?N&aiAWPh3?${l_J}d zQ(JGCXnp=j0UJAHY($L(2Iy=FfJ8!wGXbYHaaR6)!LZQxUyo_@DBCrWh5XB+ zxU>_>{tkKx;C?Ak>FjX#H~*03t*v$gB5d*0FQ@v4QQxjPRlt+2=6>PO{gI~EFYeZHIhD$DK%>Cn55qA|h0fdAFH zc#K}JLVm2i25+5!-Cy8U!ftdVe`Z>A z^xJw0e5J|n>$L)qAQI5xwK4tI*i9oj|~bBgJ;~pW?4TWj2BJM6lV|O-%Jk+I6_BJlV-&r z{`>UspxQyy(OfMw1%r58S(NY_@0uPhW_qeq{-;{+seTdF`qW+@>UW!GwRU!*^(IQb zLy#KZ*Iw&FZKs4u)6S%IjM};3ys>PG@Et!}78_BNOg*p~4eo`CVdEw(^{AT*fzRczqBiBDb+a$aiQ&us8hkotj^GXL)kOSxiK3@QLrj z*4f%MUz$A*+BKi@&soba)3ra<)oi zi7)l=O~nR}d_>28ugI!@c@j0KGD_0zb68iqNyKiyuMNv#6MmRrwdSEEWix0Q}3$vCD80 zc7*VEXAF%T>8Uo}srJ_MCu3+h*YCqsdK|p_;P*&}Gw5Z~JN1Vr<8~d!FV7B+u7QR=I*5r^@`W7qhi@+U zwAVN6@fbX%;vp4VRP0dkvWnd*ijRBRMW~phVvdSsDpsp#Q*n!mdp%gsUR4z>Dh597 zah$4Rp^EcVtW$B9iicEeQPDsz1AKlecB}e}Dtc-etL4PiGqzn}ylTdV-6Qu`Ww+YF zTPk{6yzzvG%TNO@ROLbySE#sEMYD<-gow`!s$##_Ky~B|u=7a|*PvpVir#wml!uE} zF-^rh6|E}HQt>IZ{UIR5XLD4=RTclFqBlUiD*vE%(5v^o$4*jZor)9hsrOUc-|}XZ zvmC|OMOATD#kW-S1}eNqK2XIP=myg9Ef5C{*RDiZ3*ISo?!RM{RHe_L-i>SMJPhAl7nLdnlqptf-ovUzZj*qVC zbjQBw$M##^djIC}u8;?^`QGKWjGi*alI@G??8cR=(3Y_pbOqqm8BpXw&bU7L8p>~RFtOLuue-tGz^4N4VsW!_fMh zj2*$4lRY(QRMWu!ebvVywuP{HkTC$G{|gM$Jn<+lRQ2bKlg1#ysRBQ`S1nyR4Liz~lcHCFPFRv-8j}%$I^S-6j;ib^V_4i}_ z?V(It8^V0kbnKjovEM;SSQK&O4|R9zkj*|ekue(9UpU4zT|PFkng)veAzWOIFRMvA z$+Q*kvL0kHB%QH3_zY2;qT-H{|8Z?>Jq<1bgDb;GXmCf=&bO$8=>XE;E~s*sirqjO zTrZHmu~_=l{!MiYY{pM@xMY#|4N2__fIh$-svI>zsW-8OVDPYFM?DHQ2*35o@o=CY za6-06PQ{j|0F^oXfpsx7ll#`i=PbvldmixA=xSk(@4w6nu#mx8Hn<{$4MKMNJ?`J7 zvH4b$eFyC6doz#!eO*S0A)m1oplIyhIEM9n0dy(=6M*M_g^t}_kFC+iJ~Gyi>4bqS zpa<@&eN)h@N9^H+=cX_ggQwL)ic5^*6mDjF2;5;#@2bO`_K_nEek=s;0(-PweyzSX zTCVn}$OehA&p}@+?yxPqG7nilsJ@|)vByA02lXGdcge_ot^Zv*!B1p6rUT2_i5P}@OERUduj$RQdw0K3YQK+i&>y&YHL$4b&7#(i|p9c_lDGZs-gwiTgljxnT(a7ioUbp zKkFlh1p2bTG(Q%Y>Syz|5oaM7Xp!1x8u&SVIRPRTJ1pfy&r9- zL(nTtckPJ_=g-xJ35*}D8yqR&oTUV4Rq7=>=rZ~Dbwh`ggR23p2R#aU7W4|}bDM zbc2?HzjNV(r`N#u8Q22g39pXB8A3L|D%`Lw;H!c4psQPPnE*eT1baMoyMTFSyfPle z^S>0#LJ%3*fTlb=(qLo;zCIbj!M6ej=VMdj-s*d6(rw!|g|Si46P^WG!4uMTxB`6N zYmu(fMG|9AKu@?r!qfH$gcT6hf;z$9xfH?EWw{F1;7#y^c2F3un7&sdU6~@?SkM#t zfbzi;27)TU>wxhf8e|GEPvuMN!FcaW!ZRQn8W4UB+5x`r^+(s@=3;ajdcsFRo#5}> zci`zBT!pJOye%TSB+0Ck(0d*n|N~RK66r1VsLAz*dFF{1fvz?&}sfx(J+$JGK{m74R|K zwWFNK3h+Zv75H;N-#MNDgr9*{Kz|WfFc;YZUjf`-h0cLL2pR!plD2(r1BGiZ_h_6p}zoZs7B@}0PsB!jjRLci-!sMAvCKzAw5|s zFujIC7JBUK!@#TtwZIWQ;r|9Y1zuOfSSaWic=~-pzfBC=p|ABkf{3Tb5WRX1AQ&ON jW=Kzn7mC6Yz748?pH^VjB2QrE`FNnuJFWq{fAaY!+D#VW diff --git a/source-code/source/fakedll/dllmain.cpp b/source-code/source/fakedll/dllmain.cpp index febfc22..8f714f5 100644 --- a/source-code/source/fakedll/dllmain.cpp +++ b/source-code/source/fakedll/dllmain.cpp @@ -232,6 +232,7 @@ void LoadEverything() LoadOriginalLibrary(); //LoadPlugins(); + InjectCode((void*)0x00000001409FF58E, { 0x52, 0x54, 0x46, 0x4D }); InjectCode((void*)0x00000001409FF730, { 0x53, 0x65, 0x65, 0x20, 0x52, 0x45, 0x41, 0x44, 0x4D, 0x45, 0x2E, 0x74, 0x78, 0x74, 0x2E, 0x00, 0x00 }); }