mercredi 6 juillet 2016

Loading custom DLLs instead of original DLLs

-- LET ME CLARIFY --

The question below is for educational purposes only and the discussed featured are not meant to alter registered DLLs or develop a malware but for learning and experiencing.

That said, Recently I've been exploring few methods to load my own custom DLLs instead of an application's original DLLs. One of the methods that came up was the <exe>.local method.

After experiencing with this method a little bit and after I removed the KnownDlls entry from the registry I managed to replace some system DLLs with my patched DLLs successfully.

However, there are still some DLLs that insist loading from the system32 directory, although they are present in the local folder. These are the DLLs:

enter image description here

However, the DLLs are IN the local folder:

enter image description here

I searched google a lot but I still couldn't find any method that resolves the problem.

Any help will be very appreciated.

Aucun commentaire:

Enregistrer un commentaire