ForumFree

Manual DLL Mapper - Full SEH support, I spent many a night with Windbg reversing the Windows Kernel and NTDLL.dll to study the loader's techniques, and came up with a fully functional manual mapper for you to use :)

« Older   Newer »
  Share  
pirateloader
icon5  view post Posted on 17/5/2013, 18:59




Hi!

I have chosen to post this message here for i think that the people on this forum may be interested in what i have to offer.
The concept of the MemoryModule and any other kind of manual mappers is well known accross the internet, but is still underdevelopped.

For example, I have not come across any mapper that supports exception handling on Windows Vista and higher platforms, which is a very
important feature for most, if not all of my projects.

I took it upon myself to create such a manual Dll loader, and now that it is ready I offer it to you.
I called the project PirateLoader. It fully supports SafeSEH and works on all Windows platforms (XP, Server 2003, Vista, 7, 8), with full x64 support.

Loading Dlls manually with full SEH support is a great power in the hands of any experienced malware, cheat or anti-cheat-engine developer.

The last thing that we need is for a stupid access violation to reveal our code to any researcher or anti virus program...
This is why SafeSEH support is so important. Using the PirateLoader, you may safely load any DLL extensions or plugins for your software
from a memory buffer, without fear of crashing the host process.
Your exnension DLLs may now be stored in a memory storage, SQLite db or whatever other type of storage that you use in your software,
and do not have to ever exist on disk as real files for anyone to discover (and possibly scan).

If you are interested in more information on the PirateLoader, you may visit the PirateLoader website:

www pirateloader com

Otherwise, if a full version of my PirateLoader is too much for you, or else SEH is not something that
you need in your code, I do recommend to use existing open-source manual mappers that exist online.
For example, the MemoryModule, used in Py2Exe:

www github com /fancycode/MemoryModule
 
Top
0 replies since 17/5/2013, 18:59   111 views
  Share