SH5 DLL Injection

TheDarkWraith · 02-28-11, 10:32 AM

The 32bit version of SH5 injector has a flaw in it. For those who have downloaded it please do not use! The problem with it is the incorrect RVA is given for the LoadLibrary and FreeLibrary functions in kernel32.dll.

Normally one calls the Win32 API function GetProcAddress to get the address of the function they want to call in a dll. I had problems getting that working correctly with 64bit OS so I found another way to do it. Since I know the base address of kernel32.dll I just add an offset to that base to get to the function(s) I want (I know this offset from using dumpbin on kernel32.dll). Now here's the problem: Win7 64bit uses WoW (Windows 32 on Windows 64) to enable 32bit apps to run in the 64bit environment. When in WoW mode, kernel32.dll is different from the 32bit version of kernel32.dll (there are two versions of it on 64bit). This means the offsets are also different for the functions I need

I'll be revising the 32bit version with the correct offsets here soon.

EDIT:

problem has been corrected. Now if someone can verify that the 32bit version works I would greatly appreciate it

I know the 64bit version works correctly as I run a 64bit OS.

02-28-11, 10:32 AM	#18
TheDarkWraith Black Magic Join Date: Jun 2007 Posts: 11,962 Downloads: 147 Uploads: 5	The 32bit version of SH5 injector has a flaw in it. For those who have downloaded it please do not use! The problem with it is the incorrect RVA is given for the LoadLibrary and FreeLibrary functions in kernel32.dll. Normally one calls the Win32 API function GetProcAddress to get the address of the function they want to call in a dll. I had problems getting that working correctly with 64bit OS so I found another way to do it. Since I know the base address of kernel32.dll I just add an offset to that base to get to the function(s) I want (I know this offset from using dumpbin on kernel32.dll). Now here's the problem: Win7 64bit uses WoW (Windows 32 on Windows 64) to enable 32bit apps to run in the 64bit environment. When in WoW mode, kernel32.dll is different from the 32bit version of kernel32.dll (there are two versions of it on 64bit). This means the offsets are also different for the functions I need I'll be revising the 32bit version with the correct offsets here soon. EDIT: problem has been corrected. Now if someone can verify that the 32bit version works I would greatly appreciate it I know the 64bit version works correctly as I run a 64bit OS. Last edited by TheDarkWraith; 02-28-11 at 10:45 AM.