search

TheWover / donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
BSD 3-Clause "New" or "Revised" License
3.53k stars 628 forks source link

Refactor LoadLibraryA and GetProcAddress #100

Closed S4ntiagoP closed 1 year ago

S4ntiagoP commented 2 years ago

Hey there!

I changed how the addres of DLLs and functions are found.

DLLs

Instead of just using LoadLibrary to load and get the address of all DLLs that are needed, now xGetLibAddress is used, which first searches among all already loaded DLLs, trying to find the requested DLL and only if it is not found, it loads it,

Functions

The API GetProcAddress is no longer used, now we find the address of all APIs manually (using xGetProcAddress) to avoid API hooks.

Note: This PR is built on top of this one: https://github.com/TheWover/donut/pull/98

Cheers!