Skip to content

Instantly share code, notes, and snippets.

@adeii
Last active January 5, 2024 18:51
Show Gist options
  • Save adeii/e7e528964381bd59eeb7137b10239e1c to your computer and use it in GitHub Desktop.
Save adeii/e7e528964381bd59eeb7137b10239e1c to your computer and use it in GitHub Desktop.
Chrome 117.0.5938.89 x64 for Win 7
swap in import/export chrome 117.0.5938.89 64bit
chrome.exe
==========
120-Security Directory RVA / Size --> 00000000
---
40c10: 15 B3 D8 24 00 85 C0 74 14 FF CF 48 8B 0E 48 85 --> 15 B3 D8 24 00 90 90 90 90 90 90 90 90 90 90 90 (chrome .63)
40c20: C9 75 72 B3 01 85 FF 0F 85 2A 01 00 00 89 D8 48 --> 90 90 90 B3 01 90 90 90 90 90 90 90 90 89 D8 48 (chrome .63)
206240: 48 89 F9 E8 98 E7 00 00 84 DB 75 14 FF 15 CE 7D --> 48 89 F9 E8 98 E7 00 00 84 DB EB 14 FF 15 CE 7D (chrome .63)
273b10: b.c.r.y.p.t.p.r -> x.c.r.y.p.t.p.r (hidden) 63 00 72 00 79 00 70 00 74 00 70
28d1b0: userenv -> userenx (hidden)
kernel32 -> kernel64
chrome_proxy.exe
=======================
*
chrome_elf.dll
==============
120-Security Directory RVA / Size --> 00000000
11b5a0: b.c.r.y.p.t.p.r.i.m.i.t -> x.c.r.y.p.t.p.r.i.m.i.t (hidden)
128520: b.c.r.y.p.t.p.r.i -> x.c.r.y.p.t.p.r.i (hidden) [62 00 63 00 72 00 79 00 70 00 74 00 70 00 72]
12c240: kernel32 -> kernel64
chrome.dll
=================
clear digital sign:
120-Security Directory RVA / Size --> 00000000
1767C0:
C1 30 C1 0F 84 0E 01 00 00 4C 8B BC 24 C0 00 00 --> C1 30 C1 90 90 90 90 90 90 4C 8B BC 24 C0 00 00 (chrome .63)
100B900:
00 00 4C 89 F1 BA 01 00 00 00 41 B8 0F 00 00 10 --> 00 00 4C 89 F1 BA 01 00 00 00 41 B8 0F 00 00 00 (chrome .63)
1547090:
00 48 85 C0 0F 84 C9 00 00 00 83 78 38 01 0F 85 --> 00 48 85 C0 E9 CA 00 00 00 90 83 78 38 01 0F 85
b.c.r.y.p.t.p -> x.c.r.y.p.t.p (hidden) [62 00 63 00 72 00 79 00 70 00 74 00 70 00]
c063120: C3 41 1B 9A BB D3 6A 46 87 FC FE 67 55 6A 3B 65 --> 5A EE 59 B8 38 D8 5B 4B A2 E8 1A DC 7D 93 DB 48
b.c.r.y.p.t.p -> x.c.r.y.p.t.p (hidden) [62 00 63 00 72 00 79 00 70 00 74 00 70 00]
user32 -> user64 (hidden)
mfplat -> xfplat (hidden)
netapi32 -> netapi64 (hidden)
kernel32 -> kernel64
userenv -> userenx
winhttp -> winxttp
chrome_wer.exe
==============
*
chrome_paw_launcher.exe
==============
*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment