Skip to content

Instantly share code, notes, and snippets.

@ustayready
Forked from jthuraisamy/dll-proxying.py
Created August 18, 2021 17:52
Show Gist options
  • Save ustayready/9d40503ebcb64cddd29d575113dc52e2 to your computer and use it in GitHub Desktop.
Save ustayready/9d40503ebcb64cddd29d575113dc52e2 to your computer and use it in GitHub Desktop.
import os.path
import pefile
print('#pragma once')
target_dll = r'target.dll'
pe = pefile.PE(target_dll)
for export in pe.DIRECTORY_ENTRY_EXPORT.symbols:
if export.name:
name = export.name.decode()
ordinal = export.ordinal
basename = os.path.splitext(os.path.basename(target_dll))[0].replace('.', '_')
print(f'#pragma comment(linker, "/export:{name}={basename}0.{name},@{ordinal}")')
print('''
VOID StartRoutine() {
}
BOOL APIENTRY DllMain(HMODULE hModule, DWORD fdwReason, LPVOID lpReserved)
{
switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
if (!::OpenMutexA(SYNCHRONIZE, TRUE, ".text$mm"))
{
::CreateMutexA(NULL, TRUE, ".text$mm");
::CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)StartRoutine, nullptr, 0, nullptr);
}
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
''')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment