Accept Bytes instead of Dll path about minerootkit HOT 5 CLOSED

you will have to manually map it, cause all the code are doing is it calls LoadLibraryA in the specified process with the dll path and then creates a thread in the specified process and it's start address are LoadLibraryA in order for the program to load it, you will have to emulate what LoadLibraryA do but you will just specify your dll bytes, and you will need to fix imports, do reallocation, call DllMain, etc... and it's hard to do that on a managed language.

from minerootkit.

sadly no, there's no winapi which loads dll based on it's bytes, if i had a free time i may implement manual mapping in the rootkit.

from minerootkit.

i see.. is there no other way around without using LoadLibraryA? (just so it can accept bytes without too many modifications)

from minerootkit.

i tried to find sources of loading dll as bytes , i came to this. that could work?

from minerootkit.

test it.

from minerootkit.