virb3 / perfectproxydll

A simple and stable proxy DLL for Windows x64

Perfect Proxy

A simple and stable proxy DLL for Windows x64.

Notes

Assembly inlining is not supported in MSVC on x64, therefore this project uses GCC through MinGW.

Compilation

• mingw-w64 7.0.0+
• CMake 3.16+

If you get an error like: undefined reference to 'orig_somefunc', you may need to prefix your assembly symbols with an underscore:

#define WRAPPER_GENFUNC(name) \
	FARPROC orig_##name; \
	__declspec(naked) void _##name() \
	{ \
-		asm("jmp *orig_"#name); \
+		asm("jmp *_orig_"#name); \
	}

Source: https://stackoverflow.com/a/36359457

References

• https://github.com/advancedmonitoring/ProxyDll
• https://silentbreaksecurity.com/adaptive-dll-hijacking/
• https://kevinalmansa.github.io/application%20security/DLL-Proxying/
• https://itm4n.github.io/dll-proxying/

perfectproxydll's Issues

relocation truncated to fit: R_X86_64_32S against `.bss'

Ref: ViRb3/jvm-dump-proxy#1

32-bit support

Any idea how to get this work under 32-bit environment ? I can compile the the project without issues, but any application I launch where this library gets initialized crashes with access violation after I confirm the message box

Originally posted by @iceman-77 in #2 (comment)