الفريق العربي للهندسة العكسية

Dears Mounir, Kaman99 & DarkDeath
Your Notes and the video clip are much appreciated

Problem Solved! Please check the new version below and let me know

Dears all
Enjoy RozDll v1.1 with some Code improvement
https://www.mediafire.com/file/htvcnsvii...l.rar/file

Instructions (RozDll v1.1)
Browse your EXE then choose where you need to save your Proxy Dll (normally in the same EXE folder)
Write 'Patched Data'. Always select RVA for protected files. Select 'Prot' if EXE is Protected/Packed & UPX if you like to compress the Proxy Dll
Click on the 'Dll Options' Blue circular button
Click on the 'ANZ' or Analyze button. This will run your EXE in the Memory to search for all Dll's that can be Proxied (Dynamic Load)
Select the Proxy Dll from the ComboBox above, be WISE to select 'famous Proxy Dll's such as: (Version.dll, Winmm.dll, Msimg32.dll, Uxtheme.dll, Wtsapi32.dll, Shfolder.dll, D3d9.dll)
Select the Code Injection Method you like to follow (try all)
Select/Unselect your Magic Functions (Biginer: Try the 3 methods, or Advanced: As follows)
Advanced users, use Xdbg64, to choose a 'Proxy Nominated Dll' (see Instruction no.2 above), set BreakPoints on it's numbered/ordinal functions, then check which function will BreackPoint/Hit the 'Patched Code' first (Magic Function)
Patch Code will be written into the Magic Function, so select this Function in RozDll, and check if the EXE requires more functions to be selected (EXE will generate a Message Box with required/missing Function Name). Select all EXE-Requested functions in RozDll. This way is the most accurate one
Please use it Wisely and just at your home. Developer efforts deserve to be respected!

ROZBUD® 2023

 

:Important Notes about Analyzing Process (ANZ)
A- Analyzing EXE will EXECLUDE all the Dll's in its folder. Means, once RozDll generate a Dll, you need to delete it manually 'IF' you need to Analyze the EXE again, otherwise it will be excluded in the Dll's ComboBox
B- Once you Load your Saved Data, only the Dll you worked on before will appear. To get more Dll’s, Repeat the Analyze Process again (also consider above note)

V1.2 is on the way

RozDll v1.2

What's New
O1 Now you can fully Save all your work (SAV), and Restore it again (LOD)
O2 UI and Code Enhancement

Provision
O1 Create a Tiny Proxy Dll's for your Personal Needs
O2 Generated Dll will have the Injection Code which will modify your Executable behavior

Main Features
O1 Fast, Portable & Small Size
O2 Created on Windows 10 LTSC & Visual Studio 2022 (should works on Windows 10 & Windows 11
O3 Uses Dynamic Loading of Executable Libraries, which means it will provide you with exact Dll's your Executable uses after it becomes in the Memory

Instructions
O01- Browse your target Executable (EXE)
O02- Choose where to save the Proxy Dll (normally within EXE folder)
O03- Write the Patched Data (Byte, Word, DWord). Always select RVA for protected files
O04- Select 'Prot' if EXE is Protected/Packed and UPX if you like to compress requested Proxy Dll
O05- If you Load (LOD) an already saved project/date, then RozDll will restore all previous saved options & settings
O06- Click on the 'Dll Options' circular button. This will take you to the Dll Option Panel
O07- To start a new Analysis session, click Analyze button (ANZ). This will run your EXE in the Memory to search for all Dll's that can be Proxied (Dynamic Load)
O08- Select the Proxy Dll and be WISE to select 'famous Proxy Dll's such as: (Version.dll, Winmm.dll, Msimg32.dll, Uxtheme.dll, Wtsapi32.dll, Shfolder.dll, D3d9.dll)
O09- Select the Code Injection Method you like to follow (try all)
O10- Select/Unselect your Magic Functions (SEL), Beginner: Try the 3 methods, or Advanced: As follows
O11- Advanced users, use Xdbg64, to choose the 'Proxy Dll' from 'Symbols' tab, set Breakpoints on its ‘Numbered/Ordinal Functions’, then check which function will 'Hit Patched Code first’ (Magic Function)
O12- Select the Magic Function in RozDll, run your EXE and check if it requires more functions to run (EXE will generate ‘Message Boxes’ with required Function Name). Add these functions to your selections in RozDll (Advanced)

Notes about Analyzing Process (ANZ)
OA: Analyzing EXE will EXECLUDE all the Dll's in its folder. Means, once RozDll generate a Dll, you need to delete it 'IF' you need to Analyze the EXE again (you can use X button), otherwise it will be excluded in the Dll's ComboBox
OB: Once you Load your Saved Data, only the Dll you worked on before will appear. To get more Dll’s, Repeat the Analyze Process again (also consider above note)

https://www.mediafire.com/file/htvcnsvii...l.rar/file

Quires and 'Error Notes' are welcomed, however please Make it CLEAR or send a link that explain it with the RozDll Saved file
ROZBUD® 2023

RozDll can run on any Windows have .Net Runtime files
Net Runtime is installed by default in Windows10 & Windows 11

:Net Run Time
https://download.visualstudio.microsoft....in-x64.exe