الفريق العربي للهندسة العكسية
FIXIT (the new Proxy/Hijacked DLL Generator) - نسخة قابلة للطباعة

+- الفريق العربي للهندسة العكسية (https://www.at4re.net/f)
+-- قسم : منتديات الهندسة العكسية - Reverse Engineering Forums (https://www.at4re.net/f/forum-4.html)
+--- قسم : البرامج و أدوات الهندسة العكسية - RCE Tools (https://www.at4re.net/f/forum-29.html)
+--- الموضوع : FIXIT (the new Proxy/Hijacked DLL Generator) (/thread-3655.html)

الصفحات: 1 2 3 4


FIXIT (the new Proxy/Hijacked DLL Generator) - ROZBUD - 23-08-2023

مفاجأة من العيار الثقيل
FIXIT (the new Proxy/Hijacked DLL Generator)

I’m glad to present to you, the new Proxy/Hijacked DLL Generator I developed along the past 2 months.
‘FIXIT’ will help you create Proxy DLL’s for your 'Personal Needs'.

Instructions:
1- Select the DLL Name you need to create. You can use PROCMON to find the missing/unloaded DLL’s within the current folder of your Executable (See this video: https://www.youtube.com/watch?v=XvxeUxOvKb0).
2- Select the Code Injection Method you like to follow.
3- Select or Unselect your Magic Function(s).
4- Use Xdbg64, to set BreakPoints on the numbered/ordinal functions in the chosen DLL. Verify which Function in this DLL BreackPoints or Hit the ‘Patched Code’ first (recommended).
5- Once you compiled the DLL which includes chosen function(s), Executable may warn you for missing functions which you need to include them in your selection.

Watch the demo video included with the RAR file (Pass: [email protected]), read the instructions below & try it at your comfort.
FIXIT is a Pre-Release, hence I will be waiting your kind comments on ‘Errors’ if any.
Final version will be enhanced and re-uploaded after we ensure it works well with all.

With FIXIT, I’m presenting 2 months of ‘Hard-Work’ development, freely to all colleagues @ AT4RE.NET

https://www.mediafire.com/file/ndiue05hcgpgv7c/Fixit.rar/file

Regards
ROZBUD ® 2023



RE: FIXIT (the new Proxy/Hijacked DLL Generator) - ROZBUD - 23-08-2023




RE: FIXIT (the new Proxy/Hijacked DLL Generator) - mounirsoltan - 23-08-2023

لا اعلم لكن ياخذ الكثير من الوقت ليشتغل هل نفس شيء يحصل معكم او المشكل في جهازي استعمل واندوز 11


RE: FIXIT (the new Proxy/Hijacked DLL Generator) - ROZBUD - 24-08-2023

It takes less than a Blink of eye. 
بأقل من رمشة عين، على Win10 شوف:

https://www.mediafire.com/file/fsizn37k7ja67kv/NewFixitClip.mp4/file


RE: FIXIT (the new Proxy/Hijacked DLL Generator) - KaMaN99 - 24-08-2023

Greate JOB

?does it support "Dynamic image based" targets


RE: FIXIT (the new Proxy/Hijacked DLL Generator) - ROZBUD - 02-09-2023

Dear KaMaN99
FIXIT is using RVA as a Dynamic Address if this is what you mean



RE: FIXIT (the new Hijacked DLL Generator) - ROZBUD - 02-09-2023

Here is an updated version with minor fixes
https://www.mediafire.com/file/ikrgawr8a55fstz/FixIt.rar/file

Kindly participate in evaluating FIXIT
يرجى المشاركة



RE: FIXIT (the new Proxy/Hijacked DLL Generator) - samoray - 02-09-2023

A very good Project indeed, well done
I tried to use it with a software packed with UPX (and maybe some code section was also virtualized) and did not work, when you launch the software it says that entrypoint is outside region or something like that (I dont remember exactly as my trial was 10 days ago), so, can you make any tutorial with real targets when you have more than three addresses that needs to be patched?
Thanks again for the promising project


RE: FIXIT (the new Proxy/Hijacked DLL Generator) - ROZBUD - 02-09-2023

Dear Samoray
Thank you for your feedback

I will write some tutorials very soon
Try to pack both test Fies (included with FIXIT) with upx & try .. it will work
Note that once you browsed an EXE file, FIXIT calculate the exe size, so if you pack the file after this step, FIXIT will not work correctly, because the filesize get changed

share with me a link to your target packed file & note that FIXIT may not work with STRONG Crypted/Packed files



RE: FIXIT (the new Proxy/Hijacked DLL Generator) - ROZBUD - 02-09-2023

Dear mounirsoltan 
Yes, it may take time to load at the first time only, because of ANTIVIRUS Installed on your PC