{"id":9430,"date":"2024-09-05T23:05:25","date_gmt":"2024-09-05T23:05:25","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=9430"},"modified":"2024-09-06T08:58:12","modified_gmt":"2024-09-06T08:58:12","slug":"the-art-of-overdlloading","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2024\/09\/05\/the-art-of-overdlloading\/","title":{"rendered":"The art of overDLLoading"},"content":{"rendered":"\n<p>Some time ago I came up with a silly idea: i&#8217;d like to build an executable that statically links to most of the c:\\windows\\system32 libraries. It&#8217;s a non-sensical programming exercise, but it&#8217;s also an interesting challenge.<\/p>\n\n\n\n<p>Forcing a static import of so many libraries into a single executable is actually a non-trivial task, and there are many approaches we can take to do it. Most of the high-level language-based avenues one can pursue here are kinda problematic though, because they are full of custom library building aka lots of troubleshooting. After looking at various programming languages I have eventually found myself looking at the assembly language compilers available out there. The incredible simplicity of generating your own, customized import tables offered by fasm immediately caught my attention. <\/p>\n\n\n\n<p>With a bit of python foo and fasm compilation magic, I was able to build this <a href=\"https:\/\/www.virustotal.com\/gui\/file-analysis\/NTliY2ZhZjM4ZGU1MDk5ZmMwNjcwOTlhYjMwM2E4ZmI6MTcyNTU3NjYyNQ==\">monster<\/a> (79K APIs):<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/overDLLoader.gif.gif\"><img decoding=\"async\" loading=\"lazy\" width=\"975\" height=\"850\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/overDLLoader.gif.gif\" alt=\"\" class=\"wp-image-9431\"\/><\/a><\/figure>\n\n\n\n<p>I am not 100% sure it is a correct PE file (in terms of all structures filled in properly), but it seems to run on windows 11 (with a caveat that it reports a critical error).<\/p>\n\n\n\n<p>If you are wondering what is the purpose of this exercise, I&#8217;d like to throw a few ideas:<\/p>\n\n\n\n<ul>\n<li>linking to many OS-dependent libraries could be an interesting guardrail technique<\/li>\n\n\n\n<li>it may break tools (it would seem it breaks python&#8217;s pefile module and it causes problems to decompilers)<\/li>\n\n\n\n<li>it is a great learning exercise about a PE file format; after so many years of dealing with it I am still surprised how much I don&#8217;t know about it<\/li>\n<\/ul>\n\n\n\n<p>And here&#8217;s the import table as seen by Ida:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/overdlloaded.png\"><img decoding=\"async\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/overdlloaded.png\" alt=\"\" class=\"wp-image-9438\" width=\"500\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/overdlloaded.png 623w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/overdlloaded-300x118.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/09\/overdlloaded-500x197.png 500w\" sizes=\"(max-width: 623px) 100vw, 623px\" \/><\/a><\/figure>\n\n\n\n<p>An attempt to copy these function names to clipboard pretty much freezes the program.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Some time ago I came up with a silly idea: i&#8217;d like to build an executable that statically links to most of the c:\\windows\\system32 libraries. It&#8217;s a non-sensical programming exercise, but it&#8217;s also an interesting challenge. Forcing a static import &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2024\/09\/05\/the-art-of-overdlloading\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,21,58],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9430"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=9430"}],"version-history":[{"count":5,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9430\/revisions"}],"predecessor-version":[{"id":9439,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9430\/revisions\/9439"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=9430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=9430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=9430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}