01-18-2016, 03:31 AM
Yo.
OG. Source from Scripter4Ever, however I've updated it to VB.Net standards and cleaned it up.
This, is what either of LoadLibrary entry points look like before execution of the code:Â
![[Image: UO4ZsTz.png]](http://i.imgur.com/UO4ZsTz.png)
This is what it looks like after:
![[Image: qWjABXu.png]](http://i.imgur.com/qWjABXu.png)
The first statement of LoadLibrary was just replaced by a return statement, causing any dll injector using LoadLibrary to fail (because when LoadLibrary is being called, it just returns without loading the actual dll into the process).
Hope you guys enjoy, I wouldn't rely on this too much though as it'd be fairly easy to reverse, but none the less it gets the concept across.
OG. Source from Scripter4Ever, however I've updated it to VB.Net standards and cleaned it up.
Code:
<DllImport("kernel32", CharSet:=CharSet.Auto, SetLastError:=True)>
  Private Shared Function GetProcAddress(
      ByVal ModuleHandle As IntPtr,
      ByVal ProcName As String) As IntPtr
  End FunctionÂ
<DllImport("kernel32", CharSet:=CharSet.Auto, SetLastError:=True)>
  Private Shared Function GetModuleHandle(
      [size=small][font=Monaco, Consolas, Courier, monospace]ByVal lpModuleName[/font][/size][size=small][font=Monaco, Consolas, Courier, monospace] As String[/font][/size]) As IntPtr
  End FunctionÂ
<DllImport("kernel32", CharSet:=CharSet.Auto, SetLastError:=True)>
  Private Shared Function WriteProcessMemory(
      ByVal hProcess As IntPtr,
      ByVal lpBaseAddress As IntPtr,Â
      ByVal lpBuffer As Byte(),
      ByVal nSize As UInteger,
      ByRef lpNumberOfBytesWritten As UInt32) As Boolean
  End FunctionÂ
  Public Sub AntiDll()   Â
   Dim LoadLibraryA As IntPtr = CType(GetProcAddress(CInt(GetModuleHandle("kernel32")), "LoadLibraryA"), IntPtr)
   Dim LoadLibraryW As IntPtr = CType(GetProcAddress(CInt(GetModuleHandle("kernel32")), "LoadLibraryW"), IntPtr)
   If LoadLibraryA <> IntPtr.Zero Then WriteProcessMemory(Process.GetCurrentProcess.Handle, LoadLibraryA, New Byte() {&HC2, &H4, &H0, &H90}, 4, 0)
   If LoadLibraryW <> IntPtr.Zero Then WriteProcessMemory(Process.GetCurrentProcess.Handle, LoadLibraryW, New Byte() {&HC2, &H4, &H0, &H90}, 4, 0)
  End Sub
This, is what either of LoadLibrary entry points look like before execution of the code:Â
![[Image: UO4ZsTz.png]](http://i.imgur.com/UO4ZsTz.png)
This is what it looks like after:
![[Image: qWjABXu.png]](http://i.imgur.com/qWjABXu.png)
The first statement of LoadLibrary was just replaced by a return statement, causing any dll injector using LoadLibrary to fail (because when LoadLibrary is being called, it just returns without loading the actual dll into the process).
Hope you guys enjoy, I wouldn't rely on this too much though as it'd be fairly easy to reverse, but none the less it gets the concept across.