The issue about cydoor is presumably it is calling the WinAPI function LoadLibrary and if it fails, complaining and exiting. So our job is to make it think the LoadLibrary call has succeeded, which my involve quite a lot of work filling in certain variables and forcing certain functions to return "correct" values. This can either be done at load time by editing the actual EXE file or at run time, by patching the call to LoadLibrary which causes it to first perform some of our code ( such as if( trying_to_load_cydoor ){ return success } else { call LoadLibrary } )
I will have a go with Hview, but surely all it gives you is the packed executable code?
|