Vault7: CIA Hacking Tools Revealed
Navigation: » Directory » User #7995631 » User #7995631’s Home
Owner: User #7995631
regsvr32
Looking for a Microsoft signed tool to loadlib your dll?? regsvr32.exe is your friend. The tool it meant to help COM servers register so they can be loaded by the SCUM. The tool takes a path to any dll and will loadlibrary and call GetProcAddress on the function DllRegisterServer. You can also silence any error reporting which makes it pretty nice. In addition to DllRegsiterServer it will call GetProcAddress and call the following:
HRESULT DllInstall(__in BOOL bInstall, __in LPCWSTR pszCmdLine)
{
DEBUGPRINT(eMT_Debug, L"DllInstall: Inside DllInstall!");
HANDLE hFile = CreateFile(L"DllInstall.txt", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_WRITE | FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
if (hFile == NULL || hFile == INVALID_HANDLE_VALUE)
{
DEBUGPRINT(eMT_Debug, L"DllInstall: Cannot open file.");
}
CloseHandle(hFile);
return S_OK;
}
HRESULT DllRegisterServer()
{
DEBUGPRINT(eMT_Debug, L"DllRegisterServer: Inside DllRegisterServer!");
HANDLE hFile = CreateFile(L"DllRegsiterServer.txt", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_WRITE | FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
if (hFile == NULL || hFile == INVALID_HANDLE_VALUE)
{
DEBUGPRINT(eMT_Debug, L"DllRegisterServer: Could not create file");
}
CloseHandle(hFile);
return S_OK;
}
HRESULT DllUnregisterServer()
{
//Cleanup
return S_OK;
}
