Hello,

I am trying to load a certain dll from inside a certain .exe of which I don't have the source code.

So I tried to do it with a code cave which seemed like a good option, but I am experiencing some trouble.

This is what I have so far:

I first load the .exe in ollydebugger then I select the exe module with ALT + E.

then I make sure I have at least 5 bytes of free space somewhere in the stack, in this case I did that by replacing the following asm commands with NOP's:

004BF23B                                 8BF2             MOV ESI,EDX
004BF23D                                 8BD8             MOV EBX,EAX
004BF23F                                 94               XCHG EAX,ESP

After that I go to the bottom to find some free space and add this code:

0052152A                                    90               NOP
0052152B                                    68 87155200      PUSH some.00521587 ; ASCII "some.dll"
00521530                                    E8 42349B76      CALL kernel32.LoadLibraryA
00521535                                    90               NOP
.....					    8BF2             MOV ESI,EDX
.....         	                            8BD8             MOV EBX,EAX 
.....	                                    94               XCHG EAX,ESP
00521536                                    68 FDF04B00      PUSH <some.codecave.Return>
0052153B                                    C3               RETN

I declared the ASCII somewhere above this code in the stack, also in some free space. The "codecave.Return" label is attached to the command right below the free space I made, so it would normally come after "XCHG EAX, ESP".

Finally I replaced the 5 bytes of free space with this command:

004BF23B                                   E9 E7220600      JMP <some.codecave.MyCodeCave>

which makes it jump straight to the beginning of the code you see in the second code window.

then I right click and do "copy all modifications to executable", when another window which shows the selection of what I modified appears, I right click again and do "save" and I enter another name than the original.

So when I have the dll in the same folder as the edited executable it still doesnt load it, the executable doesnt even start.

I hope someone can tell me what I did wrong.

Thanks alot in advance!

Hi,

Thanks for the reply,

Dont mind the addresses they are not accurate.

I also tried it once with a JMP to the address after my JMP to the code cave and that also didn't work.

I believe Windows calling convention allows EAX, ECX and EDX to be used as volatiles (i.e. the called function will not back them up, and the caller must assume they got clobbered and back them up if they need to be preserved). You should save all three just in case.

@ApochPiQ

Still did the same thing, it just doesnt start. This is what I replaced this time:

004BF1F7                                        00CC             ADD AH,CL
004BF1F9                                        8BC8             MOV ECX,EAX
004BF1FB                                        85C9             TEST ECX,ECX

with this:

004BF1F7                                            E9 38230600      JMP <some.codecave.MyCodeCave>
004BF1FC                                            90               NOP
004BF1FD <codecave.ReturnFromCodeCave>              75 FF            JNZ SHORT some.004BF1FE

and the codecave:

00521534 <codecave.MyCodeCave>                      50               PUSH EAX
00521535                                            68 1B155200      PUSH some.0052151B
0052153A                                            E8 38345874      CALL kernel32.LoadLibraryA
0052153F                                            58               POP EAX
00521540                                            90               NOP
00521541                                            02E1             ADD AH,CL
00521543                                            8BC8             MOV ECX,EAX
00521545                                            85C9             TEST ECX,ECX
00521547                                            90               NOP
00521548                                           ^E9 B0DCF9FF      JMP <some.codecave.ReturnFromCodeCave>

Thanks in advance

No, the size of the modded program is 412,672 bytes and the original also 412,672 bytes..

The lines which I refer to as "the bottom" contain this command:

0052151B   0000             ADD BYTE PTR DS:[EAX],AL