On Tuesday 07 November 2006 10:59, Solar Eclipse wrote:
<snip>
> What you probably don't know is that you can use a full UNC path instead of
> a DLL name in the import section of a PE file. When the file is executed,
> the loader will try to access the imported DLL using the UNC path and the
> WebDAV redirector will download the DLL from the Internet.
Whilst using this technique to decrease PE size is quite interesting, I'd be
willing to bet most here would already be aware of the redirector
functionality when loading DLLs, as it was pointed out by Dave Litchfield
over a year ago.
www.ngssoftware.com/papers/xpms.pdf
--
With Regards..
Barrie Dempster (zeedo) - Fortiter et Strenue
- http://reboot-robot.net -
"He who hingeth aboot, geteth hee-haw" Victor - Still Game
_______________________________________________
Dailydave mailing list
Dailydave_at_lists.immunitysec.com
http://lists.immunitysec.com/mailman/listinfo/dailydave
- application/pkcs7-signature attachment: smime_p7s
Received on Nov 08 2006
Intro
