Как обойти LdrLoadDll?

https://github.com/trickster0/LdrLoadDll-Unhooking

 

грузи мануалмапом, либо вызывай функцию внутри LdrLoadDll, а именно LdrpLoadDll.
я сделал себе вот такую реализацию

HMODULE LoadDll( const std::wstring_view& fullDllPath ) {
static auto LdrpLoadDll = Function( FindPattern( "ntdll.dll", "40 55 53 56 57 41 56 41 57 48 8D AC 24", true, true ) );
UNICODE_STRING ModuleFileName;

auto RtlInitUnicodeString = []( PUNICODE_STRING DestinationString, PCWSTR SourceString ) -> void {
SIZE_T Size;
const SIZE_T MaxSize = ( 0xffff & ~1 ) - sizeof( UNICODE_NULL ); // an even number

if ( SourceString ) {
if ( Size = wcslen( SourceString ) * sizeof( WCHAR ); Size > MaxSize )
Size = MaxSize;
DestinationString->Length = (USHORT)Size;
DestinationString->MaximumLength = (USHORT)Size + sizeof( UNICODE_NULL );
}
else {
DestinationString->Length = 0;
DestinationString->MaximumLength = 0;
}
DestinationString->Buffer = (PWCHAR)SourceString;
};

RtlInitUnicodeString( &ModuleFileName, fullDllPath.data( ) );

__int64 v17;
__int64 v18[ 128 ];

auto LdrpInitializeDllPath = []( __int64 a1, __int64 a2, __int64* a3 ) -> void* {

void* result; // rax
__int64 v7; // rcx

result = memset( a3, 0, 0x80ui64 );
if ( ( a2 & 1 ) != 0 || !a2 )
{
a3[ 4 ] = a1;
*( a3 + 6 ) = a2 & 0xFFFFFFFE;
}
return result;
};

LdrpInitializeDllPath( *(uintptr_t*)( &ModuleFileName + 8 ), 0, v18 );
LdrpLoadDll( (__int64)&ModuleFileName, v18, 0, (__int64)&v17 );

return *reinterpret_cast<HMODULE*>( v17 + 0x30 );
}

C

HMODULE LoadDll( const std::wstring_view& fullDllPath ) {

    static auto LdrpLoadDll = Function( FindPattern( "ntdll.dll", "40 55 53 56 57 41 56 41 57 48 8D AC 24", true, true ) );

    UNICODE_STRING ModuleFileName;



    auto RtlInitUnicodeString = []( PUNICODE_STRING DestinationString, PCWSTR SourceString ) -> void {

        SIZE_T Size;

        const SIZE_T MaxSize = ( 0xffff & ~1 ) - sizeof( UNICODE_NULL ); // an even number



        if ( SourceString ) {

            if ( Size = wcslen( SourceString ) * sizeof( WCHAR ); Size > MaxSize )

                Size = MaxSize;

            DestinationString->Length = (USHORT)Size;

            DestinationString->MaximumLength = (USHORT)Size + sizeof( UNICODE_NULL );

        }

        else {

            DestinationString->Length = 0;

            DestinationString->MaximumLength = 0;

        }

        DestinationString->Buffer = (PWCHAR)SourceString;

    };



    RtlInitUnicodeString( &ModuleFileName, fullDllPath.data( ) );



    __int64 v17;

    __int64 v18[ 128 ];



    auto LdrpInitializeDllPath = []( __int64 a1, __int64 a2, __int64* a3 ) -> void* {



        void* result; // rax

        __int64 v7; // rcx



        result = memset( a3, 0, 0x80ui64 );

        if ( ( a2 & 1 ) != 0 || !a2 )

        {

            a3[ 4 ] = a1;

            *( a3 + 6 ) = a2 & 0xFFFFFFFE;

        }

        return result;

    };



    LdrpInitializeDllPath( *(uintptr_t*)( &ModuleFileName + 8 ), 0, v18 );

    LdrpLoadDll( (__int64)&ModuleFileName, v18, 0, (__int64)&v17 );



    return *reinterpret_cast<HMODULE*>( v17 + 0x30 );

}