Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't use LoadLibrary #1

Open
jbremer opened this issue Apr 27, 2017 · 1 comment
Open

Don't use LoadLibrary #1

jbremer opened this issue Apr 27, 2017 · 1 comment

Comments

@jbremer
Copy link

jbremer commented Apr 27, 2017

Just wanted to mention that using LoadLibrary to fetch a resource from a PE file isn't exactly secure. Any malicious application that redirects DllMain (if it's a DLL in the first place), adds a TLS callback to the PE file, or simply patches some of the programs' code will be able to run arbitrary code on the machine where your Py2ExeDecompiler program is running

https://github.com/endgameinc/Py2ExeDecompiler/blob/master/Py2ExeDecompiler/Form1.Designer.cs#L340

@malware-unicorn
Copy link
Contributor

I understand the risks of using LoadLibrary due to dll hijacking. LoadLibrary used for extracting the resource, but this is also initialized by the user input (drag drop/upload). The intent of this tool is to analyze py2exe malware inside of a sandbox. Also I have yet to see a py2exe dll.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants