Project Overview#

Project link

This project uses C to develop a highly compatible DLL Proxy for hijacking version.dll. The core goals are:

• Seamless forwarding: All standard version.dll API calls are transparently forwarded to the system’s original DLL.
• Stealthy triggering: On DLL load, an asynchronous thread is started to decrypt and execute a hidden payload (e.g. launching the system calculator).

Supported platforms are Windows 7/8/10/11 x64, balancing compatibility, stealth, and file size. Suitable for security research, penetration testing, and similar scenarios.

Directory structure#

1
.
2
├── .gitignore
3
├── build.bat
4
├── LICENSE
5
├── README.md
6
├── .github/
7
│   └── workflows/
8
│       ├── build.yml
9
│       └── copilot-setup-steps.yml
10
└── src/
11
    ├── proxy.c
12
    ├── version.rc
13
    └── vm_engine.h

• proxy.c: Main proxy logic, implementing API forwarding and payload launch
• vm_engine.h: Virtual machine engine, used to dynamically generate/restore encrypted command strings
• version.rc: Resource script that disguises the DLL version information
• build.bat: Local build script
• build.yml: GitHub Actions automated build and packaging
• README.md: Detailed design documentation

Core features and implementation details#

Build and automation#

1
rc.exe /v src/version.rc
2
cl.exe /c /O1 /GL /GS- /MT src/proxy.c /Fo:proxy.obj
3
link.exe /DLL /OUT:version.dll /ENTRY:DllMain /NODEFAULTLIB /SUBSYSTEM:WINDOWS ^
4
/LTCG /OPT:REF /OPT:ICF ^
5
proxy.obj src/version.res kernel32.lib user32.lib

Key code snippets#

API forwarding declaration:

1
#pragma comment(linker, "/export:GetFileVersionInfoA=C:\\Windows\\System32\\version.GetFileVersionInfoA,@1")
2
// ...其余16个API同理...

Virtual machine dynamically restores the command:

1
static void ExecuteVM(WCHAR* output) {
2
    // ...虚拟机解释字节码，动态生成 "calc.exe" ...
3
}

Asynchronous payload launch and memory wipe:

1
DWORD WINAPI ExecutePayload(LPVOID lpParam) {
2
    WCHAR command[64];
3
    ExecuteVM(command);
4
    // ...CreateProcessW 启动 calc.exe...
5
    SecureWipe(command, sizeof(command));
6
    return 0;
7
}

Summary#

Using DLL Proxy technology, this project achieves seamless forwarding to the system’s version.dll and integrates a stealthy payload launch mechanism. The design balances compatibility, stealth, and security, and is suitable for security research, red team testing, and similar scenarios. For detailed design and implementation details, please refer to README.md and the source code comments.