Skip to content
This repository was archived by the owner on Feb 1, 2024. It is now read-only.
This repository was archived by the owner on Feb 1, 2024. It is now read-only.

Enhancement Request: Replicate VERSIONINFO #1

@offsecguy

Description

@offsecguy

I request that a feature be added to the project that allows for the automatic extraction of the VERSIONINFO from the original DLL (if found) and the replication of that information into a resource file in the proxy dll project template. This feature would enable the proxy project to retain the original DLL's versioning information.

At present the current proxy template compiles without VERSIONINFO:
image

After the enhancement is in place, the final proxy dll would compile with the same VERSIONINFO as the original DLL:
image

Additionally, an option to timestomp the final proxy dll to match the date of the original dll would be a great addition.

To reproduce the intended outcome manually, you can leverage ResourceHacker and timestomp.

Extract VERSIONINFO from original DLL:
rh.exe -open "C:\Windows\System32\version.dll" -save "version.rc" -action extract -mask VERSIONINFO -log CON

Compile .rc to .res
rh.exe -open "version.rc" -save "version.res" -action compile -log CON

Write final proxy dll with cloned VERSIONFINO:
rh.exe -open "version.dll" -save "version_final.dll" -resource "version.res" -action add -mask VERSIONINFO -log CON

Clone MACE with original DLL timestamps via timestomp:
ts.exe -c "c:\windows\system32\version.dll" "version_final.dll"

Ref: http://www.angusj.com/resourcehacker/
Ref: https://github.com/jackson5sec/timestomp

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions