+------------------------------------------+
   TFakeDll v1.1 (Beta 2) by Dr.Golova.
+------------------------------------------+

I.         .
II.    .
III.  .
IV.      .
V.       .


I.      .
===============================

TFakeDll -  Delphi ,    32 
 (dll)    (Win32 PE Exe),   Delphi.
       
 ( ,      ), 
       .   , ,
   dll        
 ,    .  ,    
. TFakeDll  (   ) ""
   ,       
   .   ,  TFakeDll
    Windows -   
 dll  ,   ,   
       dll.

II.  .
=====================

TFakeDll  2  - FDHandle  ShowErrors.

1) FDHandle     dll    
   MZ ,
2) ShowErrors  ,   True      
   MessageBox   ,   False -   .

TFakeDll   2  - InjectDll  GetFDProcAddress.


1) procedure InjectDll(MemoryFile : Pointer; FreeOld : LongBool);

       . MemoryFile -
   MZ    (  dll 
) dll  , ..        
  -     ,   dll  
 -  ,        .
 ,  dll    /   (
..   EXE ,  UPX),     
,    / .
FreeOld ,       
  (    
) -     true,   ... 
     ,   
     dll_dump.exe   Toolz,
,       .


2) function GetFDProcAddress(ProcName :PChar) : Pointer;

   GetProcAddress     
 dll. ProcName       
 (   !)   Ordinal 
.       ,   
 . Ahtung! Export Forwarding  ,  
.

       Examples.

III. .
=================

   -     dll,      
   dll   API    hModule
-       dll   dll,
      .   
   GetProcAddress   
  FakeDll    LoadResource   dll.  
         
  .  ,   
.


IV.    .
=========================

v1.1:

1)    C++ -     .
2)     obj  -     Delphi.
3)     -     .
4) GetFDProcAddress    , ..   
      .

v0.01

 ,    :)


V.    .
==========================

  ,     /  
  : dr_golova@pisem.net

== by Dr.Golova [mailto: dr_golova@pisem.net] ================ 01.06.02 ===
== [c] Underground Information Center [ http://www.uinc.ru ]===============
