
; version.dll Hijack Project
; Caution: 
;   This project code is for testing purposes only! Please do not use it in any other way.
; Code By : Baymax Patch toOls 

LoadLibraryA PROTO
GetSystemDirectoryA PROTO
GetProcAddress PROTO
GetModuleFileNameA PROTO

.data
szDllName db '\version.dll',0

szGetFileVersionInfoA db 'GetFileVersionInfoA',0
szGetFileVersionInfoByHandle db 'GetFileVersionInfoByHandle',0
szGetFileVersionInfoExA db 'GetFileVersionInfoExA',0
szGetFileVersionInfoExW db 'GetFileVersionInfoExW',0
szGetFileVersionInfoSizeA db 'GetFileVersionInfoSizeA',0
szGetFileVersionInfoSizeExA db 'GetFileVersionInfoSizeExA',0
szGetFileVersionInfoSizeExW db 'GetFileVersionInfoSizeExW',0
szGetFileVersionInfoSizeW db 'GetFileVersionInfoSizeW',0
szGetFileVersionInfoW db 'GetFileVersionInfoW',0
szVerFindFileA db 'VerFindFileA',0
szVerFindFileW db 'VerFindFileW',0
szVerInstallFileA db 'VerInstallFileA',0
szVerInstallFileW db 'VerInstallFileW',0
szVerQueryValueA db 'VerQueryValueA',0
szVerQueryValueW db 'VerQueryValueW',0

pfGetFileVersionInfoA dq 0
pfGetFileVersionInfoByHandle dq 0
pfGetFileVersionInfoExA dq 0
pfGetFileVersionInfoExW dq 0
pfGetFileVersionInfoSizeA dq 0
pfGetFileVersionInfoSizeExA dq 0
pfGetFileVersionInfoSizeExW dq 0
pfGetFileVersionInfoSizeW dq 0
pfGetFileVersionInfoW dq 0
pfVerFindFileA dq 0
pfVerFindFileW dq 0
pfVerInstallFileA dq 0
pfVerInstallFileW dq 0
pfVerQueryValueA dq 0
pfVerQueryValueW dq 0

.code

NsStringCatA proc
  push rsi
  push rdi
  xor rsi,rsi
  dec rsi
  xor rdi,rdi
  dec rdi
  xor rax,rax
  dec rdx

_NsStringCatABegin:

  inc rsi
  mov al,byte ptr [rcx+rsi]
  cmp rsi,rdx
  jge _NsStringCatAEnd
  test al,al
  jnz _NsStringCatABegin

_NsStringCatALink:

  inc rdi
  mov al,byte ptr[r8+rdi]
  test al,al
  jz _NsStringCatAEnd
  mov byte ptr [rcx+rsi],al
  inc rsi
  cmp rsi,rdx
  jge _NsStringCatAEnd
  jmp _NsStringCatALink

_NsStringCatAEnd:
  xor rax,rax
  mov byte ptr [rcx+rsi],al
  pop rdi
  pop rsi
  ret

NsStringCatA endp

NsInitDll proc

  push rsi
  sub rsp,130h
  xor rax,rax
  mov [rsp+120],rax

  lea rsi,[rsp+20h]
  mov rdx,100h
  mov rcx,rsi
  call GetSystemDirectoryA
  test rax,rax
  jz _NsInitDllEnd

  lea r8,szDllName
  mov rdx,100h
  mov rcx,rsi
  call NsStringCatA

  mov rcx,rsi
  call LoadLibraryA
  mov [rsi+100h],rax

  test rax,rax
  jz _NsInitDllEnd

  lea rdx,szGetFileVersionInfoA
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfGetFileVersionInfoA, rax

  lea rdx,szGetFileVersionInfoByHandle
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfGetFileVersionInfoByHandle, rax

  lea rdx,szGetFileVersionInfoExA
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfGetFileVersionInfoExA, rax

  lea rdx,szGetFileVersionInfoExW
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfGetFileVersionInfoExW, rax

  lea rdx,szGetFileVersionInfoSizeA
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfGetFileVersionInfoSizeA, rax

  lea rdx,szGetFileVersionInfoSizeExA
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfGetFileVersionInfoSizeExA, rax

  lea rdx,szGetFileVersionInfoSizeExW
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfGetFileVersionInfoSizeExW, rax

  lea rdx,szGetFileVersionInfoSizeW
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfGetFileVersionInfoSizeW, rax

  lea rdx,szGetFileVersionInfoW
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfGetFileVersionInfoW, rax

  lea rdx,szVerFindFileA
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfVerFindFileA, rax

  lea rdx,szVerFindFileW
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfVerFindFileW, rax

  lea rdx,szVerInstallFileA
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfVerInstallFileA, rax

  lea rdx,szVerInstallFileW
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfVerInstallFileW, rax

  lea rdx,szVerQueryValueA
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfVerQueryValueA, rax

  lea rdx,szVerQueryValueW
  mov rcx,[rsi+100h]
  call GetProcAddress
  test rax,rax
  jz _NsInitDllEnd
  mov pfVerQueryValueW, rax

  xor rax,rax
  inc rax
  mov [rsp+120],rax

_NsInitDllEnd:

  mov rax,[rsp+120]
  add rsp,130h
  pop rsi
  ret
NsInitDll endp

Hijack64_GetFileVersionInfoA proc
  jmp qword ptr [pfGetFileVersionInfoA]
Hijack64_GetFileVersionInfoA endp

Hijack64_GetFileVersionInfoByHandle proc
  jmp qword ptr [pfGetFileVersionInfoByHandle]
Hijack64_GetFileVersionInfoByHandle endp

Hijack64_GetFileVersionInfoExA proc
  jmp qword ptr [pfGetFileVersionInfoExA]
Hijack64_GetFileVersionInfoExA endp

Hijack64_GetFileVersionInfoExW proc
  jmp qword ptr [pfGetFileVersionInfoExW]
Hijack64_GetFileVersionInfoExW endp

Hijack64_GetFileVersionInfoSizeA proc
  jmp qword ptr [pfGetFileVersionInfoSizeA]
Hijack64_GetFileVersionInfoSizeA endp

Hijack64_GetFileVersionInfoSizeExA proc
  jmp qword ptr [pfGetFileVersionInfoSizeExA]
Hijack64_GetFileVersionInfoSizeExA endp

Hijack64_GetFileVersionInfoSizeExW proc
  jmp qword ptr [pfGetFileVersionInfoSizeExW]
Hijack64_GetFileVersionInfoSizeExW endp

Hijack64_GetFileVersionInfoSizeW proc
  jmp qword ptr [pfGetFileVersionInfoSizeW]
Hijack64_GetFileVersionInfoSizeW endp

Hijack64_GetFileVersionInfoW proc
  jmp qword ptr [pfGetFileVersionInfoW]
Hijack64_GetFileVersionInfoW endp

Hijack64_VerFindFileA proc
  jmp qword ptr [pfVerFindFileA]
Hijack64_VerFindFileA endp

Hijack64_VerFindFileW proc
  jmp qword ptr [pfVerFindFileW]
Hijack64_VerFindFileW endp

Hijack64_VerInstallFileA proc
  jmp qword ptr [pfVerInstallFileA]
Hijack64_VerInstallFileA endp

Hijack64_VerInstallFileW proc
  jmp qword ptr [pfVerInstallFileW]
Hijack64_VerInstallFileW endp

VerLanguageNameA proc
VerLanguageNameA endp

VerLanguageNameW proc
VerLanguageNameW endp

Hijack64_VerQueryValueA proc
  jmp qword ptr [pfVerQueryValueA]
Hijack64_VerQueryValueA endp

Hijack64_VerQueryValueW proc
  jmp qword ptr [pfVerQueryValueW]
Hijack64_VerQueryValueW endp


end
