News: Cexx forums, with volunteers dedicated to helping you remove malware and stay protected
 
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
June 19, 2013, 10:53:00
Pages: [1]   Go Down
  Print  
Topic: Kazaa & ICQ editing  (Read 2310 times)
0 Members and 1 Guest are viewing this topic.
« on: June 18, 2003, 04:17:39 »
Icarus
Guest

Hi
What are the software needed to edit ICQ an Kazaa´s exe's and dll's?
I mean, with Borland C++ Builder I could at least open and view contents of some ICQ dll's, but don't know how to edit and save them. I could not therefore edit or even see what is inside icq.exe and kazaa evil dll' s (topsearch.dll, kzscan.dll and so on...).
I know banner lines in icq.exe but can't edit it. :[
People at cexx.org done a great job on craeting a dummy file for cd_clint.dll (Kazaa), and I think it would be possible to do the same, or at least try, with those dll's, but unfortunately I don't know what piece of software was used in that good job.
Hope to hear from you soon... :]

Icarus
Logged
« Reply #1 on: June 18, 2003, 06:12:04 »
moderaticles Offline
Global Moderator

Karma: 0
Posts: 280



this post's in the wrong board; it belongs in GENERAL.  i'm moving it for future reference...
Logged

sun == fun.

sunburn =/= funburn Sad
« Reply #2 on: June 19, 2003, 00:12:01 »
Admin Offline
Administrator WWW

Karma: 0
Posts: 332



The "dummy DLLs" are created from scratch, and do not use or require any piece of the original file. If what you're after is to create dummy files similar to the CD_CLINT.DLL dummy, you need to find out the functions the original DLL exports, how each one is called (e.g. what kind of data, and how much of it, the host program passes to the real DLL), and the proper return value that will keep that host program happy. There is typically an SDK available to adware developers using a particular DLL, if you can get ahold of this, it will tell everything you need to know.

Example:

 A fictional program, HuZzAh, uses a fictional ad/spyware DLL, adfeces.dll. When HuZzAh starts up, it calls a DLL function such as StartAdBlasting(int height, int width). In the real DLL, this function connects to the internet and downloads ads, and returns "1" if the downloading was successful, and "0" if it was not. If HuZzAh receives the "0" response, it complains loudly and refuses to run.

When creating your dummy file, just create a DLL in any programming language that lets you, and create empty functions named after all the required exports. These empty functions do nothing except accept the data passed to them, then blindly return whatever data is necessary to keep the host program happy. In C++ Builder, this looks something like:

int __stdcall StartAdBlasting(int, int)
{
      return 1;
}



If what you are trying to do is simply hand-edit an EXE or DLL to e.g. change the phone-home URL to localhost, set the banner size to 0, etc., you can use any old hex editor or even Wordpad. You can also use a free program called Resource Hacker to do this more easily.
Logged
« Reply #3 on: June 24, 2003, 03:39:36 »
Icarus
Guest

Hi
Nice to get your reply :)
The main reason I'm trying to see, understand and edit, or create new dlls from stractch is to neuter Kazaa and ICQ from draining resources from my computer and catch personal information such as my surfing habits etc.
I entered Kazaa's hp today and they have launched a new version: w w w .kazaa.com/us/news/2.5_launch. htm
I haven´t tried it yet, but just talking about the installer, duh, it sucks... They´re getting more agressive.
But talking about version 2.1, I just wanted to change the bad dlls out there, I mean TopSearch, Bullguard etc., mainly the kzscan dll that seems the one that calls the others.
In ICQ, I just want to edit icqhttp.ocx (version 2003a Pro), that´s the one that puts that square banner on the top of main window, but if I simply delete it (like I do with icqhttpcontrol.dll and thus get rid of ads in message window), no http function works, and I can't read messages send files etc. There's a command in it: "loadbanner", and if I could just take it off I think ICQ would work greatly like it was in versions prior to 2001b.
Also, may it make difference if a original dll is made in a program and recreated in another, I mean maybe those dlls were not made in C++ ou Visual C ...

[]'s
Icarus
Logged
 
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by SMF 1.1.18 | SMF © 2013, Simple Machines Page created in 1.096 seconds with 20 queries.