MCPcopy Create free account
hub / github.com/LiteLoaderQQNT/QQNTFileVerifyPatch

github.com/LiteLoaderQQNT/QQNTFileVerifyPatch @DllHijack_1.1.2

Chat with this repo
repository ↗ · DeepWiki ↗ · release DllHijack_1.1.2 ↗ · + Follow
3,011 symbols 6,803 edges 103 files 763 documented · 25% ● updated 20mo agoDllHijack_1.1.2 · 2024-09-20★ 6981 open issues

Browse by type

⨍ Functions 2,404◇ Types & classes 607
What it actually does AI analysis from the code graph — generated when you open this
loading…
README

QQNTFileVerifyPatch - DLLHijackMethod

更方便的过文件检测

将DLL重名为dbghelp.dll 丢到QQ.exe同目录下重启NTQQ食用

食用方式

前往Releases下载dll劫持版本,按照你安装的QQ是x86还是x64选择dbghelp_x86/x64.dll

将下载下来的dll重命名为dbghelp.dll 丢到QQ.exe同目录下重启NTQQ即可食用

原理

和修补PE文件的原理类似,这里用了伪装为dbghelp.dll劫持QQ的方式(其实还可以劫持version.dll的)

因为DLL被加载的时候特征码不一定扫得到(不知道是我的Sig扫描器太烂了还是什么玄学问题),所以Hook CreateFileW当lpFileName含有launcher.json准备进行喜闻乐见的校验环节的时候就扫描特征码Hook校验函数

Core symbols most depended-on inside this repo

Shape

Function 1,449
Method 955
Class 583
Enum 24

Languages

C++100%
C#1%

Modules by API surface

HijackMethod_x86/json.hpp586 symbols
HijackMethod_arm64/json.hpp586 symbols
HijackMethod/json.hpp586 symbols
HijackMethod_arm64/dependencies/Detours/src/disasm.cpp180 symbols
HijackMethod_arm64/dependencies/Detours/samples/tracebld/trcbld.cpp139 symbols
HijackMethod_arm64/dependencies/Detours/samples/cping/cping.cpp81 symbols
HijackMethod_arm64/dependencies/Detours/src/image.cpp71 symbols
HijackMethod_arm64/dependencies/Detours/samples/tracetcp/trctcp.cpp66 symbols
HijackMethod_arm64/dependencies/Detours/samples/tracereg/trcreg.cpp64 symbols
HijackMethod_arm64/dependencies/Detours/samples/tracessl/trcssl.cpp63 symbols
HijackMethod_arm64/dependencies/Detours/samples/traceser/trcser.cpp50 symbols
HijackMethod_arm64/dependencies/Detours/src/detours.cpp48 symbols

For agents

$ claude mcp add QQNTFileVerifyPatch \
  -- python -m otcore.mcp_server <graph>

⬇ download graph artifact

Ask about this repo answers extend the page