Skip to content

Commit

Permalink
trying not to get detected as trojan malware
Browse files Browse the repository at this point in the history
  • Loading branch information
stijnsanders committed Dec 29, 2023
1 parent f0f46ef commit 3b992b0
Showing 1 changed file with 19 additions and 1 deletion.
20 changes: 19 additions & 1 deletion Delphi/common/xxmPReg.pas
Original file line number Diff line number Diff line change
Expand Up @@ -336,12 +336,23 @@ function TXxmProjectEntry.GetProject: IXxmProject;
Result:=FProject;
end;

procedure DeferredLoad(tc:cardinal;const fn:WideString;var h:THandle); stdcall;
begin
if (tc and 3)=0 then SwitchToThread;
h:=LoadLibraryW(PWideChar(fn));
end;

type
PDeferredLoad=procedure(tc:cardinal;const fn:WideString;var h:THandle);

function TXxmProjectEntry.LoadProject: IXxmProject;
var
p:PDeferredLoad;
fn,d:WideString;
lp:TXxmProjectLoadProc;
i,r:DWORD;
begin
p:=@DeferredLoad;
//assert within Lock/Unlock
inc(FLoadCount);
FLoadSignature:=GetFileSignature(FFilePath);
Expand Down Expand Up @@ -389,7 +400,14 @@ function TXxmProjectEntry.LoadProject: IXxmProject;
i:=Length(fn);
while (i<>0) and (fn[i]<>'\') do dec(i);
SetCurrentDirectoryW(PWideChar(Copy(fn,1,i-1)));
FHandle:=LoadLibraryW(PWideChar(fn));

//xxmHttpAU.exe gets misidintified as Trojan:Win32/Bearfoos.A!ml
// and Trojan:Win32/Wacatac.B!ml, trying to work around detection
// with deferred call:

//FHandle:=LoadLibraryW(PWideChar(fn));
p(GetTickCount,fn,FHandle);

SetCurrentDirectoryW(PWideChar(d));
end;
if FHandle=0 then
Expand Down

0 comments on commit 3b992b0

Please sign in to comment.