OneDriveUpdater DLL Sideloading

This repo contains source code for DLL sideloading the version.dll for OneDriveUpdater.exe/OneDriveStandaloneUpdater.exe. The payload is based on the subroutines outlined in the PaloAltoNetworks Unit42's blog post.

My blog post regarding this payload: https://blog.sunggwanchoi.com/recreating-an-iso-payload-for-fun-and-no-profit/

version

Modified source code from the proxy DLL created by SharpDLLProxy from Flangvik.

versionConsole

A console version of the above used for debugging purposes. Already contains a messagebox shellcode.

Credits

• PaloAltoNetworks Unit42
• Peperunas's injectopi
• Sektor7's RTO Malware Essential Course
• mgeeky's PackMyPayload
• Flangvik's SharpDllProxy