Skip to content

Instantly share code, notes, and snippets.

@adeii
Created January 5, 2024 21:11
Show Gist options
  • Save adeii/d168ead8a4cac9af3a481b7d5da00527 to your computer and use it in GitHub Desktop.
Save adeii/d168ead8a4cac9af3a481b7d5da00527 to your computer and use it in GitHub Desktop.
Brave 1.58.129 x64 for Windows 7
swap in import/export Brave 1.58.129 / chromium 117.0.5938.88 64bit
- UNSTABLE!
- Too many API-MS- libs are imported from Win 8.1.
- Few Win 10 kernel32 functions are improvised with similar functions to work on Win 7 SP1.
brave.exe
==========
120-Security Directory RVA / Size --> 00000000
---
40c10: 15 B3 D8 24 00 85 C0 74 14 FF CF 48 8B 0E 48 85 --> 15 B3 D8 24 00 90 90 90 90 90 90 90 90 90 90 90 (on chrome .63)
44ae0: 15 9B AD 24 00 85 C0 74 14 FF CF 48 8B 0E 48 85 --> 15 9B AD 24 00 90 90 90 90 90 90 90 90 90 90 90 (for brave 1.58)
40c20: C9 75 72 B3 01 85 FF 0F 85 2A 01 00 00 89 D8 48 --> 90 90 90 B3 01 90 90 90 90 90 90 90 90 89 D8 48 (on chrome .63)
44af0: C9 75 72 B3 01 85 FF 0F 85 2A 01 00 00 89 D8 48 (for brave 1.58)
206250: 48 89 F9 E8 98 E7 00 00 84 DB 75 14 FF 15 CE 7D --> 48 89 F9 E8 98 E7 00 00 84 DB EB 14 FF 15 CE 7D (chrome .63)
48 89 CE 48 8B 05 CE 61 09 00 48 31 E0 48 89 44 (for brave 1.58, not tested)
274320: b.c.r.y.p.t.p.r -> x.c.r.y.p.t.p.r (hidden) - search by hex: 63 00 72 00 79 00 70 00 74 00 70
28dd70: userenv -> userenx (hidden)
kernel32 -> kernel64
chrome_proxy.exe
=======================
*
chrome_elf.dll
==============
120-Security Directory RVA / Size --> 00000000
11d7a0: b.c.r.y.p.t.p.r.i.m.i.t -> x.c.r.y.p.t.p.r.i.m.i.t (hidden)
12a760: b.c.r.y.p.t.p.r.i -> x.c.r.y.p.t.p.r.i (hidden) [62 00 63 00 72 00 79 00 70 00 74 00 70 00 72]
12e4c0: kernel32 -> kernel64
chrome.dll
=================
clear digital sign:
120-Security Directory RVA / Size --> 00000000
18fcf0:
C1 30 C1 0F 84 0E 01 00 00 4C 8B BC 24 C0 00 00 --> C1 30 C1 90 90 90 90 90 90 4C 8B BC 24 C0 00 00 (chrome .63)
f94460:
00 00 4C 89 F1 BA 01 00 00 00 41 B8 0F 00 00 10 --> 00 00 4C 89 F1 BA 01 00 00 00 41 B8 0F 00 00 00 (chrome .63)
14DB610:
00 48 85 C0 0F 84 C9 00 00 00 83 78 38 01 0F 85 --> 00 48 85 C0 E9 CA 00 00 00 90 83 78 38 01 0F 85
b.c.r.y.p.t.p -> x.c.r.y.p.t.p (hidden) [62 00 63 00 72 00 79 00 70 00 74 00 70 00]
cd95808: C3 41 1B 9A BB D3 6A 46 87 FC FE 67 55 6A 3B 65 --> 5A EE 59 B8 38 D8 5B 4B A2 E8 1A DC 7D 93 DB 48
b.c.r.y.p.t.p -> x.c.r.y.p.t.p (hidden) [62 00 63 00 72 00 79 00 70 00 74 00 70 00]
user32 -> user64 (hidden)
mfplat -> xfplat (hidden)
netapi32 -> netapi64 (hidden)
kernel32 -> kernel64
userenv -> userenx
winhttp -> winxttp
-- kernel64-function name swaps --
K32GetModuleFileNameExA -> GetModuleHandleExA
SetThreadStackGuarantee -> SetThreadInformation
WritePrivateProfileStringW -> GetPrivateProfileStringW
chrome_wer.exe
==============
*
chrome_pwa_launcher.exe
==============
*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment