Skip to content

Commit 3b992b0

Browse files
committed
trying not to get detected as trojan malware
1 parent f0f46ef commit 3b992b0

1 file changed

Lines changed: 19 additions & 1 deletion

File tree

Delphi/common/xxmPReg.pas

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -336,12 +336,23 @@ function TXxmProjectEntry.GetProject: IXxmProject;
336336
Result:=FProject;
337337
end;
338338

339+
procedure DeferredLoad(tc:cardinal;const fn:WideString;var h:THandle); stdcall;
340+
begin
341+
if (tc and 3)=0 then SwitchToThread;
342+
h:=LoadLibraryW(PWideChar(fn));
343+
end;
344+
345+
type
346+
PDeferredLoad=procedure(tc:cardinal;const fn:WideString;var h:THandle);
347+
339348
function TXxmProjectEntry.LoadProject: IXxmProject;
340349
var
350+
p:PDeferredLoad;
341351
fn,d:WideString;
342352
lp:TXxmProjectLoadProc;
343353
i,r:DWORD;
344354
begin
355+
p:=@DeferredLoad;
345356
//assert within Lock/Unlock
346357
inc(FLoadCount);
347358
FLoadSignature:=GetFileSignature(FFilePath);
@@ -389,7 +400,14 @@ function TXxmProjectEntry.LoadProject: IXxmProject;
389400
i:=Length(fn);
390401
while (i<>0) and (fn[i]<>'\') do dec(i);
391402
SetCurrentDirectoryW(PWideChar(Copy(fn,1,i-1)));
392-
FHandle:=LoadLibraryW(PWideChar(fn));
403+
404+
//xxmHttpAU.exe gets misidintified as Trojan:Win32/Bearfoos.A!ml
405+
// and Trojan:Win32/Wacatac.B!ml, trying to work around detection
406+
// with deferred call:
407+
408+
//FHandle:=LoadLibraryW(PWideChar(fn));
409+
p(GetTickCount,fn,FHandle);
410+
393411
SetCurrentDirectoryW(PWideChar(d));
394412
end;
395413
if FHandle=0 then

0 commit comments

Comments
 (0)