May I replace the vnchooks.dll in SC?

[jfshy]

After I generate a SC exe file with online tool, while executing, the vnchooks.dll will be detelted by antivirus software automaticly.

I find the info of vnchooks.dll provided by online generator as below,
Size : 52.0 KB (53,248 byte)
Version : 3.3.6.0
Moidied : 2009-8-3, 02:55:42
CRC32 : EED3A4BA
MD5 : AA5174FDF8DEDE1A7A51E87F0D923D37

but the info of vnchooks.dll provided in UltraVNC setup (UltraVNC_1_1_9_X86_Setup) as below, and also it's with a digital signature, and it will not be detected as trojan.
Size : 54.2 KB (55,544 byte)
Version : 1.1.0.0
Modified : 2013-4-29, 21:28:38
CRC32 : BE0B97E8
MD5 : DDBCF770351F53B218C5E69FDAE8FE0D

I want to know, may I replace the online generator provided vnchooks.dll with the one in the UltraVNC setup package by myself? Will there be any side effect on this replacement?

[Rudi De Vos]

You can easy test it.
Use 7zip to extract the sc exe in a folder.
Replace the schook.dll with the new version and start winvnc.exe.

The latest online compiler (v2013) that sign the exe doesn't allow that custom dll/exe can be imported
with the uploaded zip file. This need to be done by us on the website.

Please test if it makes a difference. ( normal all vnchook versions are compatible)

[jfshy]

You can easy test it.
Use 7zip to extract the sc exe in a folder.
Replace the schook.dll with the new version and start winvnc.exe.

The latest online compiler (v2013) that sign the exe doesn't allow that custom dll/exe can be imported
with the uploaded zip file. This need to be done by us on the website.

Please test if it makes a difference. ( normal all vnchook versions are compatible)

Thanks for Rudi De Vos quickly response.
May I have two more questions? (Marked as Q1 & Q2)

Yes, I have unzip the online generated exe file, and replace the vnchooks.dll with the one included in UltraVNC_1_1_9_X86_Setup. It looks nothing changed.
But, even I delete the vnchooks.dll, actually it is deleted by antivirus programe already, the winvnc.exe still worked normally.
So, I wonder what is the function(usage) of vnchooks.dll ? ---- Q1

By the way, it looks like the vnchooks.dll included in UltraVNC_1_1_9_X86_Setup is newer then the online generated one, it has a digital signature‎ 2013‎-‎4‎-‎30 3:28:39.
Also they have similar file size, I do not think the file size is the consideration. And, a dll with digital signature‎ should be more credible.
Then I wonder why the online generator will not import this newer version (with digital signature) directly? ---- Q2

[Rudi De Vos]

Q1: A hookdll give hints about the screen position that changed.
Vnc first check them instead of doing a continous full screen polling.
If the hook does it job, it's faster and use less cpu.

Q2: Because we block it.
We block the import of dll exe. It's impossible to check if it's another file created by us
or by some else. It can be a real hook dll or a virus.
We don't thust the imported files as we can't check them.

Signing a file is telling you thrust it.
Verisign thrust you and MS thrust verisign -> exe can be run from browser.

[jfshy]

As for Q2,
I mean, could you replace the vnchooks.dll on your web server directly? Then user can download the online generated SC with newer version and digital signed vnchooks.
(I also agree that you should bock user uploading and importing dll by themselves.)
Thanks.