3 ms·
I don't think I have that code around anymore, at least I can't find it now. And it's been a while. Here is what I remember: Basically you use VirtualAllocEx()
by dark-star 5y ago
I don't think I have that code around anymore, at least I can't find it now. And it's been a while. Here is what I remember:
Basically you use VirtualAllocEx() to allocate some memory in the remote thread. The returned pointers are in the context of the target process.
You can access that remote memory with ReadProcessMemory() and WriteProcessMemory(), which uses those "remote" pointers to copy data to/from your process.
You can then use these memory areas to pass global handles and other stuff around.
For accessing the actual password field data, you use standard Window-Messages with SendMessage() etc.
- mwcampbell 5y agoSome Windows screen readers used, and maybe still use, the same technique to get data out of the SysListView32 common control, since the parameters and results of that control's window messages aren't marshaled by the OS. Edit: Looks like NVDA still does. https://github.com/nvaccess/nvda/blob/master/source/NVDAObjects/IAccessible/sysListView32.py https://github.com/nvaccess/nvda/blob/master/source/NVDAObje...
- heinrich5991 5y agoPermanent link (press 'y' anywhere on Github): https://github.com/nvaccess/nvda/blob/b5f82f878f344ab26004f39a291da5d65a57efb0/source/NVDAObjects/IAccessible/sysListView32.py https://github.com/nvaccess/nvda/blob/b5f82f878f344ab26004f3....
- unnouinceput 5y agoThis technique is a classic one. I remember learning about it in late 90's after I got infected with a malware that hid itself from Task Manager. That made me also write my own Task Manager. To this day (Win10/Win11) you can hide your program from Task Manager using this technique and any malware that respect itself does it.