3 ms·
Oh all the lost arts from the past... My preferred method was manipulating IAT table (Import Address Table) where the code injected into process is hooking Cre
by stiray 4y ago
Oh all the lost arts from the past...
My preferred method was manipulating IAT table (Import Address Table) where the code injected into process is hooking CreateProcess and LoadLibrary (and similar) to further propagate injection into other processes/library spawned by current process(es) and using debug privileges to also inject into system processes (like login process on windows 2000, to survive logoff)
Anyway Microsoft Detours is the way to go, they actually modify the code of hooked function using trampolines, I don't think anything can be more efficient than that.
- omnicognate 4y agoLost? Past? The Windows world still runs on this stuff, and there are still plenty of people who know how it works and make money from knowing. That said, MS have unintentionally (I think) done a pretty good job of scrubbing the internet clean of useful information about it by breaking all their links multiple times. I keep a personal copy of some things, such as Matt Pietrek's classic two-parter "An In-Depth Look into the Win32 Portable Executable File Format", lest they disappear completely while the technologies they describe continue to run the world. Edit: MS only appear to have part 2 of that article in their archive, and it contains broken links (of course). Both parts can still be read at [1] and [2] and remain as relevant as they were the day they were written [1] https://bytepointer.com/resources/pietrek_in_depth_look_into_pe_format_pt1.htm https://bytepointer.com/resources/pietrek_in_depth_look_into... [2] https://bytepointer.com/resources/pietrek_in_depth_look_into_pe_format_pt2.htm https://bytepointer.com/resources/pietrek_in_depth_look_into...