Armadillo 6.04 Public
My Observations so far:
JMP <ModuleEntrypoint> patch (EB FE) doesn't make it to the child process from the first WriteProcessMemory call.
My custom spin on the DebugActiveProcessStop patch now causes a crash
Code:
PUSH %PID%
CALL DEBUGACTIVEPROCESSSTOP
JMP EIP <-- CAUSES WINDOWS TO DUMP ARMADILLO MEMORY VIA WATSON
Haven't actually made it into the child process yet, back to the tutorials.