Hooking WMI (.NET Application)

		Exetools > General > General Discussion
Hooking WMI (.NET Application)

08-05-2012, 06:13

aldente

VIP

Join Date: Jul 2003

Posts: 266

Rept. Given: 27

Rept. Rcvd 7 Times in 5 Posts

Thanks Given: 36

Thanks Rcvd at 10 Times in 9 Posts

ResumeThread() has to be called with pi.hThread, that was right. The process will stay suspended, if you call it with pi.hProcess.
But apart from that, I tried your suggestions.

I also tried to start the process non-suspended, which doesn't work either...

This injection stuff is a debugging nightmare, you can't debug it in the development environment, and debugging in IDA doesn't work neither because of all this .NET stuff... :-(

Don't you have somer loader, which is known working for .NET applications?

« Previous Thread | Next Thread »

Thread Tools
Show Printable Version Email this Page
Display Modes
Switch to Linear Mode Switch to Hybrid Mode Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is Off HTML code is Off Forum Rules

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
.NET dll hooking	Avi_RE	General Discussion	10	09-28-2023 07:09
API Hooking	thomasantony	General Discussion	5	04-22-2005 11:44
API-hooking	MaRKuS-DJM	General Discussion	11	03-25-2005 13:27
C++ Help (Hooking a function)	Peter[Pan]	General Discussion	8	08-31-2004 20:37

All times are GMT +8. The time now is 00:34.