hmmm... - Exetools

		Exetools > General > General Discussion
hmmm...

Thread Tools

Display Modes

08-10-2008, 00:30

D-Jester

VIP

Join Date: Nov 2003

Location: Ohio, USA

Posts: 269

Rept. Given: 39

Rept. Rcvd 61 Times in 41 Posts

Thanks Given: 0

Thanks Rcvd at 4 Times in 4 Posts

Armadillo 6.04 Public

My Observations so far:
JMP <ModuleEntrypoint> patch (EB FE) doesn't make it to the child process from the first WriteProcessMemory call.

My custom spin on the DebugActiveProcessStop patch now causes a crash

Code:

PUSH %PID%
CALL DEBUGACTIVEPROCESSSTOP
JMP EIP <-- CAUSES WINDOWS TO DUMP ARMADILLO MEMORY VIA WATSON

Haven't actually made it into the child process yet, back to the tutorials.

__________________
Even as darkness envelops and consumes us, wrapping around our personal worlds like the hand that grips around our necks and suffocates us, we must realize that life really is beautiful and the shadows of despair will scurry away like the fleeting roaches before the light.

« Previous Thread | Next Thread »

Thread Tools
Show Printable Version Email this Page
Display Modes
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is Off HTML code is Off Forum Rules

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Hmmm...	NetRanger	General Discussion	1	01-17-2002 06:06

All times are GMT +8. The time now is 23:28.