|
-
Sep 4th, 2005, 01:02 PM
#3
Thread Starter
Lively Member
Re: VB6 - Process injection/API hooking
Perhaps you could explain a little bit more about what you are doing here
I'm afraid of writing long messages, not so much practice in writing English 
Because of the runtime.
Almost every function you use (like the left/right/mid functions) is stored in the runtime,
but I guess, you know that.
When starting a VB app, the runtime does some stuff I don't really know about, which won't allow you to use these functions in a new thread (sure, with some tricks you can, but they're not safe, At least in a standard exe).
You could inject the VB runtime into the other process, but there's the risk that the address space is already used by another module.
But even if it worked - it wouldn't be initialized.
So what I did in example 3 was:
1) Overwrite the remote function with a JMP instruction
2) inject my own module to the remote process
but don't execute code with CreateRemoteThread
because it will executed in the first thread when the hooked API will be called.
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
Click Here to Expand Forum to Full Width
|