Search options

Hi,

I've couple busy days. Here're the archived samples:

collection-17.08.2011-p3.rar
57.0 MB
[Register or log in to view the URL]

collection-17.08.2011-p4.rar
66.9 MB
[Register or log in to view the URL]

Yep, he's looking for a solution to just inject the code inside another process to intercept/hook the creation of another process.

Speaking about hiding from rk unhookers, hiding the hooks from kernel-mode from ring3 is 100% impossible due to the fact there's no way to neither forging memory nor forge false file content for a ring3 application. The only way to prevent kernel mode based antirootkit from usermode based app is to prohibit them to load their drivers ( via hooking, monitoring creating file/writing file and some other hardcore methods but it will take too long to mention them there ).

crim, do you have ICQ?

There're tons of ways to globally hook processes and newly created process. Which mode do ur process prefer to run? Kernelmode or usermode?

From kernelmode, one could use process notification callback routine to monitor which processes is created/terminated so he could inject code into those. Several topic related to this has been discussed for years. You can google for "process notification callback" and "Apc usermode injection". Or you can use 3rd party app to simplify the development such as madCodeHook.

From usermode, you can use DLL injection ( via many ways ). Again, just google for that term.

Hi,

Thanks a lot for your support. Here's today archive:

[Register or log in to view the URL]