There's more epic blog entries but I have to admit as a MURIKAN I am already too lazy to find them.
-
There's more epic blog entries but I have to admit as a MURIKAN I am already too lazy to find them. -
Re: Find the lulz
probably they discovered it recently and dont know,
dis teh same plus dll map not better.
btw amd64 does not compute.
gibs coins @
1KatP9B8KG7mvcoFhdLGua1isG88nYZE8C
-
Re: Find the lulz
tl;dr but it seems he's just covering shit that's old as fuck, I quickly checked other blog entries from him and nothing new under the sun
I DONT HAVE TEAMVIEWER AND IM NOT GOING TO GIVE ANY 24/7 ONLINE SUPPORT VIA STEAM, XFIRE OR OTHER IM PROGRAMS SO DONT BOTHER ASKING. THANKS.lolmaoman: Germans are born with a lifetime x22 login engraved into their birth certificates. True story.Comment
-
Re: Find the lulz
Oh noes, another weird thread O_o
Comment
-
Re: Find the lulz
when i read this thread for teh first time :
Comment
-
Re: Find the lulz
Hiding an injected dll was generally what I was shooting for. Notice how they talk of how to detect it. Rather than calling VirtualQueryEx on all memory and looking for SEC_IMAGE and then calling GetMappedFileName, and checking against LDR_MODULE entries in lists.
Other one you see no mention of VirtualQueryEx to check page protection. Then there's this nugget of gold:
I can't even begin to describe how useless that is.You may also want to change the VirtualSize of those sections of the victim process you used for injection in order to cover the injected code. Just adjust it in the headers in memory.Comment
Comment