Search found 1 match

by pointer
Wed Nov 28, 2018 12:29 pm
Forum: User-Mode Development
Topic: Tls callback (Ring 3) executes first that a callback configured in PsSetCreateProcessNotifyRoutineEx (Ring 0)?
Replies: 0
Views: 192

Tls callback (Ring 3) executes first that a callback configured in PsSetCreateProcessNotifyRoutineEx (Ring 0)?

Exists rootkit's that call a routine of dll injection inside of callback configured in PsSetCreateProcessNotifyRoutineEx when they detect process creation, then if I (in ring 3) use a Tls callback where is executed a inline hook in LdrLoadDll function for example, this will be able to prevent the dl...