A forum for reverse engineering, OS internals and malware analysis 

Search found 10 matches

 Go to advanced search

some anti-malware software use hypervisors and EPT to hide their hooks at least on Win 10 x64, i still not saw none antivirus product hooking the SSDT tables. Instead, they are using dll injection by monitoring process creation. Sincerely i think that SSDT/SSSDT Hooking (to x64 Windows) today not i...

Re: C to Delphi: How take screenshot in Z-Order using PrintWindow api?

 by pointer ¦  Sat Apr 27, 2019 7:34 pm ¦  Forum: User-Mode Development ¦  Topic: C to Delphi: How take screenshot in Z-Order using PrintWindow api? ¦  Replies: 3 ¦  Views: 1034

Why do you get a screenshot at all? Nevertheless, your problem is in EnumWindowsTopToDown as you translated it incorrectly. The function is only left when the following condition is true: while (proc(currentWindow, param) && (currentWindow = GetWindow(currentWindow, GW_HWNDPREV)) != NULL); The idea...

C to Delphi: How take screenshot in Z-Order using PrintWindow api?

 by pointer ¦  Fri Apr 26, 2019 11:59 pm ¦  Forum: User-Mode Development ¦  Topic: C to Delphi: How take screenshot in Z-Order using PrintWindow api? ¦  Replies: 3 ¦  Views: 1034

I'm trying translate a C code that is able of take screenshot in Z-Order but after translate this code practically equals to original (C), on Win 7 i'm getting black screenshot, on Win 10 only desktop is printed. How fix this? Here is the C code: #include "stdafx.h" #include <Windows.h> #include <gd...

I have the following code able to hook EnumWindows () function and works fine. But target application (3rd's application) crash when the dll is injected. Then this could be solved, for example, making this code prevent the target application enumerate only all windows of my software and then call or...

What does the code look like which spawns the VCL app from the service? The VCL app might have issues with the user environment. Post your code for executing the VCL app from the service, I assume in the service you're using CreateProcessAsUser() or similar? * Basically, ShellExecute() isn't an API...

I have a simple Delphi VCL form app that is executed in the NT AUTHORITY\SYSTEM account via a service app . I have a batch file that will finalize the service and VCL processes and then delete the EXE files.. To execute the batch file, I'm using ShellExecute() : procedure TForm1.Button1Click(Sender:...

Patchguard in win7 doesn't check some areas. As far as I remember inline hooking of win32k table was used by sandboxie before. Microsoft closed this in Win8. http://www.kernelmode.info/forum/viewtopic.php?f=14&t=2416 As for your links: 1) https://stackoverflow.com/questions/20552300/hook-zwterminat...

Today i saw that Kaspersky Antivirus still hooks SSSDT (Shadow Table) on Windows x64.

Tested: Kaspersky Total Security 2018
Enviroment: Windows 7 Ultimate x64

How this is possible? Is a special bypass? or simply Microsoft created a exception to make this (they)?

I already saw in several Questions/Answers in some foruns that says that not is possible write to any SSDT tables no Windows x64 here, are some: * Hook ZwTerminateProcess in x64 Driver (Without SSDT) * Is there a kernel-mode callback for LdrLoadDll? * Kernel Patch Protection ------------------------...

Exists rootkit's that call a routine of dll injection inside of callback configured in PsSetCreateProcessNotifyRoutineEx when they detect process creation, then if I (in ring 3) use a Tls callback where is executed a inline hook in LdrLoadDll function for example, this will be able to prevent the dl...