A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #8769  by listito
 Tue Sep 27, 2011 9:26 am
There's something very strange going on, some dll(i believe a malware) seems to be injected into all processes, and when i'm using some programs sometimes it executes invalid instructions into the dll and crashes the program, and when i try to unload the dll it suddenly terminates the program, is there any way to know if there is some driver or something terminating my process?
 #9369  by listito
 Sun Oct 23, 2011 6:47 am
thanks, procmon gives me 2 (thread exit) the first one is weird and the call comes from ntdll.dll

the second one is interesting :

CALL DWORD PTR DS:[<&KERNEL32.GetQueuedC>; kernel32.GetQueuedCompletionStatus

from xul.dll, it's a firefox plugin i'm reversing and i want to prevent plugin-container.exe from being closed, if i set a breakpoint anywhere, it quits after some seconds, anyone could help me with that? maybe hooking this api call would be a solution?

BOOL WINAPI GetQueuedCompletionStatus(
__in HANDLE CompletionPort,
__out LPDWORD lpNumberOfBytes,
__out PULONG_PTR lpCompletionKey,
__out LPOVERLAPPED *lpOverlapped,
__in DWORD dwMilliseconds

i'm gonna try it :)