N-InjectLib and N-CodeHook simple example
Simple example is appreciated. Right now I am trying to figure out something from IDA Stealth, but what I really want is:
1) create suspended proccess from my application
2) inject dll which has detour function inside of it
N-InjectLib and N-CodeHook simple example
I'll see what I can do and update the projects as soon as I've some spare time.
Best regards
Jan
Thanks for quick reply! I've
Thanks for quick reply!
I've wrote some test example, and it seems to be working.
Looks like I can not attach anything at this forum (I mean code) :)
Actually I am new to this "injection-hooking" stuff and have some questions.
What is expetected value for fuction IATModifier::setIBA? Is it address of import table in the process? Is it OK to use autosearch for this thing?
N-InjectLib and N-CodeHook simple example
setIBA is used to set the image base address of the process you want to inject into. Autosearch is still a "todo" for now.
You can use geshi syntax to add code to your post (remove underscores):
<___geshi type="cpp">
int main()
{
return 0;
}
<___/geshi> "
This is my simple test. It
This is my simple test. It works, though I used the autosearch for the image base address. What problems may I have with current implementation of autosearch? Is everything OK with the example?
The dll:
The application:
N-InjectLib and N-CodeHook simple example
Hi Okko,
your example looks good. However, as I said the autosearch feature hasn't been thoroughly tested.
If this method works for you, it's fine. However, you need to be aware of the fact, that the code in
findImportDescriptorwill fail if there is a page with e.g. thePAGE_NOACCESSattribute before the image base address.I will add a more reliable method in the next version of the library.
N-InjectLib and N-CodeHook simple example
The library has been updated, which fixes this issue. A simple example is also included.
Great news! Thanks for such a
Great news! Thanks for such a nice tiny lib! I will continue using it, so be aware of bug reports :)