Re: Vista's OV header



It looks like the main executable is already mapped. Knowing its base,
I can read out the PE header, find the process' entry point and then
patch in a jmp, all using Read/WriteProcessMemory. I saw the same
technique documented here:

http://qstuff.blogspot.com/2005/07/art-of-breaking-and-entering-thread.html

Arno

.



Relevant Pages

  • Re: [-mm patch] remove two OSS headers
    ... This patch removes two OSS header files that are obsolete after the ... I'll prepare a new package including the header in the package itself, ... * Voice information definitions for the low level driver for the ... * GNU General Public License for more details. ...
    (Linux-Kernel)
  • Re: [PATCH] dma-debug: disable DMA_API_DEBUG for now
    ... Subject: [PATCH] dma-debug: change hash_bucket_find from first-fit to best-fit ... Without an IOMMU this results in the same dma address being ... DMA-API: device driver frees DMA sg list with different entry count ... If the wrong entry gets returned on unmap, this can trigger bogus warnings about ...
    (Linux-Kernel)
  • 2.6.10-as5
    ... Lots of security fixes in here; it's probably a good idea to upgrade. ... Patch stolen from ubuntu. ... skb header corruption. ... struct, when it should be using a compat_cmsghdr struct, instead. ...
    (Linux-Kernel)
  • [PATCH] 2/4 move all invalidate_page outside of PT lock (#v9 was 1/4)
    ... This below simple patch invalidates the "invalidate_page" part, ... Then in .26 we'll modify the semantics of the API to be blocking ... pte_unmap_unlock(pte, ptl); ... update_mmu_cache(vma, address, entry); ...
    (Linux-Kernel)
  • Professional layout for a dictionary
    ... <specs for entry 1> ... Now, the task to accomplish is, to generate individual page headers, containing the chapter descriptors and depending on the chapter displayed on a certain page or a range of pages. ... E.g., if ranges from page 1 to 8, and chapter 2 begins on top of page 9, in the header of pages 1-8 should be written: ...
    (microsoft.public.access.reports)

Loading