|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: [Dailydave] Api hooking papers ?
From: Blue Boar (BlueBoar
thievco.com)
Date: Wed Jan 05 2005 - 13:14:47 CST
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Nicolas RUFF wrote:
> On Windows XP SP2, download the debug symbols for ws2_32.dll and look
> for CheckForHookersOrChainers(). This function will match
> GetProcAddress() results against all functions defined in the apfns[]
> array ...
On the other hand, so far all of the XP SP2 dlls I've looked at so far
have left room at the beginning of each function for a couple of JMPs,
which would making hooking that much easier if you switch techniques. I
haven't checked ws2_32.dll specifically, yet.
BB
_______________________________________________
Dailydave mailing list
Dailydavelists.immunitysec.com
https://lists.immunitysec.com/mailman/listinfo/dailydave
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]