diff options
| author | Toni Uhlig <matzeton@googlemail.com> | 2019-09-29 14:44:10 +0200 |
|---|---|---|
| committer | Toni Uhlig <matzeton@googlemail.com> | 2019-09-29 14:44:10 +0200 |
| commit | 89b400e414c29163d0219d9abc2189148fd34478 (patch) | |
| tree | 2d383e406da126cda724f7af01f283669dd2ab29 /Hunted | |
| parent | 955085e7ff3538a3e1bfc35f19670fb6c59b3ae7 (diff) | |
We need to unlink the VAD _after_ the MS CRT was initialized to prevent crashing the process.
Diffstat (limited to 'Hunted')
| -rw-r--r-- | Hunted/Hunted.cpp | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/Hunted/Hunted.cpp b/Hunted/Hunted.cpp index 8e1c157..4f003a5 100644 --- a/Hunted/Hunted.cpp +++ b/Hunted/Hunted.cpp @@ -337,9 +337,6 @@ class Vec3_tpl<float> size(12): PVOID targetAddr = (PVOID)(dll.GetBaseAddress()); std::wcout << "ADDRESS -> " << WHEXOUT << targetAddr << std::endl; - if (!ki.VUnlink(targetPID, targetAddr)) { - std::wcout << L"VUnlink failed" << std::endl; - } UINT64 globalEnvAddr = 0; for (MODULE_DATA& md : modules) { @@ -361,7 +358,7 @@ class Vec3_tpl<float> size(12): std::vector<SIZE_T> foundAddresses; pscan.Scan(md, "48 8B 48 20 48 8B 01 FF 90 20 01 00 00", foundAddresses); for (auto& addr : foundAddresses) { - std::wcout << "Addr: " << addr << std::endl; + std::wcout << "Addr: " << addr << ", Content: "; BYTE content[32]; KMemoryBuf::Rpm<sizeof content>(targetPID, (PVOID)addr, &content[0]); printBuf(content, sizeof content, 32); @@ -423,6 +420,10 @@ class Vec3_tpl<float> size(12): /* PATTERN: 48 89 4C 24 08 48 83 EC 48 +9 */ KMemoryBuf::Wpm<sizeof dd>(targetPID, (PVOID)((UINT64)md.DllBase + 0x70619), &dd[0]); #endif + Sleep(1000); + if (!ki.VUnlink(targetPID, targetAddr)) { + std::wcout << L"VUnlink failed" << std::endl; + } } #endif #if 0 |