All Questions

Tagged with
Filter by
Sorted by
Tagged with
1
vote
1answer
217 views

VirtualProtect failed to revert protections on mrdata section of ntdll, why?

i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
3
votes
1answer
428 views

Do all drivers exist in Kernel mode?

I'm in the process of learning the Windows API and reversing in general, so I apologize if this is a fairly dumb question. After reading a section of 'Practical Malware Analysis' discussing the ...
1
vote
0answers
179 views

Scanning memory accessed by a DLL

I would like to scan (or alternatively dump) memory that a DLL accesses while it's running. Scanning the application's (EXE) memory is not feasible (too large), and the DLL needs the application to ...