Skip to main content
3 votes

How to simulate responses from the file system

I think the best approach would be to redirect the relevant function calls to a dummy functions that "spoof" a file system. You'd probably be interested in modifying the executable's import table.
Amit Eyal's user avatar
  • 131
3 votes

Unable to attach into mysterious PID

It's not a malware. It's cygwin's ssh-agent and it uses non existent PID as parent. I was able figure this out using a new version of ProcessHacker.
jeffbRTC's user avatar
  • 161
2 votes

Force debug Administrator Malware

Some ideas: Try using Image File Execution Options registry key to automatically run the debugger when the process starts. Patch an infinite loop (EB FE) at the entry point, start the binary, then ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes

possible to get reference assembly address in file for special memory address?

When you are using Process Hacker to find strings, you will look at a running process. Process Hacker iterates over the mapped parts of the processes virtual memory and tries to parse everything it ...
Nordwald's user avatar
  • 2,906
1 vote

How to get thread start address in Windows?

Like I Commented this function is documented in winternl.h and you can use ntdll.lib to link with also start address being a pointer will need 8 bytes in x64 #include <windows.h> #include <...
blabb's user avatar
  • 16.4k
1 vote

Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?

I'm having the same problem for a long time and had lots of investigation on this matter. In older Delphi compilers this problem don't exist and as your mentioned it is due to some API's being ...
Vahid Nasehi's user avatar
1 vote

How to simulate responses from the file system

user578368's answer is correct, but to be more specific: (assuming that you are using Windows) you need to capture/detour the CreateFileA and CreateFileW function pair. They are the ones that programs ...
Shmuel Fomberg's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible