Thread: ScyllaHide
View Single Post
Old 09-08-2015, 02:09
Carbon Carbon is offline
Join Date: Sep 2013
Posts: 113
Rept. Given: 7
Rept. Rcvd 189 Times in 48 Posts
Thanks Given: 0
Thanks Rcvd at 58 Times in 18 Posts
Carbon Reputation: 100-199 Carbon Reputation: 100-199
Win10 has more surprises to offer:

I also see some weird behavior of NtQueryInformationProcess. You can query ProcessBasicInformation with different buffer sizes.

size = 24 -> normal behavior, expected size like in all windows editions
size = 32 -> extended information? You can get more information...
My blog:
Reply With Quote
The Following User Gave Reputation+1 to Carbon For This Useful Post:
Loki (09-08-2015)
The Following 4 Users Say Thank You to Carbon For This Useful Post:
besoeso (09-08-2015), elephant (11-15-2015), Loki (09-08-2015), Storm Shadow (12-11-2015)