View Single Post
  #2  
Old 05-11-2017, 08:15
H4vC H4vC is offline
Friend
 
Join Date: Jan 2017
Posts: 32
Rept. Given: 0
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 3
Thanks Rcvd at 20 Times in 11 Posts
H4vC Reputation: 1
Afaik that only works for .net window handles I'm working on a piece of proprietary software that implements an Obregister callback to block handle creation to the target software so I'm trying to hijack an already existing handle (csrss.exe) to do my read and write operations on the target. I'd rather not write driver code that I then have to get signed just to patch said program. So I think a good option from userland would be to hijack an existing handle.

Thanks anyways for the articles.

Edit:
Apparently if a process has VMREAD and VMWRITE rights I do not need to open a new handle I can just use the existing handle as if I had opened it, I ended up writing an injectable dll that does the reading and writing for me, thanks for the help either way Techlord.

Last edited by H4vC; 05-13-2017 at 01:37.
Reply With Quote