Hooking WMI (.NET Application)

[aldente]

Yes, I am on a x64 system...

I just tried the loader you mentioned in a virtual machine (x86), but without any success either...

newloaderv4.1.exe --lib WmiSpoof_x86_StaticRuntime.dll --launch Test.exe

The loader starts Test.exe, but the loader console window stays open (nothing is shown after "Email: [email protected]").
When I close Test.exe, the loader outputs:

Error: [@InjectLibraryW] Unknown Error (LoadLibraryW).
Error: [@SuspendResumeProcess] NtResumeProcess. [NtStatus: 0xC000010A] [LastErro
r: 6]
Error: [@InjectLibraryW] Could not resume process.
Error: [@commandline_parser] Injection failed.

How did you build your DLL?
I built it Non-Unicode with static runtime ('release' mode) with MSVC 2010.
I tried other options as well, neither worked (dynamic runtime, Unicode).

Does my attached DLL work for you?

(Thanks for your patience, by the way!)