Code Injection

[xobor]

so you have to wrote some kind of debugger, start app via createprocess and then in loop do WaitForDebugEvent, after start you can set bp at code location where loader writes unpacked section of code to memory, look if written unpacked code is what you are waiting for and if it is, you can patch code in memory, unset bp and let your app run.

maybe this helps

xobor it helps ... but that "look if written unpacked code is what you are waiting for" is kind of frightening.

yaa

[xobor]

hehe sorry for my ?English?

I mean that if you know you want to change e.g. 3B46FA7403 to 8B46FAEB03 you can wait in your debugee code for unpacking to 3B46FA7403 and then change it.

I can't explain it better so if it is not clear enough forget about it.

regards

Clear enough. Thx.

yaa