targettttt How do I cheat? Reputation: 0
Joined: 03 May 2018 Posts: 1
|
Posted: Thu May 03, 2018 5:54 pm Post subject: Moving windows api into another memory space? |
|
|
If an .exe copy OpenProcess/NtOpenProcess or ReadProcessMemory/NtReadVirtualMemory into a new memory space, how would you find it to hook it?
Is it possible that the .exe make a copy of the address pointed by fs:[C0] into a new memory space and NtOpenProcess & NtReadVirtualMemory syscall goes there instead?
if so how would you find it?
Thanks!
|
|