#include <winternl.h> <-- fetch this .h from winecvs those who dont have this (bcb free commandline users like me) NTSTATUS (WINAPI *ntdll_NtQueryInformationProcess)(HANDLE,PROCESSINFOCLASS,PVOID,ULONG,PULONG); now thats not correct by standards but the hacks work :) PROCESS_BASIC_INFORMATION pbi; now actual code (its ollydbg plugin based but you can easily strip the unwanted and modify it to suit the needs if (debev.u.Exception.ExceptionRecord.ExceptionAddress == ntdll_DbgBreakPoint) { *(FARPROC *)&ntdll_NtQueryInformationProcess = GetProcAddress(Dll_Handle,"NtQueryInformationProcess"); if(ntdll_NtQueryInformationProcess == 0) { MessageBox(hwmain,"error","GetProcFailed",MB_OK); return 0; } pid = Plugingetvalue(VAL_PROCESSID); debproc = OpenProcess(PROCESS_ALL_ACCESS,FALSE,pid); ntdll_NtQueryInformationProcess(debproc,ProcessBasicInformation,&pbi,sizeof(pbi),NULL); status = pbi.PebBaseAddress; (byte *)status += 0x68; VirtualQueryEx(debproc,status,&mbi,sizeof(mbi)); VirtualProtectEx(debproc,mbi.BaseAddress,mbi.RegionSize,PAGE_EXECUTE_READWRITE,&lpOld); ReadProcessMemory(debproc,status,&dlah,4,NULL); elah = (long)dlah; elah |= 0x02; WriteProcessMemory(debproc,status,&elah,4,NULL); the above code modifies a remote processes GlobalFlag peb->+0x68 to OR LDR_SHOW_SNAPS
There are 31,316 total registered users.
[+] expand
Printer Friendly ...
![[+] expand](/imagery/files/soysauce_blueprint.gif){kind=link}