Dailydave mailing list archives
Re: Api hooking papers ?
From: Blue Boar <BlueBoar () thievco com>
Date: Wed, 05 Jan 2005 11:14:47 -0800
Nicolas RUFF wrote:
On Windows XP SP2, download the debug symbols for ws2_32.dll and look for CheckForHookersOrChainers(). This function will match GetProcAddress() results against all functions defined in the apfns[] array ...
On the other hand, so far all of the XP SP2 dlls I've looked at so far have left room at the beginning of each function for a couple of JMPs, which would making hooking that much easier if you switch techniques. I haven't checked ws2_32.dll specifically, yet.
BB _______________________________________________ Dailydave mailing list Dailydave () lists immunitysec com https://lists.immunitysec.com/mailman/listinfo/dailydave
Current thread:
- Re: Api hooking papers ? Nicolas RUFF (Jan 05)
- Re: Api hooking papers ? Blue Boar (Jan 05)