ulysse31 Master Cheater
Reputation: 2
Joined: 19 Mar 2015 Posts: 324 Location: Paris
|
Posted: Thu May 19, 2016 8:22 am Post subject: |
|
|
| ParkourPenguin wrote: | | Code: | alloc(newmem,2048)
createthread(newmem)
newmem:
mov eax,[address1]
mov [address2],eax
push 10
call kernel32.Sleep
jmp newmem |
Besides that, you're going to need to give more information. Do you have a static pointer to these addresses? Can you find an instruction that only accesses these addresses? |
Isn't there a risk that the thread starts and executes faster than CE would write the newly allocated memory ?
Shouldn't it be better to use this code
| Code: | alloc(newmem,2048)
newmem:
mov eax,[address1]
mov [address2],eax
push 10
call kernel32.Sleep
jmp newmem
createthread(newmem) |
or is the thread created only after all the instructions have been written anyway ?
|
|