Cheat Engine

[qpp]

Hello,

Could somebody clarify me the concept of inline function hooks. I am having hard time understanding how application specific function hooks work (for example the ones created by madCodeHook).

My understanding is that the code section is shared, so how can the ntdll!ZwOpenProcess be different for two applications that both load ntdll.dll (in my understanding a change to the code section of ntdll.dll loaded into memory should be reflected to all apps that load ntddll [IAT hooking is not used])? Or in other words, I have an application that uses ZwOpenProcess: once a hooking DLL is loaded into the program space, debugger shows an inline jmp when disassembling ntdll!ZwOpenprocess. Once the hooking DLL is unloaded (the detach includes the hook cleanup code) the ZwOpenProcess no longer contains the inline jmp.

[Flyte]

System DLLs do share the same space in physical memory, but due to the wonders of virtual addressing it can be treated as copy-on-write memory. i.e. you make a change in your address space, and the changed page is first copied, an then written over. The OS does this to save space, while still allowing changes to only affect the local address space. Another thing I should point out: Changing an application in memory does not change the application on disk.

Of course, this doesn't apply to applications that reside in kernel-land. There is no copy-on-write there, and a change there will affect every single process.

[Dark Byte]

It does affect kernel-land application, but if you suppress the read-only attribute of the copy-on-write pages the copy-on-write routine never gets called.
By default the read only flag is respected in kernelmode though, unless someones driver is so stupid to reset the RW bit in CR0 and doesn't turn it back on