Exit Process...

[szymek111]

Can someone give me a tip how to hook ex ExitProcess ?? Can i do this in _asm ?

[qkuh]

MS Detours

[szymek111]

But i want to make it in dll .

[Padmak]

What do you want to approach with your hook? When ExitProcess is called the process has already released all of its handles and resources, so you cannot prevent a process from closing with only hooking ExitProcess

Padmak

[MrSm!th]

Originally Posted by szymek111

But i want to make it in dll .

Still MS Detours.

[szymek111]

I want to prevent olly from being detected by xtrap.

[​Tension]

That wont work with hooking ExitProcess.
You have to create a Bypass for that.

[MrSm!th]

Well, it helps analyzing the protected process statically (as the others said, it won't be able to run anymore, but stays frozen), but you have to hook more possible exit points for that (TerminateProcess for example).
And I'm **** sure you won't be able to attach olly anyway, because it also restricts access to the process.

[szymek111]

I know how to make xtrrap bypass i have xtrap driver static adress and also i need to hook K32EnumProcesses .

[MrSm!th]

You shouln't have any problems then.

[szymek111]

My problem is that i don't know how to hook them . I need a example . Because i never hooked winapi .

[Padmak]

What about "MS Detours" do you not get?

Padmak

[szymek111]

I get.. ..

[MrSm!th]

There are dozens of tutorials on the internet, even on this board.

[Brendan Jordan]

Originally Posted by MrSm!th

There are dozens of tutorials on the internet, even on this board.

This for example