Neo23x0 / Raccine

A Simple Ransomware Vaccine
The Unlicense
944 stars 122 forks source link

Hack to stop Image Execution Options invoking on the spawned version #2

Closed olliencc closed 3 years ago

olliencc commented 3 years ago

This is a nasty hack.

The correct way would be to use Windows internal APIs via this route: https://stackoverflow.com/questions/54453249/how-do-debuggers-bypass-image-file-execution-options-when-launching-their-debuge

However this way is the quicker, we basically

I've tested it in so much as it runs the process. You'll just need to double check it does bypass the image execution options.