Fix bug that pd cannot use -closemon in 32bit windows7

glmcdona / Process-Dump

Windows tool for dumping malware PE files from memory back to disk for analysis.

http://split-code.com/processdump.html

MIT License

1.63k stars 261 forks source link

Fix bug that pd cannot use -closemon in 32bit windows7 #21

Closed LJP-TW closed 4 years ago

LJP-TW commented 4 years ago

In terminate_monitor_hook.cpp, add_redirect rewrites ZwTerminateProcess with 0x20 bytes, but there is a important API ZwTerminateThread beside ZwTerminateProcess, and add_redirect will mess up ZwTerminateThread.

This commit fixes this problem by rewriting ZwTerminateProcess only with a near jmp, which costs only 5 bytes.