Skip to content

Commit

Permalink
Update CodeInjection.md
Browse files Browse the repository at this point in the history
Co-Authored-By: Soccerfan <108690435+wilders-soccerfan@users.noreply.github.com>
  • Loading branch information
offhub and wilders-soccerfan committed Dec 4, 2023
1 parent ce4cf21 commit 3882392
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion Content/CodeInjection.md
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ At this point the top portion of the `data->syscall_data` before the `SBIELOW_EX

The function than finds the addresses of `LdrLoadDll`, `LdrGetProcedureAddress`, `NtRaiseHardError` and `RtlFindActivationContextSectionString` using a custom `FindDllExport` lookup function by parsing through the previously selected ntdll image, these addresses are stored into the `INJECT_DATA` region, then a couple values from the `SBIELOW_EXTRA_DATA` are also copied into that region, containing paths to the SbieDll.dll (both 32 and 64 bit paths), as well as the name of kernel32.dll.

On 64-bit systems the function distinguishes between the native and the wow64 execution, in the latter case branching of to `InitInjectWow64`.
On 64-bit systems the function distinguishes between the native and the wow64 execution, in the latter case branching off to `InitInjectWow64`.
In the native case it continues with hooking the `RtlFindActivationContextSectionString` function in the ntdll.dll.
* An original copy of the functions begin is first saved to the `INJECT_DATA` structure
* The address of the structure is written into the detour function which is implemented in assembler.
Expand Down

0 comments on commit 3882392

Please sign in to comment.