top of page
Search

Hooking CreateProcess()

GameDestroyer1337

Updated: Aug 31, 2021

DEBUG_ONLY_THIS_PROCESS 0x00000002

The calling thread starts the new process. It receives all of the debug events using the WaitForDebugEvent function. CreateProcess's argument is dwCreationFlags it can be DEBUG_ONLY_THIS_PROCESS or the DEBUG_PROCESS


DEBUG_PROCESS 0x00000001

The thread starts and debugs the new process and all processes created by the process. It can receive related debug events using the WaitForDebugEvent function. A process that uses DEBUG_PROCESS is the root of a debugging chain. This continues until other processes in the chain is created with DEBUG_PROCESS. If this flag is combined with DEBUG_ONLY_THIS_PROCESS, the caller debugs only the new ones, not any child ones.


The lpProcessAttributes argument also takes a pointer to a SECURITY_ATTRIBUTES structure which may define special security permissions for the created process as well.


I would detour CreateProcess & log the arguments to find out if either of these is being used.

Last thought is, they registered their own debugger to prevent from attaching their own, sounds like a good trick to stop debuggers.

 
 
 

Recent Posts

See All

Comments


Subscribe Form

Thanks for submitting!

©2023 by FlashTrade. Proudly created with Wix.com

bottom of page