[iSam]

64 bit injection into explorer.exe

[img]http://i36.[censored].com/2likcpy.png[/img]

[birdy9]

tested it my self.

now awaiting brix to be shat by all the HF children.

[babyvamp666 ♥]

what are you trying to prove that you coded a 64 bit runpe? oh really nice (sacarism).

[superpriv5]

ITT: VB.NET and it's skid learners.

[masterjippo]

Is that code injection ? (inserting just a function)
or PE injection? (exe, dll) (and which)
also, is it a createprocess, unmap & remap new, or 2 PE's into same process?
lang?

[iSam]

ITT: VB.NET and it's skid learners.

ITT: skids that think i code in VB

Is that code injection ? (inserting just a function)
or PE injection? (exe, dll) (and which)
also, is it a createprocess, unmap & remap new, or 2 PE's into same process?

Its code injection into explorer.exe. I saw no previous examples of this.

---

Wait what's so special? A runpe was released with 64 bit injection a while back

Lol. Thats not injection at all, just memory execution. Also, if it has a parameter for injection, DEP will stop it anyway. This is DEP bypass.

[wacked2]

Uhm so what?
it´s like the normal way just:
Compiling in x64
VirtualAllocEx(..,PAGE_EXECUTE_READWRITE) (DEP bypass super pri8)
?
or did there is just ONE extra step?

[crimepack]

you are compiling in x64 mode lol its nothing special with that

to inject from 32bit to 64bit process is the hard part, this is still achievable by breaking out of wow64 environment in to a native x64 environment but this is certainly not what you did

so what you just proved is that you just figured out that you could compile your exe as x64 (which wont run on 32bit systems) so this thread is more of a fail rather than you getting the e-rep you wanted

when did you start coding C++ anyways? i thought you were one of those VB nuthuggers

[babyvamp666 ♥]

you are compiling in x64 mode lol its nothing special with that

to inject from 32bit to 64bit process is the hard part, this is still achievable by breaking out of wow64 environment in to a native x64 environment but this is certainly not what you did

so what you just proved is that you just figured out that you could compile your exe as x64 (which wont run on 32bit systems) so this thread is more of a fail rather than you getting the e-rep you wanted

when did you start coding C++ anyways? i thought you were one of those VB nuthuggers

True, but still you can find the Drive & if Progam Files(x86) Exicts its 64 bits else 32 bits so is how i do it but sometimes it fails ;(

[crimepack]

True, but still you can find the Drive & if Progam Files(x86) Exicts its 64 bits else 32 bits so is how i do it but sometimes it fails ;(

its pretty easy to determine if its executed on a x64 system or not, still i don't get your point what you are trying to say though

[babyvamp666 ♥]

its pretty easy to determine if its executed on a x64 system or not, still i don't get your point what you are trying to say though

64 bits sys have Progam Files (x86) and 32 bits not.

E: Maybe not on XP but on vis/seven.

[Squirtle]

what are you trying to prove that you coded a 64 bit runpe? oh really nice (sacarism).

Some nice sacarism you got there,

[CppSean]

So what you trying to get at bro?

[crimepack]

64 bits sys have Progam Files (x86) and 32 bits not.

E: Maybe not on XP but on vis/seven.

yeah i'm aware of that, but how is your response related to my reply at all?

[iSam]

I wasn't trying to get e-rep at all, and I told multiple people it was easy but they didn't believe me, so I posted here. Don't get butthurt. Also to detect 64 bit systems all u gotta do is detect WOW64. GetProcAddress(GetModuleHandle("kernel32.dll"), "IsWow64Process");

---

you are compiling in x64 mode lol its nothing special with that

to inject from 32bit to 64bit process is the hard part, this is still achievable by breaking out of wow64 environment in to a native x64 environment but this is certainly not what you did

so what you just proved is that you just figured out that you could compile your exe as x64 (which wont run on 32bit systems) so this thread is more of a fail rather than you getting the e-rep you wanted

when did you start coding C++ anyways? i thought you were one of those VB nuthuggers

Broseph half these fucks didn't even believe it was possible. Also I haven't coded in VB for a long ass time, only delphi + C/C++ now. I would just use a 32 bit executable to determine whether its being run in a 32/64 bit system then either execute a processes which injects into 32 bit explorer or 64 bit explorer.