You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
would be nice to have the possibility to hollow out a x64 process from a x86 Dinvoke assembly.
The only way to do that ( I think) would be to spawn a new x64 processes and obtain a valid handle to it from x86 land
The text was updated successfully, but these errors were encountered:
Are you wanting to run arbitrary 64-bit executables in WOW64 processes? I agree that that would best be handled via a fork-run methodology such as process hollowing. It might be possible to do that within the current process via jumping through Heaven's Gate / manually handling WOW64 transition and loading 64-bit copies of all of the payload's dependencies.. However... that would add a lot of complexity that I don't really want to add to the scope of this project. I don't see the cost worth the benefit for this project.
In the meantime, I would rather recommend that someone just load the 32-bit version of a binary if it is available. If not, injecting the binary (or a loader such as DInvoke and passing it the binary) would work as an alternative.
would be nice to have the possibility to hollow out a x64 process from a x86 Dinvoke assembly.
The only way to do that ( I think) would be to spawn a new x64 processes and obtain a valid handle to it from x86 land
The text was updated successfully, but these errors were encountered: