RdpThief
RdpThief copied to clipboard
Issue hooking mstsc.exe on windows 10 1903
I compiled the DLL (RdpThief.dll) and injected it into mstsc.exe process. It is able to hook ADVAPI32!CredIsMarshaledCredentialW
but is unable to hook SSPICLI!SspiPrepareForCredRead
and dpapi!cryptprotectmemory
. I was able to verify this by attaching a debugger and looking at the assembly. Only the CredIsMarshaledCredentialW
function has jump into the loaded dll. Any pointers on how do I debug this issue or have you encountered this before?
Are some DLLs immune to hooking?