Detours icon indicating copy to clipboard operation
Detours copied to clipboard

sample trcapi32 not use DetourCreateProcessWithDll in CreateProcessAsUser

Open KnoooW opened this issue 5 years ago • 2 comments

As said in title, trcapi sample not use DetourCreateProcessWithDll in CreateProcessAsUser and CreateProcessWithToken.

process may escape from detours hook if they didn't create process with CreateProcessA/W

KnoooW avatar Dec 25 '19 06:12 KnoooW

It looks like there isn't an overload of the DetourCreateProcessWithDll* methods that would support these process creation overloads.

mwasplund avatar Jul 16 '20 14:07 mwasplund

Also CreateProcessWithLogonW

mwasplund avatar Jul 16 '20 14:07 mwasplund