blackhat2012

blackhat2012 copied to clipboard

For this technique (3.5), the ProcessInformation (debugport) parameter is checked and not the value returned from NtQueryInformationProcess.

rscampos

Thank you for your useful samples. I found the following problems of your samples. - softice.ASM does not set a exception handler. And, Flat Assembler generates "icebp" from "int1" mnemonic....

yotuki