Inject code

[PeterBotes]

Hi,

if you inject a block of memory into a process does the process clean it up on exit or do you have to deal with this?

Code: Select all

CodeAddress.l = VirtualAllocEx_(hprocess, 0, 2000, #MEM_COMMIT, #PAGE_READWRITE)

Also what is the best way to detect a process has terminated?

I use this bit of code to get the processID

Code: Select all

ProcessFound = CallFunctionFast(ProcessFirst, Snapshot, Process)
While ProcessFound
  PID = Process\th32ProcessID
  hProcess = OpenProcess_(#PROCESS_ALL_ACCESS, 0, PID)

Thanks

Pete.

[PeterBotes]

Have I worded this post badly? does it make sense, what I am asking?

Pete.

[xorc1zt]

if you inject a block of memory into a process does the process clean it up on exit or do you have to deal with this?

yes windows delete the virtual memory that's why you doesn't need to call functions like FreeImage or FreeModule when you close the process.

http://msdn.microsoft.com/en-us/library ... s.85).aspx

to know if the process has terminated you could use GetExitCodeProcess

http://msdn.microsoft.com/en-us/library ... s.85).aspx

[PeterBotes]

Thanks yet again xorc1zt for the help

Pete