Page 1 of 1

Inject code

Posted: Wed Feb 01, 2012 2:04 pm
by PeterBotes
Hi,

if you inject a block of memory into a process does the process clean it up on exit or do you have to deal with this?

Code: Select all

CodeAddress.l = VirtualAllocEx_(hprocess, 0, 2000, #MEM_COMMIT, #PAGE_READWRITE)
Also what is the best way to detect a process has terminated?

I use this bit of code to get the processID

Code: Select all

ProcessFound = CallFunctionFast(ProcessFirst, Snapshot, Process)
While ProcessFound
  PID = Process\th32ProcessID
  hProcess = OpenProcess_(#PROCESS_ALL_ACCESS, 0, PID)
Thanks

Pete.

Re: Inject code

Posted: Thu Feb 02, 2012 1:05 am
by PeterBotes
Have I worded this post badly? does it make sense, what I am asking?

Pete.

Re: Inject code

Posted: Thu Feb 02, 2012 11:14 am
by xorc1zt
if you inject a block of memory into a process does the process clean it up on exit or do you have to deal with this?
yes windows delete the virtual memory that's why you doesn't need to call functions like FreeImage or FreeModule when you close the process.

http://msdn.microsoft.com/en-us/library ... s.85).aspx

to know if the process has terminated you could use GetExitCodeProcess

http://msdn.microsoft.com/en-us/library ... s.85).aspx

Re: Inject code

Posted: Thu Feb 02, 2012 2:34 pm
by PeterBotes
Thanks yet again xorc1zt for the help :D

Pete