Skip to content

Close monitor mode dumps codechunks from ProcessDump injections #4

@glmcdona

Description

@glmcdona

Process Dump hooks NtTerminateProcess and injects a executable region used to handle the hook. When Process Dump then dumps this process on terminate, it will find it's own executable region added for the hook and dump it as a codechunk. Ideally, we wan't to ignore Process Dump's own injections.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions