Video

Great video as always, what i think would be really interesting is a video about networking internals of windows because i never found a lot of information about that. Ive read Windows internals 7th edition part 1 and am currently reading part 2 but there isnt anything about networking.

got to say the one thing I appreciate the most about all of what you are doing is the dedication to digging to the exact fact i need to see to verify what you're saying is true. windows makes that very hard.

Your registry tool is using old style look and feel scroll bars. Maybe you are missing the v6 common controls XML manifest?

Thank you for the great video. I am wondering if we need thread-synchronization especially for the wchar process name changed by the configurator process and used inside the compare function inside the .dll? Also what about memory barriers so that writes to pid and process name are actually flush the store buffer and can be observed by dll inside task manager? I'm a total noob on this and I am probably wrong. I would be grateful if you could add a short explanation why we don't need to care about these threading-problems in this case. Thanks a lot

can you use modular arithmetic for getting chunks?

Thanks.

Great video! Are you using an extension for syntax highlighting? If so, which one? Thanks!

Great content. Plenty to refer to in the future. Thanks!

Recently took the Rust class. You're genuinely a wizard. Absolutely brilliant work again.

Hello, how are you? I want to ask you how to load dll from byte array

Nice! I was thinking about C++ constexpr function converting from module name and function name to a hash. Then searching the module list and export list hashing each element and comparing it to pre-computed hashes. This way you hide the strings from anti virus and from offline analyzers. But no, Pavel ecrypted the whole thing. Nice. Possible red flag would be running code that is not mapped to any file (that modified pages after decryption).

Hi Pavel, Thanks for tutorials...But all your tutorial is injected to already running process.. How about Create new process and inject in to it? My current problem is create new progress (Ex Notepad) and inject to it..but sometime it work...sometime it dont...I dont know why...just assume dll injected when nodepad process not full loaded

Super explanation

Очень полезное видео, но не совсем понял один момент. Каким образом новый поток с точкой входа в функции GetProcAddress() заставляет в дальнейшем исполнить LoadLibraryA(dllpath)?

high quality content

My idea would be to split the work to fixed number of chunks, like 1024. Then spawn the same number of threads as I have number of processors. Or maybe add one or two threads more in case of some thread gets stuck on I/O for a while, so the extra threads could run in meantime. Then each thread would repeatedly take one work chunk form shared queue until the queue is empty. This is more work for the programmer, but I believe the CPU utilization will be more even. For example when the work items are part of image that needs to be processed in some way (ray casting). Or when converting video file. If some part of the image is solid color or if some part of video is still then the speedup would be still (close to) linear.

Thank you 4 ur videos

can ye spawn a new userinteractive session and then connect it to console?

Waht font are you using?

Can we expect videos based on NtAPIs instead of win32APIs ^_^ ?

Great! I learned and studied a lot from your 'Parent Process vs. Creator Process' blog post. That's a really cool code, but it would have been nice if you put the CREATE_NEW_CONSOLE flag in when calling the CreateProcess because the 0xC0000142 error occurs if the process you're trying to spoil is the console process. And some uwp apps, such as calc.exe, do not have this spoofing. Anyway, thank you so much for sharing that information through blogs and CZcams.

I am getting an error where it keeps saying hDll could be '0; this does not adhere to the specification for the function 'GetProcAddress'

pavel will you make a video on WTL in the future?

You the best ❤

Dude you explained some things I didnt know and ot really helped thanks. Most youtubers ignore some important details and itsannoying

yeaah new video.

Thank you

Very useful technique. Thank you for sharing!

Where I can get local offline Help for Winapi, such as in your video?

Great video, I was trying to learn what ETW is and couldn't really understand it without examples but this video helped me a lot! Thank you :)

Sir Pavel, I would like to ask what might be a silly question and it’s out of the context of this video ... How can I verify whether something exists or not, for example, a DWORD that I added in a specific registry path that affects a certain mechanism? Secondly, is there a possibility that, by default, it doesn't exist internally in the Windows kernel in some pert of code, but changes once the respective DWORD is added? (I’m new on this part so I apologise for any misleading)

Hello can anyone pls give a hint on what I'm doing wrong? I'm trying to open a handle to keyboard device, check if CAPSLOCK is on and if it's turn it off. Everything is working correct except the DeviceIoControl call to turn CAPSLOCK off. #include <Windows.h> #include <stdio.h> #include <ntddkbd.h> int main() { HANDLE hDevice = CreateFile(LR"(\\.\GlobalRoot\Device\KeyboardClass0)", GENERIC_WRITE, 0, nullptr, OPEN_EXISTING, 0, nullptr); if (hDevice == INVALID_HANDLE_VALUE) { printf("Error opening handle to file "); return 1; } KEYBOARD_INDICATOR_PARAMETERS inputBuffer; KEYBOARD_INDICATOR_PARAMETERS outputBuffer; ULONG DataLength = sizeof(KEYBOARD_INDICATOR_PARAMETERS); ULONG ReturnedLength; inputBuffer.UnitId = 0; outputBuffer.UnitId = 0; if (!DeviceIoControl(hDevice, IOCTL_KEYBOARD_QUERY_INDICATORS, &inputBuffer, sizeof(inputBuffer), &outputBuffer, sizeof(outputBuffer), &ReturnedLength, nullptr)) { printf("Error sending IOCTL "); CloseHandle(hDevice); return 1; } if (outputBuffer.LedFlags & KEYBOARD_CAPS_LOCK_ON) { printf("Caps Lock is ON "); // Turn off Caps Lock inputBuffer.LedFlags = 0x0; if (!DeviceIoControl(hDevice, IOCTL_KEYBOARD_SET_INDICATORS, &inputBuffer, sizeof(inputBuffer), nullptr, 0, &ReturnedLength, nullptr)) { printf("Error setting caps lock "); CloseHandle(hDevice); return 1; } } getchar(); CloseHandle(hDevice); return 0; } Another doubt is that I'm able to open this handle with GENERIC_WRITE permission but with GENERIC_READ it doesn't work, is this a security policy to avoid getting the keys pressed from user land? Where can I find the about device objects permissions?

Nice series :)

thank you.

Thank you.

nice. is the example on github?

thank you

I read the handle value from output of handle64.exe, I needed to use base 16 to get a valid handle. HANDLE handle = (HANDLE)(ULONG_PTR)strtol(strHandle.c_str(), nullptr, 16); Thank you for this video (and many others)!

dude thats cool, you should write a book or sth

Very Informative, thank you pavel!

trappo is you BIGGEST fan (in weight terms)

trappo is your biggest fan! Keep up the work

I hope you create another great videos

you're a life saver man thank you so much

Setting the memory as executable later (and as read,executable) (ie not at the same time as setting it RW) to try to avoid things noticing, was clever. Worth noting you have to be admin (or have debug privileges?) to do this injection etc

At 19:00 the ASLR address of loadlibrary in the target process is USALLY the same as in the program doing the injecting, ie common for the state of the system since the last reboot, but not guaranteed for certain dll's?