Login Register






Thread Rating:
  • 0 Vote(s) - 0 Average


USD Wiper with DoD 5220.22-M filter_list
Author
Message
RE: USD Wiper with DoD 5220.22-M #12
Might be too late to write but windows stores process ids and thread ids as HANDLE even tho WINAPI uses ULONG ? So here is misuse of HANDLE and there is size difference ?

Code:
typedef struct _CLIENT_ID {
  HANDLE UniqueProcess;
  HANDLE UniqueThread;
} CLIENT_ID;

There is a lot of misuse i have seen, I just remembered this, and also HMODULE is ignored and threated as PVOID in most internal structures, and PE executables are threated as DLL's. LDR_DATA_TABLE_ENTRY is perfect example, LDR_DATA_TABLE_ENTRY is a list that stores information of all libraries and the current executable, The base address and name is stored as

Code:
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;

EDIT: I might delete this whole post, this is never ending spam mess
(This post was last modified: 04-30-2019, 04:57 PM by IsBadWritePtr.)

Reply





Messages In This Thread
USD Wiper with DoD 5220.22-M - by IsBadWritePtr - 04-27-2019, 08:26 PM
RE: USD Wiper with DoD 5220.22-M - by 0xDEAD10CC - 04-28-2019, 08:06 PM
RE: USD Wiper with DoD 5220.22-M - by 0xDEAD10CC - 04-29-2019, 06:02 AM
RE: USD Wiper with DoD 5220.22-M - by 0xDEAD10CC - 04-29-2019, 06:21 AM
RE: USD Wiper with DoD 5220.22-M - by 0xDEAD10CC - 04-29-2019, 05:15 PM
RE: USD Wiper with DoD 5220.22-M - by 0xDEAD10CC - 04-29-2019, 07:49 PM
RE: USD Wiper with DoD 5220.22-M - by IsBadWritePtr - 04-30-2019, 04:47 PM
RE: USD Wiper with DoD 5220.22-M - by 0xDEAD10CC - 05-01-2019, 12:06 AM



Users browsing this thread: 1 Guest(s)