Author: mxmauro
Subject: ZwSetInformationThread - Change Start Address
Posted: 24 February 2013 at 11:02pm
Although if you do a GetThreadContext, eax/rcx should contain the starting address, I recommend to take the value of eip/rip register, change it to point to your code and at the end, from your injected code, jump to the original eip/rip.
Subject: ZwSetInformationThread - Change Start Address
Posted: 24 February 2013 at 11:02pm
Hi,
This is because dll's initialization like .net's mscoree.dll changes the entrypoint on the fly.
Regards,
Mauro H. Leggieri