'Detour function' presentation slideshows

DKOM (Direct Kernel Object Manipulation)

DKOM (Direct Kernel Object Manipulation). Jamie Butler Director of Engineering HBGary, LLC http://www.hbgary.com. Operating System Design. User Land Operating system provides common API for developers to use Kernel32.dll Ntdll.dll Kernel Mode

870 views • 46 slides

Hidden Processes: The Implication for Intrusion Detection

350 views • 23 slides

Living With Detours

Living With Detours. Why Use Detours?. You want to replace some target binary code with new detour code. Detours will: Replace the first instructions of a target function with JMP to the detour function. Preserve the original function callable through a trampoline function.

123 views • 11 slides