Posted November 6, 200618 yr I?d like create global inline hook for everyone new processes. Theoretically using VirtualProtect I can change page attributes from read to write. But always when I try change it for CreateProcess EP from read to write I get ?copy on write?. My question is: Is it possible change this attributes to write only? I know that by masking cr0 I can change this attributes but I?d like do this in UM if it is possible of course;) And I don?t like patch files on disk (kernel32.dll).
Create an account or sign in to comment