Aldhard Oswine Posted May 24, 2017 Share Posted May 24, 2017 (edited) I'm trying to implement process hollowing in Win10 for x64 processes. Which is almost same as in this code: https://github.com/m0n0ph1/Process-Hollowing/blob/master/sourcecode/ProcessHollowing/ProcessHollowing.cpp, but for x64. and for an entry point, I'm using "Rcx" register. It works for apps if target and victim process is same, otherwise, it causes the error: "the application was unable to start correctly 0xc00000142". It also works apps, which are created by me for the test. What are possible mistakes in my implementation? Edited May 24, 2017 by Aldhard Oswine Link to comment Share on other sites More sharing options...
Aldhard Oswine Posted May 24, 2017 Author Share Posted May 24, 2017 Solved: problem was different subsystem Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now