Search Evasion Techniques
Names, Techniques, Definitions, Keywords
Search Result
1 item(s) found so far for this keyword.
Change Module Name at Runtime Process Manipulating
It is possible to change the name of the current process or any of its modules at runtime. This is achieved by accessing the process PEB's member 'Ldr', in particular it has a member 'InOrderMemoryLinks' which we can iterate through to get a list of the process's modules.
On each iteration it gets a PLDR_DATA_TABLE_ENTRY structure to work with …