Unprotect Navbar Version Logo
  • Home
  • Techniques
  • Scan
  • Resources
    • Snippet List
    • Detection Rule List
    • Featured Evasion API List

    • Contributors

    • Scanned Samples
  • Tools
  • About
  • Avatar Login

Search For Content

Clear

Search Result

1 item(s) found so far for this keyword.

Change Module Name at Runtime

Process Manipulating icon
Process Manipulating

It is possible to change the name of the current process or any of its modules at runtime. This is achieved by accessing the process PEB's member 'Ldr', in particular it has a member 'InOrderMemoryLinks' which we can iterate through to get a list of the process's modules.

On each iteration it gets a PLDR_DATA_TABLE_ENTRY structure to work with …

Read more

The #UnprotectProject is brought to you by 🇫🇷 fr0gger_ and 🇫🇷 DarkCoderSc

Terms And Conditions | GDPR

Contribute Now