Hooking Functions in a different Process

[@bloodyink3423]

Thank you 4 ur videos

[@Alchemytweaks]

You the best ❤

[@MrDimension0]

Thank you for the great video. I am wondering if we need thread-synchronization especially for the wchar process name changed by the configurator process and used inside the compare function inside the .dll? Also what about memory barriers so that writes to pid and process name are actually flush the store buffer and can be observed by dll inside task manager? I'm a total noob on this and I am probably wrong. I would be grateful if you could add a short explanation why we don't need to care about these threading-problems in this case. Thanks a lot

[@zodiacon]

In theory, you would need thread sync (a simple mutex or SRWLock will do) because the globals are read and written potentially at the same time from 2 different threads, but not really in practice, since if something is observed as partially changed, it will be picked up correctly the next time NtQuerySystemInformation is called. A memory barrier here is an alternative to synchronization - you could add a memory barrier to force the memory to be observed by other processors right after update to ensure sequential consistency, but again, from a practical perspective it's not needed, especially since the configurator exits quickly which will force store buffer flushing . And in any case, the example is non-trivial as it is without adding sync to the mix :)

[@slava_xd]

pavel will you make a video on WTL in the future?

[@zodiacon]

I have a complete course on that... training.trainsec.net/gui-programming-with-wtl There are some free videos there.

[@slava_xd]

@@zodiacon oh, I'll buy it then. thank you :)