"Joseph M. Newcomer" <newcomer@flounder.com> wrote in message
news:9r3gt31gajgol8ass0arkgh1tqjpbemcgl@4ax.com...
One technique I've seen is to launch an application (for instance,
Notepad), in a suspended state. Then overwrite the process memory
with your target code, and resume the process.
That is truly scary. In any sane operating system, such an action
should be impossible.
joe
Well, I know you use system-wide global Windows hooks, and those
force your hook DLL into all processes, in effect overwriting process
memory. The SendMessageRemote() function that I wrote that you seem
to like also "overwrites process memory" using CreateRemoteThread(),
CreateProcessMemory(), etc. so actually I'm glad that these methods of
binary-interception are possible in Windows. It does make possible
very valuable custom apps that make Windows truly "personal".