I'm trying to do a little IAT hooking in explorer.exe. Specs: Windows 7 x64, Visual C++. I've made it to a point where I am capable of reading thunk data from any executable of my choosing except for C:\Windows\Explorer.exe. When I run my program against that I receive an access violation in reading memory from that executable. However, when I run this against C:\Windows\system32\Explorer.exe and C:\Windows\sysWOW64\Explorer.exe I don't have any problems. Why is this? Is C:\Windows\Explorer.exe some sort of symbolic link to one of the other explorer.exe's? What could be keeping me from reading this file?
相关问题
- the application was unable to start correctly 0xc0
- Outlook Object Model - Hooking to the Conversation
- Add or Subtract From 64bit Integer in Javascript
- How to get a slug name for a page without creating
- SQLite3.dll for Windows 7 64 bit
相关文章
- Why windows 64 still makes use of user32.dll etc?
- Determine if an executable (or library) is 32 -or
- Native hooking in Android Client
- Is it possible to check whether you are building f
- Where is gacutil.exe in Windows 10?
- Combined SVN FTP system?
- How to use Int64 in C#
- Visual Studio: How to properly build and specify t
On my Windows 7 x64 system
C:\windows\explorer.exe
is a 64-bit binary,PE32+
format, whereasc:\windows\syswow64\explorer.exe
is a 32-bit binary,PE32
format. Is your application designed to read bothPE32
andPE32+
formats?And when opening
C:\Windows\System32\Explorer.exe
from a 32-bit process that is a redirect to thec:\windows\syswow64\explorer.exe
copy. From a 64-bit processc:\windows\system32\explorer.exe
doesn't exist.