Kernel injection is only supported on 圆4 OSes and requires Driver Test signing mode. May not work properly on x86 OS versions You can't manually map pure managed images, only native injection is supported for them Use x86 version to manually map 32 bit images and x86 version to map 64 bit images You can't inject 32 bit image into 圆4 process If you want to do this I would recommend to use manual mapping with manual imports option, because native loader is more buggy than my implementation in this case (especially in windows 7). Injection of 圆4 images into WOW64 process is totally unpredictable. If you want to inject pure managed dll - use same injector version as your target process is.
However this is only valid for native images. Apart from obvious features x86 version supports injection of 圆4 images into 圆4 processes 圆4 injector supports injection of x86 and 圆4 images into WOW64 processes. Only API set schema, SxS, target executable directory and system directory No C++ exception handling support for 圆4 images (only SEH) Kernel manual map features are mostly identical to user-mode with few exceptions: C++/CLI images are supported (use 'Add loader reference' in this case) Support for exceptions in private memory under DEP Make module visible to GetModuleHandle, GetProcAddress, etc. Relocations, import, delayed import, bound import Injection of 圆4 images into WOW64 process Calling custom initialization routine after injection Injection into native processes (those having only ntdll loaded) Windows 7 cross-session and cross-desktop injection Injection of pure managed images without proxy dll Manual map of kernel drivers (driver required)
Kernel-mode injection feature (driver required) Supports x86 and 圆4 processes and modules
0 kommentar(er)
