Description: OEP infection injection, the main we need to understand the concept of the OEP. OEP is the entrance to the program, for example, we write a DLL, so OEP is equivalent to DllMain, if write an EXE, then OEP is equivalent to the main or WinMain. When the Windows a PE file loading is completed, will be directly executed OEP entrance, namely: AddressOfEntryPoint. We learned knowledge, PE AddressOfEntryPoint is inside the IMAGE_OPTIONAL_HEADER32 structure definition.
To Search:
File list (Check if you may need any files):
KernelInject\drvcommon.h
............\drvversion.h
............\drvversion.rc
............\KernelInject.c
............\KernelInject.h
............\KernelInject.sln
............\KernelInject.suo
............\KernelInject.vcxproj
............\ldasm.c
............\ldasm.h
............\makefile
............\ntifs.h
............\sources
shellcode\shellcode.cpp
.........\shellcode.dsp
.........\shellcode.dsw
.........\StdAfx.cpp
.........\StdAfx.h
OEP感染注入.wps
KernelInject
shellcode
Download