Write a small program can be carried out on the process of specified PID WriteFile () API hook take why winxp under the notepad is successful, the winxp SP3 of notepad. EXE under Windows 7 also succeeded , but always run under Windows 7 primary notepad for failure, as shown in figure

CodePudding user response:

Missing picture for XP SP3 next notepad CMD interface

CodePudding user response:

Impact is more, the environment also didn't say clear, 64 is a 32-bit system, is a 32-bit program or 64 - bit, whether UAC

CodePudding user response:

refer to the second floor jha334201553 response:

impact is more, the environment also didn't say clear, 64 is a 32-bit system, is a 32-bit program or 64 - bit, whether UAC open

A 64 - bit system is a 32-bit system, is a 32-bit program or 64
That estimate is the ultimate reason, a 64 - bit system, there are two notepad, a 32-bit and a 64 - bit

CodePudding user response:

If a 64 - bit system open notepad default should be 64 if you have a DLL is 32-bit won't be injected,

If you are a 64 - bit system, you can enter syswow64 open notepad that 32 bit DLL can be injected