Imagine-Programming / Imagine-Programming/hindsight
[feature] follow process creation through DLL injection.
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 2
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
hindsight could be a bit more useful when debugging packed binaries (like SFX archives) when it would know when the debugged process is going to start a new process. There are several ways of going about this, but a nice method of approach would be to inject a generic debugging DLL into the debugged process that can hook i.e. the `CreateProcess` calls from the debugged process.
This would also help debugging the process when it starts itself with different parameters.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing how Hindsight currently tracks the debugged process and how Windows DLL injection could hook CreateProcess calls. Define how child processes and launches with different parameters should be reported, then verify that process creation is followed during packed-binary debugging.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- devtools, operating-systems, reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100