Hello!
While looking at the Tibiasock code (https://code.google.com/p/tibiasock/...ck/dllmain.cpp), I noticed some things I could use some clarification on:
- The main thread is suspended to avoid synchronization problems when calling a function, is that right?
- Executing code is done by codecaving and calling CreateRemoteThread on them. Why aren't they called directly in the DLL?
- Why does this work?
Code:BYTE* CreateOutgoingBuffer(BYTE* dataBuffer, int length) { BYTE actualBuffer[1024]; ZeroMemory((LPVOID)actualBuffer, 8); memcpy((LPVOID)&actualBuffer[8], (LPVOID)dataBuffer, length-8); return actualBuffer; // stack-allocated }
Thanks for reading