1

DetourFindRemotePayload

Brian Gianforcaro edited this page 2021-03-06 00:51:42 -08:00

Table of Contents

• DetourFindRemotePayload
• Definition
• Parameters
• Return value
• Error codes
• Remarks
• Related Samples

DetourFindRemotePayload

Return the address of the specified payload within a remote process.

Definition

_Success_(return != NULL)
PVOID DetourFindRemotePayload(
    _In_      HANDLE  hProcess,
    _In_      REFGUID rguid,
    _Out_opt_ DWORD  *pcbData
);

Parameters

hProcess

Process in which the specified payload should be searched.

rguid

GUID of the specified payload.

pcbData

Variable to receive the size in bytes of the specified payload.

Return value

Pointer to the specified payload or NULL if the payload doesn't exist.

Error codes

On failure, DetourFindRemotePayload will return NULL. Extended error code information may be retrieved by calling GetLastError.

Remarks

Where DetourFindPayload and DetourFindPayloadEx search for a payload in the current process, DetourFindRemotePayload searches for a payload in a different process. The returned value can then be read or written with ReadProcessMemory or WriteProcessMemory.

For more information on binary editing with Detours and payloads, see Payloads and DLL Import Editing in the Detours Overview.

Related Samples

Payload.

Overview

• Home
• Frequently Asked Questions
• Using Detours
• Interception of Binary Functions
• Payloads and DLL Import Editing
• Detouring 32-bit and 64-bit Processes
• Samples

API Reference

• Detouring Target Functions
• Finding Target Functions
• Accessing Loaded Binaries and Payloads
• Modifying Binaries
• Inserting DLLs and Payloads Into New Processes