Kong - hooking package.

[Neal Alexander]

bobef wrote:
> I am not really sure what this is, but can it be used to make an executable delete/replace itself :) ?

No, but the TODO list has a "from-memory executable loader" on it thats 
half done (see 
http://www.joachim-bauch.de/tutorials/load_dll_memory.html/en).

Ive used something similar in an older project to allow the software to 
hot-swap its core (no file backing/locking and everything was stored in 
a zip archive).

The main issue is when/where/how to unload the old core. You can pass a 
context onto the next dll and let it unload/modify the old, or you can 
create a loader stub inside its own memory region and let it handle all 
the loading / unloading.


In any case, i'll see if i can come up with something interesting.


BTW:
Delinking a DLL from the process environment block module list lets you 
delete the file on disk IIRC (example at the bottom here 
http://destroy.selfip.org/svn/kong/win32/DSO.d).

Dunno how useful that is, aside from hiding the dll or letting you 
delete it off disk.