pwndizzle / c-sharp-memory-injection Goto Github PK

EDIT: My bad.. Just noticed the code was for x64, switched it up with the i386 and now it works as expected. My bad!

I tried thread highjacking using your way of doing it. Pausing and resuming the thread works really good, but the CONTEXT64 struct dont get any values.

I do this, just as in your code, and I put a breakpoint inside and look at the tContext struct.
if (GetThreadContext(pOpenThread, ref tContext))
{
Console.WriteLine("CurrentEip : {0}", tContext.Rip);
}

the contents of the tContext struct is all zero for some reason and when it prints the currentEip it says 0.
Do you have any idea whats up with that? I basically copa pastad your code into a windows forms app, just confused why it doesnt get any values.

EDIT: My bad.. Just noticed the code was for x64, switched it up with the i386 and now it works as expected. My bad!

sorry, cerated by mistake