| Author |
Message |
| tzuk |
Posted: Thu Oct 02, 2008 10:21 pm Post subject: |
|
| No, Buster, I am sorry but I don't think that's a good idea for me to debug your DLL. |
|
 |
| Buster |
Posted: Thu Oct 02, 2008 10:01 pm Post subject: |
|
Sorry, I thought you were meaning other thing.
If I send you the DLL could you check whatīs going wrong? |
|
 |
| tzuk |
Posted: Thu Oct 02, 2008 9:26 pm Post subject: |
|
| I don't know why it happens. |
|
 |
| Buster |
Posted: Wed Oct 01, 2008 4:15 pm Post subject: |
|
Fixed, thanks!
What about NtSetInformationFile from ntdll.dll? Do you know why it happens? |
|
 |
| tzuk |
Posted: Wed Oct 01, 2008 2:41 pm Post subject: |
|
| I don't know why it happens. |
|
 |
| Buster |
Posted: Wed Oct 01, 2008 1:56 pm Post subject: |
|
| up! |
|
 |
| Buster |
Posted: Wed Oct 01, 2008 9:47 am Post subject: |
|
http://www.megaupload.com/?d=EDI97UO3
There you can get a working DLL to avoid file deletion with source code included in Delphi.
I was unable to convert tzukīs code so I used a hooking unit from other person.
tzuk: a question...
I tried to hook NtSetInformationFile from ntdll.dll but Sandboxie rejects to inject the DLL and aborts opening a sandbox.
Why does it happen? |
|
 |
| Ruhe |
Posted: Sun Sep 28, 2008 11:30 am Post subject: |
|
| After some tries, I'm not able to convert this code to Delphi. |
|
 |
| Buster |
Posted: Thu Sep 25, 2008 7:46 am Post subject: |
|
| Ruhe wrote: |
| I'm a home and hobby Delphi coder but always have problems to read this C/C++ stuff. |
Iīm in the same situation.  |
|
 |
| Ruhe |
Posted: Thu Sep 25, 2008 6:54 am Post subject: |
|
| I'm a home and hobby Delphi coder but always have problems to read this C/C++ stuff. |
|
 |
| Buster |
Posted: Thu Sep 25, 2008 6:44 am Post subject: |
|
| Would be anyone able to code the same stuff tzuk did but in Delphi? |
|
 |
| dynarx |
Posted: Thu Sep 25, 2008 12:20 am Post subject: |
|
| raid wrote: |
| You've really got one fantastic little program. |
Little it may be, but as we say round here, it's not the amount of code in the fight that counts, but the amount of fight in the code!
Just passing, don't mind me
Cheers, all.
Dynarx |
|
 |
| raid |
Posted: Wed Sep 24, 2008 6:41 pm Post subject: |
|
| tzuk wrote: |
| I don't see Sandboxie as a malware research tool, so I'm not going to add features that are dedicated to malware research. Buster, I've already mentioned the InjectDll setting which would let you inject DLLs into sandboxed programs. All you need is to write a small DLL that hooks DeleteFile and prevent the deletion. Maybe you and guys can team up and figure out how to do that. |
Perfectly understandable Tzuk. Although, Sandboxie does a fine job of assisting in malware research. You've really got one fantastic little program.
I will be purchasing a license for it very soon. Your a professional author and have gone out of your way as far as I'm concerned to answer my question.
Thanks again! |
|
 |
| tzuk |
|
 |
| Buster |
Posted: Wed Sep 24, 2008 2:12 pm Post subject: |
|
| tzuk wrote: |
Ha, I guess the build tool knows its stuff. Glad the DLL is working, I'd like to hear that you got it doing what you want and that you can take back your feature request.  |
It almost does what I want.
Do you know if itīs possible to know (if yes, some code would be of help) whatīs the file name that made the DeleteFile call? |
|
 |