I followed the running steps but it can't find the notepad.exe process although it's currently running.
Agent.exe:
C:\Users\matt\Downloads\EDR-mergency\builds> .\Agent.exe
========================================
vEDR Agent - Starting Up
========================================
[Phase 1] Starting Log Server
==============================
[+] Creating named pipe: \\.\pipe\HookPipe
[+] vhook.dll will connect to this pipe
[+] Logs will appear below:
----------------------------------------
[+] Named pipe server starting...
[+] Named pipe created. Waiting for vhook.dll to connect...
[+] vhook.dll connected! Starting handler thread...
[+] Named pipe created. Waiting for vhook.dll to connect...
[+] Client handler thread started
[LOG] Process: DLLLoader.exe | PID: 22416 | Injected into process
[LOG] Process: DLLLoader.exe | PID: 22416 | Hooks installed successfully
DLLLoader.exe:
C:\Users\matt\Downloads\EDR-mergency\builds> .\DLLLoader.exe
[+] Attempting to self-inject vhook.dll...
[+] Successfully loaded vhook.dll into DLLLoader.exe
Searching for process: notepad.exe
Process not found... exiting!
edr_shared.log content:
Process: DLLLoader.exe | PID: 9140 | Injected into process
Process: DLLLoader.exe | PID: 9140 | Hooks installed successfully
Process: DLLLoader.exe | PID: 9140 | NtProtectVirtualMemory changed to executable pid=9140
Process: DLLLoader.exe | PID: 9140 | NtProtectVirtualMemory changed to executable pid=9140
Process: DLLLoader.exe | PID: 21244 | Injected into process
Process: DLLLoader.exe | PID: 21244 | Hooks installed successfully
Process: DLLLoader.exe | PID: 22416 | Injected into process
Process: DLLLoader.exe | PID: 22416 | Hooks installed successfully
Note:
- I did not build the source I just launched the Agent.exe and DLLLoader.exe already included in your repository.
- I have MS Defender EDR already installed locally, maybe it can interfere with the correct execution chain?
What can I do to make it work?
Thank you,
zer0matt
I followed the running steps but it can't find the notepad.exe process although it's currently running.
Agent.exe:
DLLLoader.exe:
edr_shared.log content:
Note:
What can I do to make it work?
Thank you,
zer0matt