Alexandre Benson Smith wrote:

> Ok... I cannot say a lot of in memory code injection, as I understand
> it, it's possible, but the possibilities are a lot limited compared to
> change the binary for a custom build, change the binary with a custom
> build open all kinds of possibilities, while in memory code injection
> must be a change of byte per byte, so one cannot do a lot without
> breaking the original functionality, or even make the software unable to
> run.

An exploit could just download a DLL, load it and do anything. Official
FB binaries is easy identically recreated (i.e., use same FB source code
version and same compiler version), so it's easy for one to "play" with
it and know exactly what in-memory bytes need to be modified to call
another code.


Adriano