j
k
j a
j l
I opted for doing it in ntdll and passing the machine of the mapping in request's reply. Please advisde if you'd prefer another approach.
It should probably be done in the NtWaitForDebugEvent thunk in wow64.dll.
Back to the thread
Back to the list