I wrote something that did this too but went about it differently-- instead of injection I spawned the target processes as a child process so I could modify the setting for the children. To do this, I added my binary as a debugger via KLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\target.exe
6 comments
[ 3.0 ms ] story [ 23.9 ms ] threadI wrote something that did this too but went about it differently-- instead of injection I spawned the target processes as a child process so I could modify the setting for the children. To do this, I added my binary as a debugger via KLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\target.exe
Is there a way to detect the screen is being captured?