1

I have exe file in my pc(exe1) that send message to another exe (client-server maybe).

I dont know which exe recived this message from exe1 and with which iso that message encoding.

  1. How can I see which exe recived message from exe1.

  2. How can I see with which ISO this message encoding?

  • what is "ISO"? also please fix "witch" to "which" – Igor Skochinsky Aug 6 '18 at 14:42
  • @IgorSkochinsky there are a variety of ways how to encode message between 2 processes (how to encode each 8 bits). For ex. if yiu encode each 8 bits with ASCII ,because ASCII is only 7 bits, you lose the msb bits of each byte – Keystone Aug 6 '18 at 15:39
  • why do you think one exe is sending messages to another? please add more information to the question – Igor Skochinsky Aug 6 '18 at 15:46
  • For ex. in exe1 there is user login (put user and password) and exe2 add this user and password to database, exe1 don't have a access to db – Keystone Aug 6 '18 at 15:49
  • Do you know if the message sent is via a proprietary API or Windows API? If the latter, then perhaps an application like API Monitor might be of help: rohitab.com/apimonitor – dsasmblr Aug 6 '18 at 16:11
4

There are multiple ways two processes can communicate. The general term for this is IPC (Interprocess Communications). On Windows, the following forms of IPC are commonly used:

  • COM
  • Window messages (simple messages for small data amounts, WM_COPYDATA for bigger amounts)
  • File mapping, or named shared memory
  • Shared memory
  • Pipes (named or anonymous)
  • Sockets (e.g. TCP/IP)
  • passing info via command-line arguments (though this is not really IPC)

Less common but still possible:

  • Clipboard
  • Mailslots
  • RPC (remote procedure call)

Which one is actually used is difficult to say with limited information you provided. Using an API monitor, as suggested by @dsasmblr may give you some hints. You can also just debug or RE the executable which processes user input and see what is being done with the entered information.

  • I didn't success watch the communication at api monitor but I saw the message was sent when exe1 call to ObjectStublessClientXX in ole32.dll is that explain something? Is that passable? – Keystone Aug 14 '18 at 18:59
  • This smells like COM(or, less likely, RPC). Unfortunately there’s too little space in the answering box for introduction into COM – Igor Skochinsky Aug 15 '18 at 7:24
  • Is there any way to verify that is com? Why do you think that COM when I tell ObjectStublessClientXX?? – Keystone Sep 2 '18 at 21:17
  • @Keystone "stub" and "client" is OLE/COM terminology: docs.microsoft.com/en-us/windows/desktop/Midl/… – Igor Skochinsky Sep 2 '18 at 21:29
  • So when I saw ObjectStublessClientXX that mean communication between process? How can I see what is the message that send between process and to which process my process send that message?? Thank – Keystone Sep 3 '18 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.