Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [process]

An instance of a computer program being executed in memory. It contains the program code and its current activity inside the same memory context.

0
votes
0answers
31 views

How can third party software show their window on a “secure desktop”?

I'm trying to see how these commercial password managers seem to show their dialog window on what they claim to be a "Secure desktop". Here's one: Then if you click its "Unlock on Secure Desktop" ...
6
votes
1answer
66 views

Detecting protected processes and critical processes from windows driver

I've got a driver that tamper user-space processes by sending APC calls upon process start using the call PsSetCreateProcessNotifyRoutine. I wish to avoid tampering with any process that is critical ...
0
votes
2answers
73 views

capturing the sub processes's PID of a process

When a program is executed, some processes may be created by the parent process. Especially, if a program is malware, created (or forked or even injected) sub-processes will be named as a systemic ...
0
votes
2answers
363 views

How to use API monitor on specific process

I want to monitor specific process with API Monitor but I didn't understand how do I do it please. I will happy to understand that. By the way, can I monitor process while I debugging it with ida?
2
votes
0answers
47 views

Catch connection string between exe and mdb

I have an exe file that read and write from a local DB file. I checked this file with Detect It Easy and it shows that this is a mdb file. I can open this file with microsoft access, and watch all ...
0
votes
1answer
58 views

Figuring out where 2 executions of the same process differ

I have a process that runs and does it's job sometimes (takes some files and does some work). However when I feed it some incorrect files, it fails. I'd like, if possible, to record every step the ...
3
votes
1answer
983 views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
1
vote
0answers
76 views

Process Memory Viewing Tool

I'm trying to remember a couple of tools that I used several years ago that allowed you to create structs and map certain regions of memory to those structures so you could view the correct data types ...
0
votes
1answer
1k views

How is CreateProcessAsUser impersonation implemented in Windows services?

CreateProcessAsUser is often used by Windows services in case an executable is started that the user has specified in order to run it with Medium Integrity Level to ensure privilege isolation. ...
0
votes
1answer
154 views

TOKEN structure in Kernel

I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code. ...
6
votes
2answers
454 views

Getting the current process in Windows

While reading Practical Reverse Engineering by Bruce Dang, I came across the following. Am I correct in my assumption that the procedures return a pointer to the current thread and current process ...
1
vote
1answer
409 views

DLL Injection does not work twice

I created a program that performs DLL injection. It does that by opening the process with OpenProcess, writes the DLL path to the process and creates a remote thread with CreateRemoteThread with the ...
2
votes
2answers
167 views

Any tool for finding IP that a process use/access?

I need to extract the IP that a certain application is using to receive and/or send data, is there any tool or software that would do this for me ? or any simple way without needing to dig into the ...
0
votes
2answers
353 views

Heap address Calculation

I can see in the windbg disassembly the handle to the process heap on, allocated by the Windows (WINDOWS 10) for my process: 0:000> dt nt!_PEB 0106c000 ntdll!_PEB +0x000 InheritedAddressSpace : ...
2
votes
1answer
198 views

Changes on threads and threading system, in new Windows OS

I looked up the source code of the functions like CreateProcess and CreateThreade from kernel32. For example, CreateThread@kernel32 leads into kernelbase.dll and ends with a call to NtCreateThreadEx. ...
1
vote
2answers
80 views

How to simulate responses from the file system

I have a program that checks a lot of local files. When the program runs I want it to use the local files as normal, but during the loading of the program I'd like it to check for details of files ...
5
votes
2answers
552 views

CreateProcess - First thread routine - where is the memory allocated for the thread?

When calling CreateProcess internally it will call (obviously ZwCreateProcessEx and then) ZwCreateThread with a CreateSuspended set to True, then i assume final initialization is taking place. ...
3
votes
2answers
1k views

Extracting threads' stack from Windows memory dump

I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB). I want to extract as many features as possible from this dump. Mainly I want to extract all stacks ...
3
votes
1answer
3k views

Process Dumping and Ida

Up until now I've been performing static analysis using Ida and run time analysis using OllyDBG. I've identified a function in Olly which I would like to start documenting further in Ida, however I ...
0
votes
1answer
305 views

Exe Unpack or Process Spy - Getting process internals

I want to rewrite a application tool in C# that is written in VB6. This application does not work in windows 8/10 due to some compatibility issues. It is an old game server management tool. This ...
2
votes
1answer
3k views

Attaching debugger to process IDA Pro privilege problem

I am trying to attach the WinDBG to particular process but I constantly get the error below : I am using win 7 x64 and am trying to debug x64 application. I run the IDA Pro with admin privileges. I ...
3
votes
1answer
479 views

Command for Command line plugin does not work

I need to analyse a sample which creates a child process. I want to analyze the child process, too, but I have the following problem. Therefore, I take the command line plugin for my olldbg v1.10 and ...
0
votes
1answer
1k views

Working with multi-threaded program but can not find created thread

i am analyzing a piece of code in which the main thread does the following steps: First, it calls CreateProcess() to create a a process in suspended state. Then it changes the starting address of the ...
0
votes
2answers
501 views

Reading the process memory yields different results

I used some code to read the process memory using the MEMORY_BASE_INFORMATION a little while back using the information provided here. However, when I list out the regions in memory, only the pages ...
0
votes
1answer
558 views

Running thread without process - special case

During the analysis of a piece of code, I have seen that a process is created in a suspended state. The process had one thread. Then they are changing the start address of that thread. After doing ...
2
votes
1answer
2k views

Why/how is GDB allowed to attach to a process and read/write to attached process' address space?

The fact that GDB can attach to any process without having su rights is terrifying to me. For example, what prevents me from writing a malware/virus(/whatever the correct term is) that uses same ...
2
votes
0answers
144 views

How can one debug a program that can only be started by other processes?

I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger. The program starts by using a bash script wrapper to process input parameters, ...
1
vote
1answer
196 views

Reverse Engineering Thought Process

About an year back I had seen a PDF of some research work that had been shared at /r/reverseengineering that tried to reason and understand the thought process involved in Reverse Engineering. ...
2
votes
1answer
509 views

Using GetProcAddress with offset syntax

I have the following line (I use IDA PRO) : ... push (offset aPstorec_dllwne+0Ch) ; lpProcName push esi ; hModule call GetProcAddress_0 ... When I ...