Questions tagged [process]

An instance of a computer program being executed in memory. It contains the program code and its current activity inside the same memory context.

Filter by
Sorted by
Tagged with
1
vote
1answer
77 views

macOS under M1, cannot find library

I'm looking for the following dylib file which is included from process loginwindow. If I run vmmap to inspect loginwindow while it's up and running I get : user@mycomp / % sudo vmmap -I ``pgrep ...
1
vote
2answers
93 views

How to search for process by name with WinDBG

I know how to list all the processes in the system by running: 0: kd>dx -r1 Debugger.Sessions[0].Processes OR 0: kd>.tlist But how can I search for a process by name? I tried to use the ...
3
votes
1answer
170 views

Unable to attach into mysterious PID

I have a suspicious process. I found it by ProcessHacker's network tab. ProcessHacker display the process as Unknown. The process listening into a constant port number that's also not found by ...
3
votes
1answer
246 views

Catch connection string between exe and mdb

I have an exe file that read and write from a local DB file. I checked this file with Detect It Easy and it shows that this is a mdb file. I can open this file with microsoft access, and watch all ...
2
votes
0answers
45 views

Is there a way to resume execution of a process for a given amount of time then suspend it?

I am using the following IDC script in IDA: #include <idc.idc> static main() { for (i=0; i<10; i++) { PauseProcess(); ...
1
vote
1answer
55 views

Import Address Table in Process Hollowing

I know that the PE loader is the one that is responsible for assigning addresses in a PE Import Address Table, so why when we inject code using process hollowing we don't build the IAT? We just copy ...
-1
votes
1answer
465 views

c++ reading process memory with injected DLL

The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address). Why does it return this error? Btw ...
1
vote
0answers
51 views

Acquire command line of remote process in Windows OS

I'd like to use C/C++/CS API to get the command line that invoked another process according to PID. I've seen that this is done in processHacker that is an openSource project, but I couldn't find the ...
0
votes
1answer
42 views

WinHex : There's a data that does not belong to any module

I read my process memory with WinHex in order to remove some sensitive text which may running my app into crack/hack.(license data). Now , when i open the process Entire memory with in WinHex , i can ...
1
vote
0answers
59 views

Debug only one thread with ida-gdb server

If I want to debug process in embedded that running linux , I can run gdb-server in embedded and attach to process with Ida. The problem is if this process has 1 thread that can't stop over than x ...
0
votes
0answers
76 views

How to use API Monitor to filter function parameters?

I am monitoring a process using API monitor. I'm getting a lot of API calls unrelated to what I am interested in monitoring. I know about the Display Filter and have been using to filter API Names to ...
6
votes
1answer
856 views

Detecting protected processes and critical processes from windows driver

I've got a driver that tamper user-space processes by sending APC calls upon process start using the call PsSetCreateProcessNotifyRoutine. I wish to avoid tampering with any process that is critical ...
0
votes
2answers
328 views

capturing the sub processes's PID of a process

When a program is executed, some processes may be created by the parent process. Especially, if a program is malware, created (or forked or even injected) sub-processes will be named as a systemic ...
3
votes
2answers
4k views

How to use API monitor on specific process

I want to monitor specific process with API Monitor but I didn't understand how do I do it please. I will happy to understand that. By the way, can I monitor process while I debugging it with ida?
3
votes
1answer
997 views

Command for Command line plugin does not work

I need to analyse a sample which creates a child process. I want to analyze the child process, too, but I have the following problem. Therefore, I take the command line plugin for my olldbg v1.10 and ...
0
votes
1answer
76 views

Figuring out where 2 executions of the same process differ

I have a process that runs and does it's job sometimes (takes some files and does some work). However when I feed it some incorrect files, it fails. I'd like, if possible, to record every step the ...
4
votes
1answer
4k views

How to fix anti-debugger with DbgUiRemoteBreakin

I have windows application that I want to debug. When I open it with ollydbg and attach to this application process I see attached process paused at ntdll.DbgBreakPoint when I press Play I see ...
1
vote
0answers
122 views

Process Memory Viewing Tool

I'm trying to remember a couple of tools that I used several years ago that allowed you to create structs and map certain regions of memory to those structures so you could view the correct data types ...
1
vote
1answer
3k views

How is CreateProcessAsUser impersonation implemented in Windows services?

CreateProcessAsUser is often used by Windows services in case an executable is started that the user has specified in order to run it with Medium Integrity Level to ensure privilege isolation. ...
0
votes
1answer
532 views

TOKEN structure in Kernel

I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code. ...
7
votes
2answers
1k views

Getting the current process in Windows

While reading Practical Reverse Engineering by Bruce Dang, I came across the following. Am I correct in my assumption that the procedures return a pointer to the current thread and current process ...
2
votes
1answer
888 views

DLL Injection does not work twice

I created a program that performs DLL injection. It does that by opening the process with OpenProcess, writes the DLL path to the process and creates a remote thread with CreateRemoteThread with the ...
3
votes
2answers
1k views

Any tool for finding IP that a process use/access?

I need to extract the IP that a certain application is using to receive and/or send data, is there any tool or software that would do this for me ? or any simple way without needing to dig into the ...
1
vote
2answers
721 views

Heap address Calculation

I can see in the windbg disassembly the handle to the process heap on, allocated by the Windows (WINDOWS 10) for my process: 0:000> dt nt!_PEB 0106c000 ntdll!_PEB +0x000 InheritedAddressSpace : ...
2
votes
1answer
286 views

Changes on threads and threading system, in new Windows OS

I looked up the source code of the functions like CreateProcess and CreateThreade from kernel32. For example, CreateThread@kernel32 leads into kernelbase.dll and ends with a call to NtCreateThreadEx. ...
1
vote
2answers
90 views

How to simulate responses from the file system

I have a program that checks a lot of local files. When the program runs I want it to use the local files as normal, but during the loading of the program I'd like it to check for details of files ...
4
votes
2answers
1k views

CreateProcess - First thread routine - where is the memory allocated for the thread?

When calling CreateProcess internally it will call (obviously ZwCreateProcessEx and then) ZwCreateThread with a CreateSuspended set to True, then i assume final initialization is taking place. ...
3
votes
2answers
2k views

Extracting threads' stack from Windows memory dump

I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB). I want to extract as many features as possible from this dump. Mainly I want to extract all stacks ...
2
votes
1answer
4k views

Process Dumping and Ida

Up until now I've been performing static analysis using Ida and run time analysis using OllyDBG. I've identified a function in Olly which I would like to start documenting further in Ida, however I ...
0
votes
1answer
538 views

Exe Unpack or Process Spy - Getting process internals

I want to rewrite a application tool in C# that is written in VB6. This application does not work in windows 8/10 due to some compatibility issues. It is an old game server management tool. This ...
2
votes
1answer
6k views

Attaching debugger to process IDA Pro privilege problem

I am trying to attach the WinDBG to particular process but I constantly get the error below : I am using win 7 x64 and am trying to debug x64 application. I run the IDA Pro with admin privileges. I ...
0
votes
1answer
2k views

Working with multi-threaded program but can not find created thread

i am analyzing a piece of code in which the main thread does the following steps: First, it calls CreateProcess() to create a a process in suspended state. Then it changes the starting address of the ...
0
votes
2answers
767 views

Reading the process memory yields different results

I used some code to read the process memory using the MEMORY_BASE_INFORMATION a little while back using the information provided here. However, when I list out the regions in memory, only the pages ...
0
votes
1answer
814 views

Running thread without process - special case

During the analysis of a piece of code, I have seen that a process is created in a suspended state. The process had one thread. Then they are changing the start address of that thread. After doing ...
3
votes
1answer
3k views

Why/how is GDB allowed to attach to a process and read/write to attached process' address space?

The fact that GDB can attach to any process without having su rights is terrifying to me. For example, what prevents me from writing a malware/virus(/whatever the correct term is) that uses same ...
2
votes
0answers
185 views

How can one debug a program that can only be started by other processes?

I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger. The program starts by using a bash script wrapper to process input parameters, ...
1
vote
1answer
222 views

Reverse Engineering Thought Process

About an year back I had seen a PDF of some research work that had been shared at /r/reverseengineering that tried to reason and understand the thought process involved in Reverse Engineering. ...
2
votes
1answer
680 views

Using GetProcAddress with offset syntax

I have the following line (I use IDA PRO) : ... push (offset aPstorec_dllwne+0Ch) ; lpProcName push esi ; hModule call GetProcAddress_0 ... When I ...