Questions tagged [processhacker]
ProcessHacker is a Windows multi-purpose tool that helps you monitor system resources, debug software and detect malware.
10 questions
0
votes
1
answer
736
views
Best way to monitor the access to a DLL of a software?
I'm currently analyzing a complex software which compiles a kind of code. By monitoring and correlating it with ProcMon I could figure out it loads a DLL as a module.
Now I'm trying to find out how ...
2
votes
1
answer
1k
views
How to get thread start address in Windows?
I'm writing thread finder in module. My goal is find all threads in process and find threads currently working address locations. Like image on below. I do this goal with NtQueryInformationThread API.
...
3
votes
1
answer
564
views
Unable to attach into mysterious PID
I have a suspicious process. I found it by ProcessHacker's network tab.
ProcessHacker display the process as Unknown.
The process listening into a constant port number that's also not found by ...
- 161
1
vote
0
answers
67
views
Acquire command line of remote process in Windows OS
I'd like to use C/C++/CS API to get the command line that invoked another process according to PID.
I've seen that this is done in processHacker that is an openSource project, but I couldn't find the ...
- 293
-1
votes
1
answer
139
views
Force debug Administrator Malware
I want to analyse a malware that do not run without administrative previliges.
I know it is risky but still.
How can I debug it with debugger as from entry point?
Because debugger could not start ...
- 101
1
vote
1
answer
340
views
possible to get reference assembly address in file for special memory address?
Hello I try to learn reverse engineering, so i use from process hacker to view dynamic strings in the process's memory... (more info)
i get something like this :
Address Length Result
--------------...
- 13
1
vote
2
answers
111
views
How to simulate responses from the file system
I have a program that checks a lot of local files. When the program runs I want it to use the local files as normal, but during the loading of the program I'd like it to check for details of files ...
- 233
5
votes
1
answer
931
views
Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?
Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR.
GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0.
...
- 51
8
votes
3
answers
3k
views
Re-engineering to create UML Diagrams from Source and Binary
Are there tools that would create:
UML Structural Diagrams from Source Code.
UML Behavioral Diagrams from Binary executing on a arm / x86 system.
Sources would be in C &/ C++ &/ Python.
...
2
votes
2
answers
564
views
How to interpret entries from Exports tab in ProcessHacker
I use ProcessHacker version 2.33 to inspect the functions which are exported by DLLs in running processes. In the screen-shot below you can see a few exported functions from a C++ application, along ...
- 828