Hot answers tagged

6

Linux As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it would not. netstat has some blind spots -- it only shows connections at a certain point in time. Therefore, connections which closed quickly and every ...


6

2) The system call is ptrace. That call has lots of functionality, including "copy a section of the tracee's memory into a local buffer in my address space" and the reverse "copy my buffer to the tracee's memory". These are quite similar to windows' ReadProcessMemory and WriteProcessMemory. The tracing program needs to use these to access memory in the ...


5

It seems the correct term is Critical System Service. There are API from userland but I can't find anything for the kernel. So I took a quick look into the RstrtMgr.dll and it seems the list is actually hardcoded... For the processes: system32\csrss.exe system32\smss.exe system32\lsass.exe system32\wininit.exe system32\logonui.exe system32\services.exe ...


4

I am Not Sure what you are looking for let me try i have a dump file of a vm too MEMORY.dmp from a vm that ran xp sp3 created using .crash from a kernel debugger attached to it i loaded it using windbg as below windbg -z memory.dmp now i thought i will count how many threads are running so i did some thing like this kd> r $t0 = 0; !...


4

If your binary is allocating a new memory page & writing code on it, that's something you won't see on the static binary. Performing a full dump of the process from memory and loading this new binary into IDA will indeed show you those new parts. The data has to come from somewhere though (ressource, compressed, encrypted, another file, Internet, etc). ...


4

Disclaimer: The implementation of these APIs is likely to change between versions of Windows. I will be referencing 32-bit Windows XP SP3 in my answer. Your results may vary. How thread creation works There are three structures that must be initialized before calling NtCreateThread: INITIAL_TEB: Contains pointers to the stack region CONTEXT: Contains ...


4

I currently assume that every function that calls CreateProcessAsUser has its own implementation of retrieving the "current user" in order to pass its token. I would like to understand what this logic looks like and on what criteria the hToken is selected. A while back I wrote some Delphi code to do this when running a program as SYSTEM. Instead of a ...


3

To start with, the offsets are more likely to match the current OS at the time of the book's writing (probably Win7) than Windows 10. That said, a good reference to internal kernel structures over different Windows versions is Geoff Chapell's website: https://www.geoffchappell.com/studies/windows/km/index.htm For example, looking at KPCR, we can see that at ...


3

I think the best approach would be to redirect the relevant function calls to a dummy functions that "spoof" a file system. You'd probably be interested in modifying the executable's import table.


3

You are probably refering to this document: http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA557042


3

If you run across an API call that you're unfamiliar with, check the MSDN page. Parameter 2 is "The function or variable name, or the function's ordinal value." Looking at your offset only one of those things is a function name, WNetEnumCachedPasswords. You can verify this as the comment in your post said, by counting 12 (0xc) bytes from aPstorec_dllwne. db ...


3

AFAIK you cannot debug a 64 bit application locally with IDA Pro. You need to use remote debugging. See this page: https://www.hex-rays.com/products/ida/debugger/#details and this: https://www.hex-rays.com/products/ida/debugger/cross-win-linux/win32towin64.shtml


2

the latest version is available in blog entry https://www.openrce.org/repositories/users/anonymouse/ModifiedCommandLinePluginWithChildDbg_Date_16082008.rar if the link did not work you can download a modified version of the plugin with an additional command .writemem compiler has been changed to vc++ and old code modified to suit vc++ so the ...


2

In addition to creating the child process, CreateProcess() also causes the creation of the child process's primary thread. Your post makes it sound like the calls to GetThreadContext(), SetThreadContext(), and ResumeThread() all act on that primary thread. 1st question: Why it is not in the list ? As you said in your post, you are seeing the process's ...


2

Is it possible that the thread with the manipulated start address is still running after we close the handle to the corresponding process? Is the thread still running although the process to which it belongs is closed because of the changed starting address or will the thread also closed automatically after CloseHandle(processhandle) ? Yes. From the ...


2

Ok so ZwCreateThread has it in the context structure (PCONTEXT + 0xB0) The api calls to receive the address are like this: CreateSection(..SectionInformation..) - Probably to create to initial address NtQuerySection(Handle, x, SectionInformation, x, x) This SectionInformation is containing the address of the EntryPoint of the remote process, later ...


2

this is from win7 but that shouldn't matter much ProcessHeap From Peb of current Process 0:000> dt ntdll!_PEB ProcessHeap @$proc +0x018 ProcessHeap : 0x00430000 Void heap Stat For the same 0:000> !heap -s @$proc->ProcessHeap **************************************************************************** ...


2

This is not anti-debug but the standard way the Win32 debugging API implements process attaching. The thread with DbgBreakPoint call is injected by the OS to ensure that the process gets stopped, since it could be in unknown state otherwise. Most debuggers should handle it transparently, but if yours does not, just set breakpoints on some APIs you’re ...


2

Fire up API Monitor (with the correct architecture fitting your sample) Set the API hooks you need. This highly depends on what you are looking for. To see which APIs your exe is usually using you can use ApiLogger (https://www.aldeid.com/wiki/SysAnalyzer/ApiLogger) Don't forget to set the Breakpoints Before Call In my example I set a filter on ...


1

If commandline is required you can subscribe to WMI Win32_ProcessStartTrace events, here's an example in PowerShell: Register-WMIEvent -query "SELECT * FROM Win32_ProcessStartTrace" -SourceIdentifier "testevent" -action { $e = $Event.SourceEventArgs.NewEvent Write-Host $e.ProcessName, "started" } To stop notification call Unregister-Event Process-Started ...


1

The terms you are looking at , when you want to do a search on this site to answer your question are "Differential Debugging", Runtime "Trace Analysis" and "Trace Recording". This link answers your question: https://reverseengineering.stackexchange.com/a/2567/18402 . Also read this: https://reverseengineering.stackexchange.com/a/16020/18402. If you want ...


1

This Token you've used, the link, is not the Token structure you're searching for. This is the structure https://www.nirsoft.net/kernel_struct/vista/TOKEN.html


1

most of these structures can be queried with windbg if you are running in usermode ntdll.pdb has these type information if you are running in kernelmode ntos/ntkr/ aka nt*.pdb has these type information you can use a tool like livekd from sysinternals along with windbg to do a local kernel debugging session following are output from livekd on a ...


1

Since OP's answer was a bit low on details, i'll assume Linux and Dynamic IP. On most OSes there are tools to list network resources taken by processes. This often includes IP addresses and ports used for existing connections. If you want to list existing connections and their owning processes on linux, running the netstat command. By providing it some ...


1

The problem was due to the Page Heap verification, enabled by Gflags. I forgot about that, and the heap verifier was messing with the heap handles. When i disabled it, the handle at the PEB became valid.


1

No. It is not necessary to create a connection with the CSRSS service in order for a process to function. The CSRSS server provides a few functionalities that are not needed for most processes, and therefore can be ignored unless it is requried in that specific process for any reason. Since NT4, the main functionalities of CSRSS remained mostly the Windows ...


1

user578368's answer is correct, but to be more specific: (assuming that you are using Windows) you need to capture/detour the CreateFileA and CreateFileW function pair. They are the ones that programs use to request a file from windows, so you can change the filename before Windows get it. You can use the link that user578368 gave to modify the import table,...


1

The easiest solution would be to monitor the application with API Monitor to see what parameters it supplies to ReadProcessMemory() and WriteProcessMemory().


1

OllyDbg shows memory regions of all types, whereas your code doesn't show MEM_IMAGE regions. Replace if ((info.State == MEM_COMMIT) && ((info.Type & MEM_MAPPED) || (info.Type & MEM_PRIVATE))) with just if (info.State == MEM_COMMIT).


Only top voted, non community-wiki answers of a minimum length are eligible