Hot answers tagged

7 votes
Accepted

Any tool for finding IP that a process use/access?

Linux As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it ...
Megabeets's user avatar
  • 8,959
6 votes
Accepted

Detecting protected processes and critical processes from windows driver

It seems the correct term is Critical System Service. There are API from userland but I can't find anything for the kernel. So I took a quick look into the RstrtMgr.dll and it seems the list is ...
wisk's user avatar
  • 1,124
4 votes
Accepted

CreateProcess - First thread routine - where is the memory allocated for the thread?

Disclaimer: The implementation of these APIs is likely to change between versions of Windows. I will be referencing 32-bit Windows XP SP3 in my answer. Your results may vary. How thread creation ...
user1354557's user avatar
  • 1,234
4 votes
Accepted

Extracting threads' stack from Windows memory dump

I am Not Sure what you are looking for let me try i have a dump file of a vm too MEMORY.dmp from a vm that ran xp sp3 created using .crash from a kernel debugger attached to it i loaded it ...
blabb's user avatar
  • 16.3k
4 votes
Accepted

How is CreateProcessAsUser impersonation implemented in Windows services?

I currently assume that every function that calls CreateProcessAsUser has its own implementation of retrieving the "current user" in order to pass its token. I would like to understand what ...
Mick's user avatar
  • 7,562
3 votes
Accepted

Unable to attach into mysterious PID

It's not a malware. It's cygwin's ssh-agent and it uses non existent PID as parent. I was able figure this out using a new version of ProcessHacker.
jeffbRTC's user avatar
  • 161
3 votes
Accepted

Getting the current process in Windows

To start with, the offsets are more likely to match the current OS at the time of the book's writing (probably Win7) than Windows 10. That said, a good reference to internal kernel structures over ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes

How to fix anti-debugger with DbgUiRemoteBreakin

This is not anti-debug but the standard way the Win32 debugging API implements process attaching. The thread with DbgBreakPoint call is injected by the OS to ensure that the process gets stopped, ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes

How to simulate responses from the file system

I think the best approach would be to redirect the relevant function calls to a dummy functions that "spoof" a file system. You'd probably be interested in modifying the executable's import table.
Amit Eyal's user avatar
  • 131
3 votes

How to use API monitor on specific process

Fire up API Monitor (with the correct architecture fitting your sample) Set the API hooks you need. This highly depends on what you are looking for. To see which APIs your exe is usually using you can ...
hariom's user avatar
  • 51
3 votes
Accepted

Process Dumping and Ida

If your binary is allocating a new memory page & writing code on it, that's something you won't see on the static binary. Performing a full dump of the process from memory and loading this new ...
user2823000's user avatar
2 votes

CreateProcess - First thread routine - where is the memory allocated for the thread?

Ok so ZwCreateThread has it in the context structure (PCONTEXT + 0xB0) The api calls to receive the address are like this: CreateSection(..SectionInformation..) - Probably to create to initial ...
0xAK's user avatar
  • 668
2 votes

Heap address Calculation

this is from win7 but that shouldn't matter much ProcessHeap From Peb of current Process 0:000> dt ntdll!_PEB ProcessHeap @$proc +0x018 ProcessHeap : 0x00430000 Void heap Stat For the ...
blabb's user avatar
  • 16.3k
2 votes

Catch connection string between exe and mdb

You can find the connection string with an API Monitor tool or Debugger. However first you will need to know are you looking at .NET based executable (i.e. has it loaded clr.dll or mscorlib.dll) and ...
chentiangemalc's user avatar
2 votes
Accepted

macOS under M1, cannot find library

On ARM macOS, like on iOS, most of the common dylibs are no longer shipped as separate files, but are bundled into the dyld shared cache. You can usually find the caches in /System/Library/dyld/.
Igor Skochinsky's user avatar
  • 36.5k
1 vote

How to search for process by name with WinDBG

You Cannot use contains for objects they are not strings contains only is meaningful when you have a partial case Sensitive pattern here is how you may use contains 0: kd> dx Debugger.Sessions....
blabb's user avatar
  • 16.3k
1 vote

How to search for process by name with WinDBG

Here is how to do it: dx @$cursession.Processes.Where(p => p.Environment.EnvironmentBlock.ProcessParameters->CommandLine->ToDisplayString().Contains("chrome")) If you have other ...
E235's user avatar
  • 583
1 vote

Import Address Table in Process Hollowing

Obviously you should resolve the address in IAT. This is a manually mapped dll code, you can take a look. #include <stdio.h> #include <Windows.h> #include <intrin.h> typedef HMODULE(...
Ox9A82's user avatar
  • 137
1 vote

capturing the sub processes's PID of a process

If commandline is required you can subscribe to WMI Win32_ProcessStartTrace events, here's an example in PowerShell: Register-WMIEvent -query "SELECT * FROM Win32_ProcessStartTrace" -SourceIdentifier ...
Remko's user avatar
  • 3,218
1 vote

Figuring out where 2 executions of the same process differ

The terms you are looking at , when you want to do a search on this site to answer your question are "Differential Debugging", Runtime "Trace Analysis" and "Trace Recording". This link answers your ...
TechLord's user avatar
  • 1,046
1 vote
Accepted

TOKEN structure in Kernel

This Token you've used, the link, is not the Token structure you're searching for. This is the structure https://www.nirsoft.net/kernel_struct/vista/TOKEN.html
EWD-0-'s user avatar
  • 119
1 vote

Getting the current process in Windows

most of these structures can be queried with windbg if you are running in usermode ntdll.pdb has these type information if you are running in kernelmode ntos/ntkr/ aka nt*.pdb has these type ...
blabb's user avatar
  • 16.3k
1 vote
Accepted

DLL Injection does not work twice

Calling LoadLibrary twice with the same DLL name only increases the load counter but does not cause DLL entrypoint to be called again. From the doc (emphasis mine): If the specified module is a DLL ...
Igor Skochinsky's user avatar
  • 36.5k
1 vote

Any tool for finding IP that a process use/access?

Since OP's answer was a bit low on details, i'll assume Linux and Dynamic IP. On most OSes there are tools to list network resources taken by processes. This often includes IP addresses and ports ...
NirIzr's user avatar
  • 11.8k
1 vote
Accepted

Heap address Calculation

The problem was due to the Page Heap verification, enabled by Gflags. I forgot about that, and the heap verifier was messing with the heap handles. When i disabled it, the handle at the PEB became ...
Vlad's user avatar
  • 153
1 vote
Accepted

Changes on threads and threading system, in new Windows OS

No. It is not necessary to create a connection with the CSRSS service in order for a process to function. The CSRSS server provides a few functionalities that are not needed for most processes, and ...
NirIzr's user avatar
  • 11.8k
1 vote

How to simulate responses from the file system

user578368's answer is correct, but to be more specific: (assuming that you are using Windows) you need to capture/detour the CreateFileA and CreateFileW function pair. They are the ones that programs ...
Shmuel Fomberg's user avatar
1 vote

Exe Unpack or Process Spy - Getting process internals

The easiest solution would be to monitor the application with API Monitor to see what parameters it supplies to ReadProcessMemory() and WriteProcessMemory().
Jason Geffner's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible