Hot answers tagged

2

procmon can help in locating an entry point or a point of ingress start procmon remove all filters enable capturing try typing something like "turbox the t" in the start menu stop capturing go to tools->file summary->extension tab and expand the wildcard (*) entry you may notice this file has been searched on the PATH paths click one entry ...


2

as i commented in latest windows type index has been randomised it is a xor of the index with nt!obHeaderCookie and the second byte of OBJECT_HEADER Address see below 0: kd> ?? (char *)@$proc->ImageFileName char * 0xffffa083`398ab4d0 "conhost.exe" 0: kd> ?? ((nt!_object_header *) @@masm( @$proc - @@c++(#FIELD_OFFSET(nt!_OBJECT_HEADER , ...


2

EPROCESS does not represent OBJECT_HEADER !process 0 0 notepad.exe provides you an EPROCESS I think object_header is not documented on x86 (win7 sp2) it was 0x18 bytes before the OBJECT the Typeindex field also has been repurposed if i am not mistaken in newer OS the following display is from a win7sp2 32bit vm kd> dt nt!_OBJECT_HEADER TypeIndex @$proc-...


1

Like I Commented this function is documented in winternl.h and you can use ntdll.lib to link with also start address being a pointer will need 8 bytes in x64 #include <windows.h> #include <winternl.h> #include <stdio.h> int main(void) { ULONG64 Tinfo = 0; ULONG retlen = 0; NTSTATUS ntqitret = NtQueryInformationThread(...


1

Yes, the command echo 0 > /proc/sys/kernel/randomize_va_space disables ASLR. From here: The value shown will be one of the following: 0 = Disabled 1 = Conservative Randomization 2 = Full Randomization There are several differences in the implementation of ASLR between Windows and Linux, you can search for them online, but to your question: In Windows, ...


Only top voted, non community-wiki answers of a minimum length are eligible