2
procmon can help in locating an entry point or a point of ingress
start procmon
remove all filters
enable capturing
try typing something like "turbox the t" in the start menu
stop capturing
go to tools->file summary->extension tab and expand the wildcard (*) entry
you may notice this file has been searched on the PATH paths
click one entry ...
2
as i commented in latest windows type index has been randomised
it is a xor of the index with nt!obHeaderCookie and the second byte of OBJECT_HEADER Address
see below
0: kd> ?? (char *)@$proc->ImageFileName
char * 0xffffa083`398ab4d0
"conhost.exe"
0: kd> ?? ((nt!_object_header *) @@masm( @$proc - @@c++(#FIELD_OFFSET(nt!_OBJECT_HEADER , ...
2
EPROCESS does not represent OBJECT_HEADER
!process 0 0 notepad.exe provides you an EPROCESS
I think object_header is not documented
on x86 (win7 sp2) it was 0x18 bytes before the OBJECT
the Typeindex field also has been repurposed if i am not mistaken in newer OS
the following display is from a win7sp2 32bit vm
kd> dt nt!_OBJECT_HEADER TypeIndex @$proc-...
1
Like I Commented this function is documented in winternl.h and you can use ntdll.lib to link with
also start address being a pointer will need 8 bytes in x64
#include <windows.h>
#include <winternl.h>
#include <stdio.h>
int main(void)
{
ULONG64 Tinfo = 0;
ULONG retlen = 0;
NTSTATUS ntqitret = NtQueryInformationThread(...
1
Yes, the command echo 0 > /proc/sys/kernel/randomize_va_space disables ASLR. From here:
The value shown will be one of the following:
0 = Disabled
1 = Conservative Randomization
2 = Full Randomization
There are several differences in the implementation of ASLR between Windows and Linux, you can search for them online, but to your question: In Windows, ...
Only top voted, non community-wiki answers of a minimum length are eligible
