New answers tagged

0

Great tool to achieve this in Windows is Application Verifier. The general idea is that you run your program with different heap inspections, using the verifier. For example - each allocation made on a separate memory page, Freed memory is not just returned to the pool but marked as freed, and any later access to it will cause an excpetion and so on. This ...


0

Many programs, especially malware, start a suspended child process (CreateProcess variants), overwrite its code with their own (WriteProcessMemory with or without VirtualAllocEx) and resume the main thread (ResumeThread). Also look for ReadProcessMemory, it is possible that the call to OpenProcess that you see is actually the same process reading from its ...


2

just modified your source a bit to print Rip prior and post in handler added another exception and eliminated a warning (empty handler block) and tested with +1,+2,+3 +4 +5 on the handler Hardware breaks doesn't get hit I haven't checked by single stepping inside RtlpExecuteHandlerForxxx calls here is a modified src #include <windows.h> #...


2

There are ways to do it without resorting to hooking or drivers. For example alternate data streams (ADS), or creating files with "illegal", i.e. reserved, names (NUL, CON ... trailing ., alternative casing to an existing file). Yep, that's right a trailing dot in a file name is illegal in Win32, but the most frequently used file system (NTFS) has no ...


0

It looks like you are looking for some hooking frameworks. You can check detours and Frida for this purpose. Check in particular this example.


2

which debugger are you using ? most debuggers will decipher the handle on the spot that is you can find out the handle info when you have broken on the WriteProcessMemory() Call itself here is how you can do it with windbg i am debugging ollydbg and olllydbg ais debugging calc.exe ollydbg is setting a breakpoint in calc.exe (uses WriteProcessMemory() ) ...


Top 50 recent answers are included