dealer eprocess

with the PE loading routine (LDR function family), you have to look at the Microsoft CRT source code. The CRT code sets up the CRT using heap (mainly for the new syntax) you can have a comprehensive understanding of heap applications, such as heapinit. c. heaphook. c. heapdump. c. heapwalk. c. Next we will talk about the virtual memory organization. The basic structure of virtual memory management is VAD (virtual address descriptors ). Because the Windows NT/2000 memory subsystem actually alloc

). Suppose we allocate 0 x B18 bytes, in fact, the system will allocate 0xb20 bytes, and the eight more bytes are pool_header structure, which is used for pool management. The structure of pool_header is as follows: + 0x000 previussize: POS 0, 9 bits+ 0x000 poolindex: POS 9, 7 bits+ 0x002 blocksize: POS 0, 9 bits+ 0x002 pooltype: POS 9, 7 bits+ 0x000 ulong1: uint4b+ 0x004 processbilled: ptr32 _ eprocess+ 0x004 pooltag: uint4b+ 0x004 allocatorbacktrace

When zwterminateprocess hook is written, the parameters that hook zwterminateprocess are handle processhandle and ntstatus exitstatus. The structure is as follows: Ntstatus Zwterminateprocess ( In handleProcesshandle, In ntstatusExitstatus ); When processhandle is null, it indicates that the process has ended. When the process ends other processes, processhandle points to the process object of the terminated process. To obtain the name of the terminated process, perform the following operations

follows://************************************// Function Name: hookntterminateprocess // Description: Custom ntopenprocess, used to implement the hook kernel API // Date: 2013/06/28 // parameter: processhandle: Process Handle exitstatus: // return value: // *********************************** ntstatus hookntterminateprocess (_ in_opt handle processhandle, __in ntstatus exitstatus) {ulong upid; ntstatus rtstatus; pchar pstrprocname; peprocess; ansi_string strprocn Ame; // obtain the fileobject

); Return int (CID. uniqueprocess );} Extern "C"Int wmain (INT argc, wchar_t * argv []){Unicode_string imagefile;Rtlinitunicodestring ( imagefile, argv [1]); Exec ( imagefile, argv [2]); Return 0;} Usage: For ppp.exe after compilation, Run "C: root directory" qqq.exe" with PPP. Set "parent path" to "assumer.exe", and" PID "of" assumer.exe "***. On the console, enter:Ppp.exe /?? /C:/qqq.exe ***Use other tools to check the parent process of qqq.exe, instead of PPP, but explorer. At the time of cr

Start of Windbg script and expansion Tool I haven't written any articles for a long time. Recently I have been busy with script and extension tools for the project's adjustable nature. In view of the strong power of windbg and the relatively small amount of information, I decided to write a series of articles on how to develop Windbg scripts and extended commands. Your support is my greatest motivation. I hope this series of articles will help you. So what does a complete windbg script look like

Problem: when using windbg + vmare for kernel debugging, multi-thread switching may occur, resulting in a thread being no longer the same when the number of F10, this greatly affects normal debugging. Solution: 1. You can set a breakpoint for a process or thread: BP/P eprocess address BP/t ethread address. 2. You can use scripts. I have never used this method, but I don't understand windbg scripts. 3. The last method is also stupid, that is, to b

process space. When you need to read and write these virtual addresses, it calls the relevant kernel functions, lock the physical and logical pages corresponding to these virtual addresses to prevent physical pages from being replaced and logical pages from being modified or released. In another case, the driver can also use MDL to execute pure kernel tasks. In particular, if only non-Paging memory is called, these pages will not be replaced in the page file, therefore, you do not need to con

(expressed in pseudo code ): Disablereadprotection (); Modifyssdt (); Enablereadprotection (); Intel's documentation states: "If cr0.wp = 1, the access type is determined by the R/W flag of the page Directory and page table items. If cr0.wp = 0, the superuser permission allows read and write access ." Therefore, to damage write protection on ssdt, We need to temporarily clear the write protect (WP) Mark. By assigning your own MDL to describe ssdt, we can disable read protection. MDL is associat

It is very convenient to use ironruby + sharpdevelop to develop GUI programs. The ironruby hands-on series program is to use Ruby to write a series of gadgets to familiarize themselves with ironruby.Ironruby installed on my machine isIronruby 1.0 for. NET 2.0 SP1Ironruby: http://ironruby.codeplex.com/releases Download the sample code in this article: Click to download this file. After decompression, run. dat. My homepage: Www.w-yong.com This article describes how to write a Process Manager, in

;. Formats 00428378Evaluate expression:hex:00428378decimal:4359032octal:00020501570binary:00000000 01000010 10000011 01111000Chars:. b.xTime:fri Feb 20 18:50:32 1970Float:low 6.1083e-039 High 0double:2.15365e-317Based on the structure of the PAE32-bit linear address we derive:Page Catalog pointer Table index = 0x0Page Directory index is 000000 010 = 0x2Page Table index is 00010 = 0x28In-page offset is 0011 01111000 = 0x378We use!process 0 0 to find the eproc