Re: searching through the address space of a process

From: dullien@gmx.de
Date: 10/14/01 

Date: Sun, 14 Oct 2001 12:47:51 -0700
From: dullien@gmx.de
Message-ID: <62446652.20011014124751@gmx.de>
To: Franklin DeMatto <franklin.lists@qdefense.com>
Subject: Re: searching through the address space of a process

Hey Franklin,

FD> Is there a way for a process (i.e., shellcode) to search through its
FD> address space (looking for a particular string, etc.)? I'm interested
FD> particularly in doing this under Windows, although Unix would be nice
FD> also. Can this be done without using any API/syscalls, just in assembly alone?
FD> I can see to basic ways of doing it:
FD> 1) Determining the address space, and then searching it
FD> 2) Trying every block, but catching the gpf/segfault exceptions

Of course it can be done - it is quite easy under windows as every
process can easily install their own exception handler through SEH
structures pointed to by FS:[0]. A lot of the old 29A virii used this
technique to scan for KERNEL32.DLL base address.

How long is the string you're looking for ? If you're searching for a
dword-aligned dword value on a certain page, you might wanna look into
rep scasd ;)

Need source ?

Cheers,
dullien@gmx.de

Relevant Pages

  • Re: String searching and lienar optimization
    ... There are *lots* of things known about pattern matching. ... string: "fjwkrjweoriosdaicfosdifidoiasosifosdifosdfio" for example.. ... Can this problem be posed suitable lfor linear optimization? ... What I am trying to do is to structure a string searching ...
    (sci.math.num-analysis)
  • RE: Oject value changing in a loop
    ... Sub zString_FindGeneral(ByRef IFindThis As String, ... ByRef IFmRow As Long, ByRef IFmCol As Integer, ByRef IToRow As Long, ByRef ... ' OFoundQty is the number of cells found containing the IFindThis string. ... 'Lines A, D, E work when searching one or multiple worksheets ...
    (microsoft.public.excel.programming)
  • Re: Parameter Query Form Problem
    ... Dim stDocName As String ... This is what I used to make my query, its was a Microsoft support site. ... controls on the form so it can run the query. ... Combo Box for searching Customer Name ...
    (microsoft.public.access.formscoding)
  • Re: string comparision in a file
    ... rakesh wrote: ... String which needs to be searched would be ... I would also welcome any other better of handling searching ... and there is considerable overhead time when reading a line (such as ...
    (comp.lang.cpp)
  • Re: Fastest way to search text file for string
    ... I'm searching a text file for a given string -- ... "I don't want to load the entire file into physical memory" ... Not stuck, that is the requirement. ...
    (microsoft.public.dotnet.languages.csharp)
Quantcast