ntdll

Hooking NtCreateFile API from ntdll.dll with EasyHook (c#)

由 ⅰ亾dé卋堺 提交于 2019-12-08 05:40:06
问题 This is the first time I try to hook windows API. My goal is to monitor all files that a process is going to create/open/read/write. In order to be the most verbose possible, I decided to hook the ntdll.dll API such as NtCreateFile() and NtOpenFile(). So, in order to acheive this goal, I went on EasyHook, which seems easy and robust. I've essetially followed the FileMon example, changing what I really wanted: the Hooked function. When I try to read information about the file that is going to

Delete a mutex from another process

由 会有一股神秘感。 提交于 2019-12-07 02:25:54
问题 Using the topic Overview - Handle Enumeration , number 5, the attempt Close mutex of another process and and information from Mutex analysis, the canary in the coal mine and discovering new families of malware/ , I have came up with: Attempt 1: http://pastebin.com/QU0WBgE5 You must open Notepad first. Needless to say, this is not working for me. I need better error checking to figure out what's going on. I don't know how to get mutex pointers in the format I see them in Process Explorer. My

Delete a mutex from another process

由 南笙酒味 提交于 2019-12-05 06:19:35
Using the topic Overview - Handle Enumeration , number 5, the attempt Close mutex of another process and and information from Mutex analysis, the canary in the coal mine and discovering new families of malware/ , I have came up with: Attempt 1: http://pastebin.com/QU0WBgE5 You must open Notepad first. Needless to say, this is not working for me. I need better error checking to figure out what's going on. I don't know how to get mutex pointers in the format I see them in Process Explorer . My goal is to be able to delete/kill of the mutex handles created by a process so more than one instance

Unexplained crashes related to ntdll.dll

由 血红的双手。 提交于 2019-12-04 09:56:34
I have an application that I've written that crashes intermittently, but I'm unable to capture an exception at the application layer. I always get an entry in the event log but doesn't give me much info: Faulting application name: BCS-UI.exe, version: 1.0.11.0, time stamp: 0x5c0edcbd Faulting module name: ntdll.dll, version: 10.0.17134.376, time stamp: 0x4358e406 Exception code: 0xc0000374 Fault offset: 0x000d8829 Faulting process id: 0x39b0 Faulting application start time: 0x01d49161c80079a0 Faulting application path: C:\Gogs Local\SMR_Windows_UI\BCS-UI\BCS-UI\bin\Release\BCS-UI.exe Faulting

Why is ntdll.dll crashing my c++ executable?

由 て烟熏妆下的殇ゞ 提交于 2019-12-03 03:05:09
I am having trouble to get a Visual C++ executable to work, the app crashes , here is what I have seen in the event viewer. Faulting application name: submit.exe, version: 0.0.0.0, time stamp: 0x50a3cce7 Faulting module name: ntdll.dll, version: 6.1.7601.17514, time stamp: 0x4ce7ba58 Exception code: 0xc0000374 Fault offset: 0x000ce653 Faulting process id: 0x8fc Faulting application start time: 0x01cdc2a3da4f2997 Faulting application path: c:\submit.exe Faulting module path: C:\Windows\SysWOW64\ntdll.dll Report Id: 1813823a-2e97-11e2-8675-000c29229191 The executable compiled in old versions of

GetProcAddress vs __declspec( dllimport )

由 对着背影说爱祢 提交于 2019-11-29 18:17:24
What's the difference between the two? i.e. for finding functions such as Nt___ or Zw___ In MS Windos, there is a difference between implicit linking and explicit linking . Implicit Linking The executable is linked against the accompanying library ( .lib file) which provides the symbols exported from DLL. (The functions for import are remarked with __declspec(dllimport) .) Implicit linked DLLs are loaded with executable. Explicit Linking The program loads a DLL explicitly calling LoadLibrary() . To call functions of the DLL their address has to be determined using GetProcAddress() . However,

How to use NtOpenProcess

由 对着背影说爱祢 提交于 2019-11-28 14:02:44
问题 I am trying to use NtOpenProcess() I have not find any example in town. I am getting an error any help is much appreciated. int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE prevInstance, PSTR szCmdLine, int showCmd) { HANDLE handle; HWND myWindow =FindWindow(NULL, L"Notepad"); PCLIENT_ID PID; GetWindowThreadProcessId(myWindow, (LPDWORD)&PID); ZwOpenProcess(&handle, PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, NULL,PID); return 0; } The errors are 1>c:\users\asus\source\repos

GetProcAddress vs __declspec( dllimport )

由 久未见 提交于 2019-11-28 12:38:25
问题 What's the difference between the two? i.e. for finding functions such as Nt___ or Zw___ 回答1: In MS Windos, there is a difference between implicit linking and explicit linking . Implicit Linking The executable is linked against the accompanying library ( .lib file) which provides the symbols exported from DLL. (The functions for import are remarked with __declspec(dllimport) .) Implicit linked DLLs are loaded with executable. Explicit Linking The program loads a DLL explicitly calling
订阅 ntdll