EMO Style ForumPro - Hos Geldiniz
Giriş yap

Şifremi unuttum

Istatistikler
Toplam 202 kayıtlı kullanıcımız var
Son kaydolan kullanıcımız: AnthonyFurey3

Kullanıcılarımız toplam 1186 mesaj attılar bunda 862 konu
Tarıyıcı
 Kapı
 Indeks
 Üye Listesi
 Profil
 SSS
 Arama
Arama
 
 

Sonuç :
 


Rechercher çıkıntı araştırma

RSS akısı


Yahoo! 
MSN 
AOL 
Netvibes 
Bloglines 


Kimler hatta?
Toplam 4 kullanıcı online :: 0 Kayıtlı, 0 Gizli ve 4 Misafir

Yok

[ Bütün listeye bak ]


Sitede bugüne kadar en çok 92 kişi Paz Ağus. 28, 2016 6:58 am tarihinde online oldu.
En son konular
» İnternetten Para Kazandıran Oyun ! Ödeme Alt Limiti Yok ! DEV KONU
Cuma Ağus. 29, 2014 8:33 am tarafından Hello EMO

» goldenchase.net maden yaparak para kazanma
Cuma Ağus. 29, 2014 8:18 am tarafından Hello EMO

» etichal hacker görsel egitim seti
Çarş. Ağus. 06, 2014 4:57 am tarafından Hello EMO

» KO TBL Source C#
Ptsi Ara. 09, 2013 6:36 am tarafından Hello EMO

» x86 Registers
C.tesi Ağus. 24, 2013 5:02 am tarafından Hello EMO

» [Tutorial] Pegando Address, Pointers de WYD
Çarş. Tem. 10, 2013 7:25 am tarafından Hello EMO

» [Tutorial] Pegando Address, Pointers de CS Metodo²
Çarş. Tem. 10, 2013 7:23 am tarafından Hello EMO

» [Tutorial] Aprendendo basico deASM OLLYDBG
Çarş. Tem. 10, 2013 7:22 am tarafından Hello EMO

» Basic C# DLL injector
Ptsi Tem. 08, 2013 7:48 am tarafından Hello EMO

Reklam

Finding the Thread ID from the Executable Name

Önceki başlık Sonraki başlık Aşağa gitmek

Finding the Thread ID from the Executable Name

Mesaj tarafından Hello EMO Bir Paz Nis. 24, 2011 7:02 am

[quote name='Stork' timestamp='1296612384' post='1210']
If you only know the name of the executable of your target, then you can use this code to locate it.

Kod:

unsigned long GetTargetThreadIdFromProcname(char *procName)
{
  PROCESSENTRY32 pe;
  HANDLE thSnapshot, hProcess;
  BOOL retval, ProcFound = false;
  unsigned long pTID, threadID;

  thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

  if(thSnapshot == INVALID_HANDLE_VALUE)
  {
      MessageBox(NULL, "Error: unable to create toolhelp snapshot", "Loader", NULL);
      return false;
  }

  pe.dwSize = sizeof(PROCESSENTRY32);

    retval = Process32First(thSnapshot, &pe);

  while(retval)
  {
      if(StrStrI(pe.szExeFile, procName) )
      {
        ProcFound = true;
        break;
      }

      retval    = Process32Next(thSnapshot,&pe);
      pe.dwSize = sizeof(PROCESSENTRY32);
  }

  CloseHandle(thSnapshot);
   
  _asm {
      mov eax, fs:[0x18]
      add eax, 36
      mov [pTID], eax
  }

  hProcess = OpenProcess(PROCESS_VM_READ, false, pe.th32ProcessID);
  ReadProcessMemory(hProcess, (const void *)pTID, &threadID, 4, NULL);
  CloseHandle(hProcess);

  return threadID;
}


Kod:
_asm {
      mov eax, fs:[0x18]
      add eax, 36
      mov [pTID], eax
    }
This is required as there is no C++ equivalent command to capture the thread ID. FS:[0x18] holds the Thread Environment Block or TEB of a process. Now, what does the TEB look like (see image below)? Notice the location of 0x2C - its the threadID associated with the TEB. We loop through the process list with Process32Next() unitl we find the process name we are interested in. We then open up that process, read TEB+0x2C, and dump it into our threadID variable.

Kod:

Position    Length    Windows Versions    Description
FS:[0x00]    4    Win9x and NT    Current Structured Exception Handling (SEH) frame
FS:[0x04]    4    Win9x and NT    Top of stack
FS:[0x08]    4    Win9x and NT    Current bottom of stack
FS:[0x0C]    4       Unknown - TIB Subsystem?
FS:[0x10]    4    NT    Fiber data
FS:[0x14]    4    Win9x and NT    Arbitrary data slot
FS:[0x18]    4    Win9x and NT    Linear address of TIB
---- End of NT subsystem independent part ----
FS:[0x1C]    4    NT    Environment Pointer
FS:[0x20]    4    NT    Process ID
FS:[0x24]    4    NT    Current thread ID
FS:[0x28]    4    NT    Active RPC Handle
FS:[0x2C]    4    Win9x and NT    Linear address of the thread-local storage array
FS:[0x30]    4    NT    Linear address of Process Environment Block (PEB)
FS:[0x34]    4    NT    Last error number
FS:[0x38]    4    NT    Count of owned critical sections
FS:[0x3C]    4    NT    Address of CSR Client Thread
FS:[0x40]    4    NT    Win32 Thread Information
FS:[0x44]    124    NT, Wine    Win32 client information (NT), user32 private data (Wine), 0x60 = LastError (Win95), 0x74 = LastError (WinME)
FS:[0xC0]    4    NT    Reserved for Wow32
FS:[0xC4]    4    NT    Current Locale
FS:[0xC8]    4    NT    FP Software Status Register
FS:[0xCC]    216    NT, Wine    Reserved for OS (NT), kernel32 private data (Wine)
FS:[0x124]    4    NT    Pointer to KTHREAD (ETHREAD) structure
FS:[0x1A4]    4    NT    Exception code
FS:[0x1A8]    18    NT    Activation context stack
FS:[0x1BC]    24    NT, Wine    Spare bytes (NT), ntdll private data (Wine)
FS:[0x1D4]    40    NT, Wine    Reserved for OS (NT), ntdll private data (Wine)
FS:[0x1FC]    1248    NT, Wine    GDI TEB Batch (OS), vm86 private data (Wine)
FS:[0x6DC]    4    NT    GDI Region
FS:[0x6E0]    4    NT    GDI Pen
FS:[0x6E4]    4    NT    GDI Brush
FS:[0x6E8]    4    NT    Real Process ID
FS:[0x6EC]    4    NT    Real Thread ID
FS:[0x6F0]    4    NT    GDI cached process handle
FS:[0x6F4]    4    NT    GDI client process ID (PID)
FS:[0x6F8]    4    NT    GDI client thread ID (TID)
FS:[0x6FC]    4    NT    GDI thread locale information
FS:[0x700]    20    NT    Reserved for user application
FS:[0x714]    1248    NT    Reserved for GL
FS:[0xBF4]    4    NT    Last Status Value
FS:[0xBF8]    532    NT    Static UNICODE_STRING buffer
FS:[0xE0C]    4    NT    Pointer to deallocation stack
FS:[0xE10]    256    NT    TLS slots, 4 byte per slot
FS:[0xF10]    8    NT    TLS links (LIST_ENTRY structure)
FS:[0xF18]    4    NT    VDM
FS:[0xF1C]    4    NT    Reserved for RPC
FS:[0xF28]    4    NT    Thread error mode (RtlSetThreadErrorMode)
[/quote]

alnıtı


Hello Kitty
vs
eMoStyLe




Hello EMO
EMO Team
EMO Team

Cinsiyet : Erkek
Burçlar : Yay
Yılan
Mesaj Sayısı : 935
Puan : 241393
Rep Puanı : 18
Doğum tarihi : 28/11/89
Kayıt tarihi : 21/07/09
Yaş : 27
Nerden : EMO WorlD
İş/Hobiler : RCE Student / Game Hacking / Learn Beginner C#,C++,Delphi
Lakap : EMO

Kullanıcı profilini gör http://emostyle.myforumpro.com

Sayfa başına dön Aşağa gitmek

Önceki başlık Sonraki başlık Sayfa başına dön

- Similar topics

 
Bu forumun müsaadesi var:
Bu forumdaki mesajlara cevap veremezsiniz