Flag: Tornado! Hurricane!

OpenRCE Article Comments: Process Stalker vs. MS05-030

Article Abstract Process Stalker is a tool-set I put together that is capable of visually producing run-time profiles, state mapping and tracing. The goal of a successful stalk is to provide the reverse engineer with a targeted and intuitive interface to run-time block-level trace data.

This article serves as an intro-by-example to Process Stalker (Note: Process Stalker has since been deprecated by PaiMei) by providing a walk-through of the MS05-030 Microsoft Outlook Express NNTP Response Parsing Buffer Overflow Vulnerability. Further details, source code, binaries and manuals are available in the bundled Process Stalker archive available from the downloads page.

Full Article ...    Printer Friendly ...

Article Comments
fluxist Posted: Monday, July 11 2005 23:38.32 CDT
I am very impressed with the Process Stalker toolset and this article as well. Its so rare to read a really well written article of this nature. Keep up the good work! Im totally psyched to try out the toolset...

pedram Posted: Tuesday, July 12 2005 11:18.52 CDT
Much appreciated, thanks. There are some bug fixes I have made in response to community feedback that will be included in an updated release tomorrow. They are:

- gml.py: Fixed bug in parsing of GDE saved GML files.
- ps_state_mapper.py: Fixed bug in handling of filename arguments containing directory modifiers. ex: './seh.gml' and '../seh.gml'.
- process_stalker.exe: Replaced reliance on DebugActiveProcessStop() and DebugSetProcessKillOnExit() function resolution with dynamic function loading. This was preventing the tracer from running on systems that don't support the API such as Windows 2000.


Add New Comment
Comment:










There are 30,963 total registered users.


Recently Created Topics
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Immunity Debugger Re...
Aug/03
Question about memor...
Dec/12
How can i find conne...
Nov/27


Recent Forum Posts
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n
OOP_RE tool available?
van7hu
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack


Recent Blog Entries
nieo
Mar/22
Android Application Reversing

halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit