Flag: Tornado! Hurricane!

OpenRCE Article Comments: Process Stalker vs. MS05-030

Article Abstract Process Stalker is a tool-set I put together that is capable of visually producing run-time profiles, state mapping and tracing. The goal of a successful stalk is to provide the reverse engineer with a targeted and intuitive interface to run-time block-level trace data.

This article serves as an intro-by-example to Process Stalker (Note: Process Stalker has since been deprecated by PaiMei) by providing a walk-through of the MS05-030 Microsoft Outlook Express NNTP Response Parsing Buffer Overflow Vulnerability. Further details, source code, binaries and manuals are available in the bundled Process Stalker archive available from the downloads page.

Full Article ...    Printer Friendly ...

Article Comments
fluxist Posted: Monday, July 11 2005 23:38.32 CDT
I am very impressed with the Process Stalker toolset and this article as well. Its so rare to read a really well written article of this nature. Keep up the good work! Im totally psyched to try out the toolset...

pedram Posted: Tuesday, July 12 2005 11:18.52 CDT
Much appreciated, thanks. There are some bug fixes I have made in response to community feedback that will be included in an updated release tomorrow. They are:

- gml.py: Fixed bug in parsing of GDE saved GML files.
- ps_state_mapper.py: Fixed bug in handling of filename arguments containing directory modifiers. ex: './seh.gml' and '../seh.gml'.
- process_stalker.exe: Replaced reliance on DebugActiveProcessStop() and DebugSetProcessKillOnExit() function resolution with dynamic function loading. This was preventing the tracer from running on systems that don't support the API such as Windows 2000.


Add New Comment
Comment:










There are 30,784 total registered users.


Recently Created Topics
Question about memor...
Dec/12
How can i find conne...
Nov/27
How can I write olly...
Oct/05
Career: Malware Reve...
Sep/30
How to produce separ...
Sep/20
How to decompile a f...
Sep/16
How to trap mouse cl...
Sep/03
Intel pin in loaded ...
Jun/27
Going to do today wi...
Jun/27
how to create delphi...
Jun/27


Recent Forum Posts
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n
OOP_RE tool available?
van7hu
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack
looking for a softwa...
raxen
Documenting reversed...
raxen
.orpc section what's...
mbin


Recent Blog Entries
oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

oleavr
Apr/17
frida.re 1.2.0 is out, with...

More ...


Recent Blog Comments
djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

newlulu on:
Jun/10
Branch tracing and LBR acce...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit