Flag: Tornado! Hurricane!

OpenRCE Article Comments: Process Stalker vs. MS05-030

Article Abstract Process Stalker is a tool-set I put together that is capable of visually producing run-time profiles, state mapping and tracing. The goal of a successful stalk is to provide the reverse engineer with a targeted and intuitive interface to run-time block-level trace data.

This article serves as an intro-by-example to Process Stalker (Note: Process Stalker has since been deprecated by PaiMei) by providing a walk-through of the MS05-030 Microsoft Outlook Express NNTP Response Parsing Buffer Overflow Vulnerability. Further details, source code, binaries and manuals are available in the bundled Process Stalker archive available from the downloads page.

Full Article ...    Printer Friendly ...

Article Comments
fluxist Posted: Monday, July 11 2005 23:38.32 CDT
I am very impressed with the Process Stalker toolset and this article as well. Its so rare to read a really well written article of this nature. Keep up the good work! Im totally psyched to try out the toolset...

pedram Posted: Tuesday, July 12 2005 11:18.52 CDT
Much appreciated, thanks. There are some bug fixes I have made in response to community feedback that will be included in an updated release tomorrow. They are:

- gml.py: Fixed bug in parsing of GDE saved GML files.
- ps_state_mapper.py: Fixed bug in handling of filename arguments containing directory modifiers. ex: './seh.gml' and '../seh.gml'.
- process_stalker.exe: Replaced reliance on DebugActiveProcessStop() and DebugSetProcessKillOnExit() function resolution with dynamic function loading. This was preventing the tracer from running on systems that don't support the API such as Windows 2000.


Add New Comment
Comment:










There are 30,633 total registered users.


Recently Created Topics
Your Best Slim &...
Apr/19
Amazing Your Lucky Skin
Apr/18
Your Skin Very Soft...
Apr/17
Question about debbu...
Apr/16
IDA PRO Struct Point...
Apr/15
problems with pseudo...
Apr/04
Problem with ollydbg
Mar/22
Should binaries be n...
Mar/22
Ida pro on infineon ...
Mar/10
need help about an D...
Feb/25


Recent Forum Posts
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack
looking for a softwa...
raxen
Documenting reversed...
raxen
.orpc section what's...
mbin
Pydbg load() issue
phreak
Pydbg load() issue
netw0rm
How would you interp...
mbin
Pydbg load() issue
phreak


Recent Blog Entries
martanhawkings
Apr/19
iPhone 4S- Purchase Apple’s...

elenablacik
Apr/18
Cleanse Pure Premium Supple...

hermesfrsac
Apr/17
Il convient que vous devrie...

oleavr
Apr/17
frida.re 1.2.0 is out, with...

Michealhance
Apr/17
Remove Wrinkles For Longer

More ...


Recent Blog Comments
pedram on:
Dec/21
frida.github.io: scriptable...

cin100dy on:
Dec/16
Devil May Cry Cosplay Costu...

NeOXQuiCk on:
Nov/26
DONGLE

maharlee on:
Nov/21
Cheap Nike Shoes NZ,Nike Sh...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit