Flag: Tornado! Hurricane!

OpenRCE Article Comments: Process Stalker vs. MS05-030

Article Abstract Process Stalker is a tool-set I put together that is capable of visually producing run-time profiles, state mapping and tracing. The goal of a successful stalk is to provide the reverse engineer with a targeted and intuitive interface to run-time block-level trace data.

This article serves as an intro-by-example to Process Stalker (Note: Process Stalker has since been deprecated by PaiMei) by providing a walk-through of the MS05-030 Microsoft Outlook Express NNTP Response Parsing Buffer Overflow Vulnerability. Further details, source code, binaries and manuals are available in the bundled Process Stalker archive available from the downloads page.

Full Article ...    Printer Friendly ...

Article Comments
fluxist Posted: Monday, July 11 2005 23:38.32 CDT
I am very impressed with the Process Stalker toolset and this article as well. Its so rare to read a really well written article of this nature. Keep up the good work! Im totally psyched to try out the toolset...

pedram Posted: Tuesday, July 12 2005 11:18.52 CDT
Much appreciated, thanks. There are some bug fixes I have made in response to community feedback that will be included in an updated release tomorrow. They are:

- gml.py: Fixed bug in parsing of GDE saved GML files.
- ps_state_mapper.py: Fixed bug in handling of filename arguments containing directory modifiers. ex: './seh.gml' and '../seh.gml'.
- process_stalker.exe: Replaced reliance on DebugActiveProcessStop() and DebugSetProcessKillOnExit() function resolution with dynamic function loading. This was preventing the tracer from running on systems that don't support the API such as Windows 2000.


Add New Comment
Comment:










There are 30,779 total registered users.


Recently Created Topics
Intel pin in loaded ...
Jun/27
Going to do today wi...
Jun/27
how to create delphi...
Jun/27
enabling menu in a s...
Jun/18
How to get the Image...
Jun/17
OllyDBG Process Term...
Apr/28
Reversing opcode
Apr/24
Question about debbu...
Apr/16
IDA PRO Struct Point...
Apr/15
Problem with ollydbg
Mar/22


Recent Forum Posts
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n
OOP_RE tool available?
van7hu
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack
looking for a softwa...
raxen
Documenting reversed...
raxen
.orpc section what's...
mbin
Pydbg load() issue
phreak


Recent Blog Entries
oleavr
Jun/25
Build a debugger in 5 minutes

oleavr
Apr/17
frida.re 1.2.0 is out, with...

gareebnavas
Jan/21
Android Malware Analysis

oleavr
Dec/21
frida.github.io: scriptable...

chr1x
Nov/05
!apilookup - Win32 API Func...

More ...


Recent Blog Comments
pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

newlulu on:
Jun/10
Branch tracing and LBR acce...

newlulu on:
Jun/10
Advanced debugging techniques

newlulu on:
Jun/10
2 anti-trace mechanisms spe...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit