Interesting stuff

Index > Windows > Interesting stuff

Author

Thread

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 10 Aug 2011, 14:51

Recently I just got into the process of handling my own exceptions, but before I start, I thought I'd do a little reading and I got something from wikipedia.

http://en.wikipedia.org/wiki/Win32_Thread_Information_Block

I like this part

Quote:

The TIB can be used to get a lot of information on the process without calling Win32 API. Examples include emulating GetLastError(), GetVersion(). Through the pointer to the PEB one can obtain access to the import tables (IAT), process startup arguments, image name, etc.

Interesting huh ?

10 Aug 2011, 14:51

idle

Joined: 06 Jan 2011
Posts: 440
Location: Ukraine

idle 10 Aug 2011, 15:40

observing own code with ollydbg on os-calls i saw fs:xxxx readings, and now i know what that is, thanks!

10 Aug 2011, 15:40

AsmGuru62

Joined: 28 Jan 2004
Posts: 1619
Location: Toronto, Canada

AsmGuru62 10 Aug 2011, 16:41

Imagine if Microsoft will change TIB layout, so API works and 'direct' FS:XXXX manipulation fails! Probably far fetched, but it can happen.

10 Aug 2011, 16:41

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 10 Aug 2011, 17:30

Quote:

Imagine if Microsoft will change TIB layout, so API works and 'direct' FS:XXXX manipulation fails! Probably far fetched, but it can happen.

yup. Is till want to see FS in use but direct API, like the author said.

Maybe am gonna have to ask him/her how it can be done.

10 Aug 2011, 17:30

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 10 Aug 2011, 17:35

PS: I was thinking, if one can access the whole memmory and enumerate all the code and data in there(ie. running programs), can you not use the method above(Win32 Thread Information Block) to get the basic info about each & every particular program, thus bypassing API ?

Hmm?....

Just another day in the computer virus lab.. Very Happy

10 Aug 2011, 17:35

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum