Quote:
[Originally Posted by Kayaker;80364]Sounds like you've got sym/nms problems. |
I have to go out but I'll make a quick reply. Something hairy is happening. Symservers d/l'd a pdb file for ntoskrnl and converted it to a valid nms with all the functions names legible. It d/l's a pdb for k32 with all the files legible in a text editor. However, the nms it makes for k32 has no names in it and is only 40,000 bytes. ntoskernl nms is 837,460.
I've tried it several times and get a bad nms for k32. I'll have to convert it directly once I recall how to do it.
Quote:
[Originally Posted by Kayaker;80364]And you MUST use updated versions of symsrv.dll and dbghelp.dll (get them from WinDbg and replace the old Softice ones in the SymRtrvr.exe directory).Also make sure the appropriate NMS files are loaded (through the Sice Loader or right click on the nms file and default 'Load into Softice'). |
I knew about the symsrv.dll trick but not the dbghelp.dll. Thanks
Quote:
[Originally Posted by Kayaker;80364]Alternate Method 1: Disasm kernel32 in IDA and use the absolute address of BaseProcessStart. |
Did that, found baseprocessstart at 7C817044. Thanks
Quote:
[Originally Posted by Kayaker;80364]Method 2: Load any exe into Olly and check the stack window where you'll find the global calling address within BaseProcessStart |
What's Olly? Just kidding, blabberer.
Quote:
[Originally Posted by Kayaker;80364]Method 3: BPX NtSetInformationThread if *(esp+8)==9 NtSetInformationThread is called from BaseProcessStart, 9 is the Class ThreadQuerySetWin32StartAddress. F12 twice, F8 once and you should be back in BaseProcessStart ready to execute the PE (see address in Method 2) |
Found that one last night. It leads directly to rundll32, which leads into shell32 where most of the work seems to be done in loading the cpl file. thanks.
Quote:
[Originally Posted by Kayaker;80364]Method 4: BPX _KiFastSystemCall if eax==E5 |
Good one...oh great one of the reversing clan. Remember Burns...oh cheiftan o' the puddin' race? Ode to a Haggis:
Fair fa' your honest, sonsie face,
Great Chieftan o' the Puddin-race!
Aboon them a' ye tak your place,
Painch, tripe, or thairm:
Weel are ye wordy of a grace
As lang's my arm.
Quote:
[Originally Posted by Kayaker;80364]Method 5: Take up knitting as a hobby instead  |
My dear old Scottish granny tried to teach me knitting once but I was too interested in soccer balls, which she called 'a great bag of wind'.