PDA

View Full Version : how to get executable loaded info in remote machine using kernel debugging using wind


ronnie291983
February 25th, 2010, 01:18
I am running the target machine in the vmware and i was able to connect to the target machine using windbg, this is for kernel debugging,

when i tried to enumerate loaded modules in the remote system it just showed me the list of sys files and i was not able to find any loaded exe files.

Is there any way find the list of exe files loaded in the remote system?

c0ldcrow
February 25th, 2010, 07:22
That's because exe files are not "loaded", at least not in such a way that you think. What you probably want is to get the list of running processes on the system (since processes usually start from .exe files ).

You can do that with windbg !process extension. Check the help file for details.

Kayaker
February 26th, 2010, 22:16
There might be some interest in this. I don't how well it works for remote debugging.

Memory Forensics Debugger Extension for Microsoft Debugging Tools - This extension for WinDbg allows to detect all hidden processes

http://forensic.seccure.net/
http://forensic.seccure.net/tools/hidden.zip