English
books & Tutorials

Direct code Injection with XProfan

 

Andre
Rohland
love Community,

in the welt one (of my) derzeitigen Projektes (Überwachung one Prozesses) use I The Possibility, ausführbaren code directly in a ongoing Process To injizieren, the too to the termination the aufrufenden Program moreover carryed out becomes.

there these routine in another Process runs, is tappt im dunkeln so in the XP-Taskmanager not visible, displayed becomes there only the (by the Injection infizierte), d.h. go wrong Process.

in the angefügten example becomes by the Injector.exe first of all the program Muttertier.exe launched. thereafter becomes the ausführbare code into Process Muttertier.exe injiziert, the aufrufende Program Injector.exe exits itself to ca. 3 sec. The injizierte code launch the program prozess2.exe and screen, whether it yet runs.

is this not the case, becomes it new launched. The routine divides prozess2.exe too with, whether it itself at Start circa a first and normalen Start, or circa a Start to fire through termination or Taskmanager deals. this gives prozess2.exe properly from.

Getestet is this program yet only with Win XP/SP3. with one Error ( z.B. Muttertier.exe has a Error fixes and must exits go - trouble too on Microsoft Send ?) could I yet no Beeinträchtigungen the Systemstabilität check.

nevertheless point I thereupon, that the wildly herumexperimentieren of these Program on own risk results.

The konkrete Verfahrensweise the Programming such items lying in a ( for me ) so-called Grauzone. The direct Injizierung of ausführbarem code in others processes has sure in Spezialfällen too a Legitimacy, lying but too very heavy in the sew the Missbrauchs through Virenprogrammierung... .

I eröffne therefore herewith a Discussion over:

- sense and nonsense such programs...
- must one really all ! Usern the Community such Techniken nachvollziehbar explain ?

I were now Your opinion. To The majority the Posts one eindeutiges Votum abgibt, I will me with einschlägigen Offenlegungen, Quelltexten and further Aids/Explanations hold back.

you are now dran...

Greeting André

1.065 kB
Hochgeladen:03/05/09
Downloadcounter496
Download
 
03/04/09  
 



means one A-D-plan:

a) by View source declared and so nachvollziebar
b) no Binarys
c) no Sicherheitslücke beschreibend
d) against no right verstossend

the Injizieren one Codes in a strangers Process can fundamentally A-D-plan-konform his, however not if in z.B. one M$-Program injiziert becomes - because it imho mindest against The Nubeds of M$ verstösst (where I naturally brill can, only one Bauchgefühl).

Injizieren on the best here always only from and Own Applications by View source.

I would already on my own on it interested because of the many Kleinigkeiten which one therefore erschliessen can.
Verschoben of programs to courses.
 
03/05/09  
 




Andre
Rohland
@IF:
I have whom Download updated and my first Posting adjusted, circa suitable deliberating concerning M$ at the outset from the lane to go ( - on Bauchgefühle ought to one thoroughly listen...).

to that A-D-plan:
The spots b), c) and d) understand itself really of self,
b) except the Download-demonstration becomes through me with safety no Program supplied, with welchem irgendwer wild drauflos injizieren and Perhaps Malwarecode in stranger processes einschleusen can.
c) over Sicherheitslücken can in the network already sufficient nachlesen, here deals it itself anyway not circa a such, there M$ The suitable functions and the KnowHow for self available position.
d) this is already a little bit tougher, because it's located in the hand which, the these Programmiertechnik using and standing so in the engsten Context with

a) nachvollziehbarer View source
very therefore have I Yes The obigen Questions Discussion set (and hope therefore yet on further Positionierungen To this Topic).
too Rolands opinion moreover would me brennend interested...

Greeting
André
 
03/05/09  
 



solely the small Einwand, that a) by View source declared and so nachvollziebar not exakt same a) nachvollziehbarer View source is.
 
03/05/09  
 



The konkrete Verfahrensweise the Programming such items lying in a ( for me ) so-called Grauzone.

gray and Tabuzonen there only, where a passing/offence starting.

otherwise is the thing to that program there, means only no schiss having.
 
03/05/09  
 



One ONU (Otto Normaluser) erbittet resolution:

What is one A-D-plan?
what are Nubeds of M$
is Injizieren somehow with the TSR-engineering (Terminate and Stay Resident) under DOS vergleichbar?
What is the Difference between `per View source declared and so nachvollziebar and nachvollziehbarer View source?
what are Tabuzonen in the EDV?

Greeting
 
03/05/09  
 




Andre
Rohland
Hello Peter (Bierbach),

Please in the formulation:
The konkrete Verfahrensweise the Programming such items lying in a ( for me ) so-called Grauzone. too The words into clinging mind.

Perhaps have I Yes something umständlich framed, meant is still so really only, that one and diesselbe programmiertechnische Verfahrensweise To good Zwecken ( = Spezialfälle ), as well as To wicked Zwecken ( = injizieren of Malwarecode z.B. in explorer.exe, svchost.exe etc.) uses go can. The of me so designated Grauzone is means sozusagen the yin and yang in the Programming.

If I of beginning on only from the usage for passing/Straftaten gone out would, had I this issue still well hardly unzipped and to Discussion set, or ???

To your recommendation ( in Your times set... ):
you have me saponaceous erwischt! fact, I have Schiss ( daily in the morning, on time circa 6.30 watch )
well then time Please all joking aside !

If it because possible would, Please no Fäkaliensprache More in Answer on my Postings, the Topic is me simply To serious... .

jmp @Next:
I have no fear before it, a ausführlichen Source with entsprechender Kommentierung To post.

jmp @Next:
i sit neither on my code around as an Glucke, finally have I so the bicycle not really new made up and be really gladly ready, my Experience mitzuteilen.

for me goes it here sooner circa a gewisse blame...

alone this is the reason for my ask in the first Posting To this Topic !

be you Please too above in the Klaren, that not only our Community this Posting reading can, separate eachone, the somewhere in the network this Posting finds. of my opinion to there really already enough angry Script-Kiddies, The only hereon Waiting, that one in irgeneiner point your Wissenslücken for a effektiveren forward line closes... .

unfortunately has very To this point, inwieweit it tenable is all and really all Lesern this Page The erforderlichen Kenntnisse To provide, yet none really geäußert.

i'll me therefore furthermore yet hold back ( s. first Posting...)

@IF

well Gucke ma, there has still the Peter woodpecker the same thing trouble How I straight... .

Greeting
André
 
03/05/09  
 



Andre Rohland
for me goes it here sooner circa a gewisse blame...


Responsible in the senses of at least mitverantwortlich is one always, so How z.B. to explanation Y bill Gates äää Bill Tore, if M$s Games and software for Unheil care and so How RGHs XProfan if so time Brunhildess_weltschlimmster_Virus any Humans verdrückt the a row uses The You once posted had, The I against but indicating, what Lilo moving tappt im dunkeln from slip on a postcard To print which tappt im dunkeln on your sister absandte but at neighbors Brunhilde submitted watts.

i'd say: The Postbote has guilt, he had stumbling must How it it statistisch seen otherwise indeed bravös vorschauspielert.

The subscriber the Ereigniskette go itself in a circle nominate and einsaargen let, but the program Yes rather.

objectively game it no role, thatswhy circa you To calm and To encourage be definiert: it'll you not gelingen something A-D-plan-temperate To post, what here so long Bestand has, that it negative relevant go could, to best know and conscience all, which here Edit can.

is and be means - How otherwise indeed - everything the morals subjected because You here Yes even not on my own are - if it you helps.

in the senses the safety means always ran there, Unwissenheit wants no enduring alternative his.
 
03/05/09  
 



Any A-D-plans green?
 
03/05/09  
 




Andre
Rohland
@Peter (woodpecker):

question 1.) about such a thing How Mach Please none Mist...
question 2.) the are The sogenanten Terms of Use of Microsoft
question 3.)No !!!, what You presumably mean are The sogen. Terminate and Stay Resistent programs, this here survive with safety none Reset... .
question 4.) have I IF weitergeleitet, knows neither as accurate, what it so means... .
question 5.) integrally trivial: if you what Böses with the code make... .

Greeting André
 
03/05/09  
 



Andre Rohland
@Peter (woodpecker):

question 5.) integrally trivial: if you what Böses with the code make...


go still simply time of it from, that it already now already plenty bösere Codes write could, as You you Perhaps against present can.

there's no safety (secure Betriebssysteme) and resolution harm seldom.
 
03/05/09  
 



@Andre: Perhaps make we the first of all in a klaren Anwendungsbeispiel solid which useful his can.

have You to a idea?
 
03/05/09  
 




Zum Buch


Topictitle, max. 100 characters.
 

Systemprofile:

no Systemprofil laid out. [anlegen]

XProfan:

 Posting  Font  Smilies  ▼ 

Please register circa a Posting To verfassen.
 

Topic-Options

26.213 Views

Untitledvor 0 min.
p.specht06/17/19
kustg05/10/19
Walter10/30/18
Ernst03/18/16
More...

Themeninformationen



Admins  |  AGB  |  Applications  |  Authors  |  Chat  |  Privacy Policy  |  Download  |  Entrance  |  Help  |  Merchantportal  |  Imprint  |  Mart  |  Interfaces  |  SDK  |  Services  |  Games  |  Search  |  Support

One proposition all XProfan, The there's!


My XProfan
Private Messages
Own Storage Forum
Topics-Remember-List
Own Posts
Own Topics
Clipboard
Log off
 Deutsch English Français Español Italia
Translations

Privacy Policy


we use Cookies only as Session-Cookies because of the technical necessity and with us there no Cookies of Drittanbietern.

If you here on our Website click or navigate, stimmst You ours registration of Information in our Cookies on XProfan.Net To.

further Information To our Cookies and moreover, How You The control above keep, find You in ours nachfolgenden Datenschutzerklärung.


all rightDatenschutzerklärung
i want none Cookie