EMO Style ForumPro - Hos Geldiniz
Finding the Thread ID from the Executable Name Uyeols10

Join the forum, it's quick and easy

EMO Style ForumPro - Hos Geldiniz
Finding the Thread ID from the Executable Name Uyeols10
EMO Style ForumPro - Hos Geldiniz
Would you like to react to this message? Create an account in a few clicks or log in to continue.
Giriş yap

Şifremi unuttum

Istatistikler
Toplam 203 kayıtlı kullanıcımız var
Son kaydolan kullanıcımız: crayzboy76

Kullanıcılarımız toplam 1186 mesaj attılar bunda 862 konu
Tarıyıcı
 Kapı
 Indeks
 Üye Listesi
 Profil
 SSS
 Arama
Arama
 
 

Sonuç :
 


Rechercher çıkıntı araştırma

RSS akısı


Yahoo! 
MSN 
AOL 
Netvibes 
Bloglines 


Anahtar-kelime

pointer  kutu  loot  

Kimler hatta?
Toplam 1 kullanıcı online :: 0 Kayıtlı, 0 Gizli ve 1 Misafir

Yok

[ Bütün listeye bak ]


Sitede bugüne kadar en çok 217 kişi C.tesi Tem. 29, 2017 1:46 am tarihinde online oldu.
En son konular
» İnternetten Para Kazandıran Oyun ! Ödeme Alt Limiti Yok ! DEV KONU
Finding the Thread ID from the Executable Name I_icon_minitimeCuma Ağus. 29, 2014 8:33 am tarafından Hello EMO

» goldenchase.net maden yaparak para kazanma
Finding the Thread ID from the Executable Name I_icon_minitimeCuma Ağus. 29, 2014 8:18 am tarafından Hello EMO

» etichal hacker görsel egitim seti
Finding the Thread ID from the Executable Name I_icon_minitimeÇarş. Ağus. 06, 2014 4:57 am tarafından Hello EMO

» KO TBL Source C#
Finding the Thread ID from the Executable Name I_icon_minitimePtsi Ara. 09, 2013 6:36 am tarafından Hello EMO

» x86 Registers
Finding the Thread ID from the Executable Name I_icon_minitimeC.tesi Ağus. 24, 2013 5:02 am tarafından Hello EMO

» [Tutorial] Pegando Address, Pointers de WYD
Finding the Thread ID from the Executable Name I_icon_minitimeÇarş. Tem. 10, 2013 7:25 am tarafından Hello EMO

» [Tutorial] Pegando Address, Pointers de CS Metodo²
Finding the Thread ID from the Executable Name I_icon_minitimeÇarş. Tem. 10, 2013 7:23 am tarafından Hello EMO

» [Tutorial] Aprendendo basico deASM OLLYDBG
Finding the Thread ID from the Executable Name I_icon_minitimeÇarş. Tem. 10, 2013 7:22 am tarafından Hello EMO

» Basic C# DLL injector
Finding the Thread ID from the Executable Name I_icon_minitimePtsi Tem. 08, 2013 7:48 am tarafından Hello EMO

Reklam

Finding the Thread ID from the Executable Name

Aşağa gitmek

Finding the Thread ID from the Executable Name Empty Finding the Thread ID from the Executable Name

Mesaj tarafından Hello EMO Paz Nis. 24, 2011 7:02 am

[quote name='Stork' timestamp='1296612384' post='1210']
If you only know the name of the executable of your target, then you can use this code to locate it.

Kod:

unsigned long GetTargetThreadIdFromProcname(char *procName)
{
  PROCESSENTRY32 pe;
  HANDLE thSnapshot, hProcess;
  BOOL retval, ProcFound = false;
  unsigned long pTID, threadID;

  thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

  if(thSnapshot == INVALID_HANDLE_VALUE)
  {
      MessageBox(NULL, "Error: unable to create toolhelp snapshot", "Loader", NULL);
      return false;
  }

  pe.dwSize = sizeof(PROCESSENTRY32);

    retval = Process32First(thSnapshot, &pe);

  while(retval)
  {
      if(StrStrI(pe.szExeFile, procName) )
      {
        ProcFound = true;
        break;
      }

      retval    = Process32Next(thSnapshot,&pe);
      pe.dwSize = sizeof(PROCESSENTRY32);
  }

  CloseHandle(thSnapshot);
   
  _asm {
      mov eax, fs:[0x18]
      add eax, 36
      mov [pTID], eax
  }

  hProcess = OpenProcess(PROCESS_VM_READ, false, pe.th32ProcessID);
  ReadProcessMemory(hProcess, (const void *)pTID, &threadID, 4, NULL);
  CloseHandle(hProcess);

  return threadID;
}


Kod:
_asm {
      mov eax, fs:[0x18]
      add eax, 36
      mov [pTID], eax
    }
This is required as there is no C++ equivalent command to capture the thread ID. FS:[0x18] holds the Thread Environment Block or TEB of a process. Now, what does the TEB look like (see image below)? Notice the location of 0x2C - its the threadID associated with the TEB. We loop through the process list with Process32Next() unitl we find the process name we are interested in. We then open up that process, read TEB+0x2C, and dump it into our threadID variable.

Kod:

Position    Length    Windows Versions    Description
FS:[0x00]    4    Win9x and NT    Current Structured Exception Handling (SEH) frame
FS:[0x04]    4    Win9x and NT    Top of stack
FS:[0x08]    4    Win9x and NT    Current bottom of stack
FS:[0x0C]    4       Unknown - TIB Subsystem?
FS:[0x10]    4    NT    Fiber data
FS:[0x14]    4    Win9x and NT    Arbitrary data slot
FS:[0x18]    4    Win9x and NT    Linear address of TIB
---- End of NT subsystem independent part ----
FS:[0x1C]    4    NT    Environment Pointer
FS:[0x20]    4    NT    Process ID
FS:[0x24]    4    NT    Current thread ID
FS:[0x28]    4    NT    Active RPC Handle
FS:[0x2C]    4    Win9x and NT    Linear address of the thread-local storage array
FS:[0x30]    4    NT    Linear address of Process Environment Block (PEB)
FS:[0x34]    4    NT    Last error number
FS:[0x38]    4    NT    Count of owned critical sections
FS:[0x3C]    4    NT    Address of CSR Client Thread
FS:[0x40]    4    NT    Win32 Thread Information
FS:[0x44]    124    NT, Wine    Win32 client information (NT), user32 private data (Wine), 0x60 = LastError (Win95), 0x74 = LastError (WinME)
FS:[0xC0]    4    NT    Reserved for Wow32
FS:[0xC4]    4    NT    Current Locale
FS:[0xC8]    4    NT    FP Software Status Register
FS:[0xCC]    216    NT, Wine    Reserved for OS (NT), kernel32 private data (Wine)
FS:[0x124]    4    NT    Pointer to KTHREAD (ETHREAD) structure
FS:[0x1A4]    4    NT    Exception code
FS:[0x1A8]    18    NT    Activation context stack
FS:[0x1BC]    24    NT, Wine    Spare bytes (NT), ntdll private data (Wine)
FS:[0x1D4]    40    NT, Wine    Reserved for OS (NT), ntdll private data (Wine)
FS:[0x1FC]    1248    NT, Wine    GDI TEB Batch (OS), vm86 private data (Wine)
FS:[0x6DC]    4    NT    GDI Region
FS:[0x6E0]    4    NT    GDI Pen
FS:[0x6E4]    4    NT    GDI Brush
FS:[0x6E8]    4    NT    Real Process ID
FS:[0x6EC]    4    NT    Real Thread ID
FS:[0x6F0]    4    NT    GDI cached process handle
FS:[0x6F4]    4    NT    GDI client process ID (PID)
FS:[0x6F8]    4    NT    GDI client thread ID (TID)
FS:[0x6FC]    4    NT    GDI thread locale information
FS:[0x700]    20    NT    Reserved for user application
FS:[0x714]    1248    NT    Reserved for GL
FS:[0xBF4]    4    NT    Last Status Value
FS:[0xBF8]    532    NT    Static UNICODE_STRING buffer
FS:[0xE0C]    4    NT    Pointer to deallocation stack
FS:[0xE10]    256    NT    TLS slots, 4 byte per slot
FS:[0xF10]    8    NT    TLS links (LIST_ENTRY structure)
FS:[0xF18]    4    NT    VDM
FS:[0xF1C]    4    NT    Reserved for RPC
FS:[0xF28]    4    NT    Thread error mode (RtlSetThreadErrorMode)
[/quote]

alnıtı
Hello EMO
Hello EMO
EMO Team
EMO Team

Cinsiyet : Erkek
Burçlar : Yay
Yılan
Mesaj Sayısı : 935
Puan : 372443
Rep Puanı : 18
Doğum tarihi : 28/11/89
Kayıt tarihi : 21/07/09
Yaş : 34
Nerden : EMO WorlD
İş/Hobiler : RCE Student / Game Hacking / Learn Beginner C#,C++,Delphi
Lakap : EMO

https://emostyle.yetkinforum.com

Sayfa başına dön Aşağa gitmek

Sayfa başına dön

- Similar topics

 
Bu forumun müsaadesi var:
Bu forumdaki mesajlara cevap veremezsiniz