Remote Universal Stackwalker

Hey ppl,

Last night I needed to quickly figure out the program flow of a program I was debugging, to help myself I made this little gem

I took the stackwalker code from the code project, links and descriptions are in the source. I believe the code is licensed but I don't really care about such things.

What is this shit?

You inject this tool into another process using a dll injector, in a config file you specify the function and the corresponding module to walk the stack from. This tool will hook the function you specified and dump the functions called before it into a .txt file. You can specify multiple functions at a time. It's possible to get duplicate stackwalks if functions are recursive or if two functions you're monitoring call each other.

Sources
There are allot of em, so I'll post them in a rar and link it. inside you'll also find a compiled example that you can inject into any process.

Extract on your C drive!

Dll injector not included

The example looks for the config file in C:/asd/config/sw.txt
It'll post all it's logs as C:/asd/***.txt
The current configuration hooks and logs all calls to the Process32Next and First functions (needed to patch an executable that was scanning for debuggers...)

https://www.virustotal.com/file/8583...is/1341423369/
Stack_walk.rar - Jotti's malware scan

Stack_walk_mpgh.net.rar

Good job!!

nice job.
but what if the function is called more than once? (lets say its DrawIndexedPrimitive)
this will make a very big file if you go to the game more than 5 seconds xD

Yep, true. But the sources are inside the rar so you can possibly bind the logging function to a hotkey or something, it can unhook so you can choose when you want to stop logging calls.

File Approved !

so it watches the stack and logs calls to get a timeline?

You can hook a function, and then it walks the stack to see what functions were called before it. For example you wish to know what functions call CreateFileA(), this is how your log could look:

Code:

724252h Kernel32.dll CreateFileA();
401240h Program.exe Function.name
401024h Program.exe Function.name

It can be expanded to dump all parameters too, but that's not included in the example.

just wanted to say.. maybe the "executable that was scanning for debuggers" uses ZwQuerySystemIndormation ,
making hooking Process32First and Process32Next useless

True, but I found it none the less ^^ Besides changing

GetProcess32Next Kernel32.dll

to

ZwQuerySystemInformation ntdll.dll

is trival.

Very nice release as usual, maybe specify something in the config to unhook after one hit.

it might be easier to open the said program in ollydbg and find references to the function

Good Job

Originally Posted by kibbles18

it might be easier to open the said program in ollydbg and find references to the function

@kibbles18 if you only need a single function's referenced that might be the easiest way, but alot more awesome things can be done with the stack if you know how to use it

You can bypass regions of code by modifying the return address with enough knowledge of the stack and assembly, which is very useful when making undetected cheats.

Originally Posted by Hell_Demon

@kibbles18 if you only need a single function's referenced that might be the easiest way, but alot more awesome things can be done with the stack if you know how to use it

You can bypass regions of code by modifying the return address with enough knowledge of the stack and assembly, which is very useful when making undetected cheats.

yea i remember one of my old hooks was using this way:
push myfunction
ret

but it got detected as usual :P

There's more, you can also find allot of interesting leftovers from functions that have recently executed. Notice for example that some d3d functions leave the device pointer on the stack when they return (the pointer is not overwritten, so it's still there and valid). Now instead of hooking the d3d, you could also just hook the caller wait for it to return and snatch the pointer from the stack. It's what I do to get my hacks undetected

And I laugh when I see those poor 'coders' building horribly inefficient, complex hooks just to display a few lines on the screen ^^

Remote Universal Stackwalker

Post a Reply

Similar Threads

Tags for this Thread