Remote Universal Stackwalker
Remote Universal Stackwalker
Hey ppl,
Last night I needed to quickly figure out the program flow of a program I was debugging, to help myself I made this little gem
I took the stackwalker code from the code project, links and descriptions are in the source. I believe the code is licensed but I don't really care about such things.
What is this shit?
You inject this tool into another process using a dll injector, in a config file you specify the function and the corresponding module to walk the stack from. This tool will hook the function you specified and dump the functions called before it into a .txt file. You can specify multiple functions at a time. It's possible to get duplicate stackwalks if functions are recursive or if two functions you're monitoring call each other.
Sources
There are allot of em, so I'll post them in a rar and link it. inside you'll also find a compiled example that you can inject into any process.
Extract on your C drive!
Dll injector not included
The example looks for the config file in C:/asd/config/sw.txt
It'll post all it's logs as C:/asd/***.txt
The current configuration hooks and logs all calls to the Process32Next and First functions (needed to patch an executable that was scanning for debuggers...)
https://www.virustotal.com/file/8583...is/1341423369/
Stack_walk.rar - Jotti's malware scan
Last night I needed to quickly figure out the program flow of a program I was debugging, to help myself I made this little gem
I took the stackwalker code from the code project, links and descriptions are in the source. I believe the code is licensed but I don't really care about such things.
What is this shit?
You inject this tool into another process using a dll injector, in a config file you specify the function and the corresponding module to walk the stack from. This tool will hook the function you specified and dump the functions called before it into a .txt file. You can specify multiple functions at a time. It's possible to get duplicate stackwalks if functions are recursive or if two functions you're monitoring call each other.
Sources
There are allot of em, so I'll post them in a rar and link it. inside you'll also find a compiled example that you can inject into any process.
Extract on your C drive!
Dll injector not included
The example looks for the config file in C:/asd/config/sw.txt
It'll post all it's logs as C:/asd/***.txt
The current configuration hooks and logs all calls to the Process32Next and First functions (needed to patch an executable that was scanning for debuggers...)
https://www.virustotal.com/file/8583...is/1341423369/
Stack_walk.rar - Jotti's malware scan
Good job!!
nice job.
but what if the function is called more than once? (lets say its DrawIndexedPrimitive)
this will make a very big file if you go to the game more than 5 seconds xD
but what if the function is called more than once? (lets say its DrawIndexedPrimitive)
this will make a very big file if you go to the game more than 5 seconds xD
Yep, true. But the sources are inside the rar so you can possibly bind the logging function to a hotkey or something, it can unhook so you can choose when you want to stop logging calls.
File Approved !
so it watches the stack and logs calls to get a timeline?
You can hook a function, and then it walks the stack to see what functions were called before it. For example you wish to know what functions call CreateFileA(), this is how your log could look:
It can be expanded to dump all parameters too, but that's not included in the example.
Code:
724252h Kernel32.dll CreateFileA(); 401240h Program.exe Function.name 401024h Program.exe Function.name
just wanted to say.. maybe the "executable that was scanning for debuggers" uses ZwQuerySystemIndormation ,
making hooking Process32First and Process32Next useless
making hooking Process32First and Process32Next useless
True, but I found it none the less ^^ Besides changing
GetProcess32Next Kernel32.dll
to
ZwQuerySystemInformation ntdll.dll
is trival.
GetProcess32Next Kernel32.dll
to
ZwQuerySystemInformation ntdll.dll
is trival.
Very nice release as usual, maybe specify something in the config to unhook after one hit.
it might be easier to open the said program in ollydbg and find references to the function
Originally Posted by kibbles18
it might be easier to open the said program in ollydbg and find references to the function
You can bypass regions of code by modifying the return address with enough knowledge of the stack and assembly, which is very useful when making undetected cheats.
Originally Posted by Hell_Demon
@kibbles18 if you only need a single function's referenced that might be the easiest way, but alot more awesome things can be done with the stack if you know how to use it
You can bypass regions of code by modifying the return address with enough knowledge of the stack and assembly, which is very useful when making undetected cheats.
You can bypass regions of code by modifying the return address with enough knowledge of the stack and assembly, which is very useful when making undetected cheats.
push myfunction
ret
but it got detected as usual :P
Good Job 
There's more, you can also find allot of interesting leftovers from functions that have recently executed. Notice for example that some d3d functions leave the device pointer on the stack when they return (the pointer is not overwritten, so it's still there and valid). Now instead of hooking the d3d, you could also just hook the caller wait for it to return and snatch the pointer from the stack. It's what I do to get my hacks undetected And I laugh when I see those poor 'coders' building horribly inefficient, complex hooks just to display a few lines on the screen ^^
And I laugh when I see those poor 'coders' building horribly inefficient, complex hooks just to display a few lines on the screen ^^