Re: [Vol-users] Output from windows/wintree plugins - what does it mean?

Hi Michael, Thanks so much for the tips - I've been reading through Brendan Dolan-Gavitt's initial set of GDI utilities and have decided that using the existing 'windows' plugin is a good starting point. My logic is as follows: Iterate over the tagWND objects (as per the windows plugin) and when I come across one that has a SuperClassAtom of Edit get the offset of 'cbwndExtra' and then read the Edit control properties/structure from the data at this offset. (Eeek! Maybe?! Is that right?!) You kindly told me that "0xfea0dc70 is a virtual address in this case, its the location of the tagWND structure in kernel memory." so I thought I could look this up in the output from memmap: Virtual Physical Size DumpFileOffset ---------- ---------- ---------- -------------- 0xfea0d000 0x040ea000 0x1000 0xa80e000 So I thought I should be able to find the structure at offset 0x040eac70 in my raw dump file. This is so that I can manually look at the bytes when I'm building my plugin/script. So, my actual question is... Brendan's code used get_member_offset(). I can see from the SVN that this was removed back in 2010, so what's the method of doing the same thing in today's code? The bits are loosely there in my head - just trying to put them together in my head! It's hard, but I'm loving it =) Adam On Sunday, 9 March 2014, 21:46, Michael Ligh &lt;michael.ligh(a)mnin.org&gt; wrote: Hey Adam, 0xfea0dc70 is a virtual address in this case, its the location of the tagWND structure in kernel memory. Indeed, you can pull the text out of edit controls and various other window elements that we don't currently analyze. Brendan Dolan-Gavitt's initial set of GDI utilities [1] contained definitions for _TOOLBAR_WINDOW32, _TEXT_DESCRIPTOR, _EDIT_BOX, _STATUS_BAR, and a few of the critical structures for MSHTML documents. However, they're for XP SP2/SP3 and may have changed since then, so its definitely possible, but will just require a bit of research. Also, if you have access to a retail version of Visual Studio (not the free express version), then you should have Spy++ [2]. This lets you select any window on your desktop using your cursor and it will display the details like handle value, address in kernel memory, coordinates, and types of messages it sends/receives. Hope this helps! Michael [1]. http://www.cc.gatech.edu/~brendan/volatility/dl/gdiutils-0.3.zip <http://www.cc.gatech.edu/%7Ebrendan/volatility/dl/gdiutils-0.3.zip> [2]. http://msdn.microsoft.com/en-us/library/dd460756.aspx -------------------------------------------------- Michael Ligh (@iMHLv2) GPG: http://mnin.org/gpg.pubkey.txt Blog: http://volatility-labs.blogspot.com <http://volatility-labs.blogspot.com/> Training: http://memoryanalysis.net <http://memoryanalysis.net/> On Mar 8, 2014, at 7:14 PM, Bridgey &lt;adam.bridge(a)yahoo.com <mailto:adam.bridge@yahoo.com>> wrote: current looking at Windows, literally, the GUI. Notepad window, and #20126 is the edit control, that is, the textarea into which the user types. edit control: WS_EX_CLIENTEDGE,WS_EX_LTRREADING,WS_EX_RIGHTSCROLLBAR,WS_EX_LEFT virtual? Of what? The Edit control object? style flags, et al) are all clearly present., but where can I find information specific to this control (in this instance, an 'Edit'). For example, maybe the text it contains? of structure to parse.) hoping to write!) please let me know where to look. _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users