11:19 a.m.
Hallo all,
According to a hint from Andreas Schuster (THX!!) I have tried to access the
_SE_AUDIT_PROCESS_CREATION_INFO-structure which is referenced in _EPROCESS.
SeAuditProcessCreationInfo:
>> for proc in
win32.tasks.pslist(self.addrspace):
... if proc.UniqueProcessId in (172, 528,
1560):
... print "SeAuditProcessCreationInfo:
{0:#x}".format(proc.SeAuditProcessCreationInfo)
...
SeAuditProcessCreationInfo: 0x82014964
SeAuditProcessCreationInfo: 0x81c8e6ac
SeAuditProcessCreationInfo: 0x81cc1214
So I have displayed the pointers to the
_SE_AUDIT_PROCESS_CREATION_INFO-structure.
I hoped to find a Unicode-string somewhere containing the path to the
imagefile.
Sadly a hexdump seems to be useless::
>> db(0x82014964, length=256)
0x82014964
d0 b8 fe 81 40 b3 27 ff e7 d2 c9 01 00 00 01 00
....@.'.........
0x82014974 5e 03 00 00 00 03 00 00 00 03 00 00 32 00 00 00
^...........2...
0x82014984 59 01 00 00 00 30 88 c0 64 3c 22 82 c4 95 ff 81
Y....0..d<".....
0x82014994 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
................
...
But that's OK, because there should be a only another pointer again:
>>
dt("_SE_AUDIT_PROCESS_CREATION_INFO")
'_SE_AUDIT_PROCESS_CREATION_INFO' (4 bytes)
0x0 : ImageFileName ['pointer',
['_OBJECT_NAME_INFORMATION']]
How can I access this structure via object.method?
CU
Mic
11:36 a.m.
Michael,
You can print do this:
>>
str(proc.SeAuditProcessCreationInfo.ImageFileName.dereference().Name)
'\\Device\\HarddiskVolume1\\Program Files\\Internet Explorer\\IEXPLORE.EXE'
MHL
On Wed, Jun 6, 2012 at 11:19 AM, Michael Felber <MichaelFelber(a)gmx.net> wrote:
Hallo all,
According to a hint from Andreas Schuster (THX!!) I have tried to access the
_SE_AUDIT_PROCESS_CREATION_INFO-structure which is referenced in _EPROCESS.
SeAuditProcessCreationInfo:
>> for proc in
win32.tasks.pslist(self.addrspace):
... if proc.UniqueProcessId in (172, 528,
1560):
... print "SeAuditProcessCreationInfo:
{0:#x}".format(proc.SeAuditProcessCreationInfo)
...
SeAuditProcessCreationInfo: 0x82014964
SeAuditProcessCreationInfo: 0x81c8e6ac
SeAuditProcessCreationInfo: 0x81cc1214
So I have displayed the pointers to the
_SE_AUDIT_PROCESS_CREATION_INFO-structure.
I hoped to find a Unicode-string somewhere containing the path to the
imagefile.
Sadly a hexdump seems to be useless::
>> db(0x82014964, length=256)
0x82014964 d0 b8 fe 81 40 b3 27 ff e7 d2 c9 01 00 00 01 00
....@.'.........
0x82014974 5e 03 00 00 00 03 00 00 00 03 00 00 32 00 00 00
^...........2...
0x82014984 59 01 00 00 00 30 88 c0 64 3c 22 82 c4 95 ff 81
Y....0..d<".....
0x82014994 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
................
...
But that's OK, because there should be a only another pointer again:
>>
dt("_SE_AUDIT_PROCESS_CREATION_INFO")
'_SE_AUDIT_PROCESS_CREATION_INFO' (4 bytes)
0x0 : ImageFileName ['pointer',
['_OBJECT_NAME_INFORMATION']]
How can I access this structure via object.method?
CU
Mic
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users 
11:37 a.m.
Michael,
The pstree plugin does exactly this (with the -v):
try:
process_params = task.Peb.ProcessParameters
renderer.write(u"{0} cmd: {1}\n".format(
' ' * pad, process_params.CommandLine))
renderer.write(u"{0} path: {1}\n".format(
' ' * pad, process_params.ImagePathName))
renderer.write(u"{0} audit: {1}\n".format(
' ' * pad,
task.SeAuditProcessCreationInfo.ImageFileName.Name or
"UNKNOWN"))
I think you are looking to print the last element.
Michael.
On 6 June 2012 17:19, Michael Felber <MichaelFelber(a)gmx.net> wrote:
Hallo all,
According to a hint from Andreas Schuster (THX!!) I have tried to access the
_SE_AUDIT_PROCESS_CREATION_INFO-structure which is referenced in _EPROCESS.
SeAuditProcessCreationInfo:
>> for proc in
win32.tasks.pslist(self.addrspace):
... if proc.UniqueProcessId in (172, 528,
1560):
... print "SeAuditProcessCreationInfo:
{0:#x}".format(proc.SeAuditProcessCreationInfo)
...
SeAuditProcessCreationInfo: 0x82014964
SeAuditProcessCreationInfo: 0x81c8e6ac
SeAuditProcessCreationInfo: 0x81cc1214
So I have displayed the pointers to the
_SE_AUDIT_PROCESS_CREATION_INFO-structure.
I hoped to find a Unicode-string somewhere containing the path to the
imagefile.
Sadly a hexdump seems to be useless::
>> db(0x82014964, length=256)
0x82014964 d0 b8 fe 81 40 b3 27 ff e7 d2 c9 01 00 00 01 00
....@.'.........
0x82014974 5e 03 00 00 00 03 00 00 00 03 00 00 32 00 00 00
^...........2...
0x82014984 59 01 00 00 00 30 88 c0 64 3c 22 82 c4 95 ff 81
Y....0..d<".....
0x82014994 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
................
...
But that's OK, because there should be a only another pointer again:
>>
dt("_SE_AUDIT_PROCESS_CREATION_INFO")
'_SE_AUDIT_PROCESS_CREATION_INFO' (4 bytes)
0x0 : ImageFileName ['pointer',
['_OBJECT_NAME_INFORMATION']]
How can I access this structure via object.method?
CU
Mic
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
3:16 a.m.
New subject: AW: Determining the image path of a process
Hello namesakes,
thanks for the your quick response. Both ways did work fine.
Thanks a lot!
Regards
Michael
4543
days inactive
4544
days old
vol-users@lists.volatilityfoundation.org
3 comments
3 participants
participants (3)
-
Michael Cohen -
Michael Felber -
Michael Hale Ligh