🔒 Locked

Program Introspection: Process, Memory, Network...

Started by Metorical May 16, 2006 at 5:13 AM 5 replies 1.3k views

Original Post

May 16, 2006 at 5:13 AM

I am aware that tools exist to inspect a program at runtime (e.g. in a non-debug build) however I'm having a little trouble pulling up any valid links from google. I am interested in viewing the memory contents of a running process either as a snapshot or in realtime. To pose it as a general question I'm also interested in the system/network traffic however I have an idea where to start on this. Ideas so far include packet sniffers and program injection. Also can you catch/hook standard windows calls so for instance you could make a program that detects when another program fires of the window maximise event? Any help would be appreciated.

nmi

May 16, 2006 at 6:57 AM

Maybe this article is of interest for you:
http://www.codeproject.com/threads/MDumpAll.asp

Google also revealed this link:
http://support.microsoft.com/?kbid=241215

You may also want to search for the term "process" and "dump". There is a tool called "procdump" which creates a dump of a running process.

For network sniffing you should try ethereal:
http://www.ethereal.com/

Metorical

May 18, 2006 at 5:10 AM

Thanks guys! Indeed I'm looking for tools on the Windows Platform.

The Userdump.exe tool seems quite handy, I wasn't aware of how to configure it and the link provided has all the info.

Do you know of any tools to interact in real time with the memory used by a process or is this, as I suspect, protected by the Operating System. This would be similar to peek/pokeing values on the spectrum or the action replay catridges but in realtime.

The API Spy link comes up tops too and I will have to check out Ethereal :O)

Edit:

I guess what I really want is to be able to drop a program/process in to a wrapper that gives me access to the memory used and allows me to control the execution of the program. Sounds VM like.

Edit 2:

Here are some exampls.

1. A dialog pops up within a program. I would like to be able to detect the pop-up (e.g. the windows message with the hook) and then modify the value of one of the fields in the dialog.

2. A process sends out transactions. I would like to force a variable to maintain a constant value or work out a new value outside of the program and put it back in.

[Edited by - Metorical on May 18, 2006 5:10:50 AM]

nmi

May 18, 2006 at 6:27 AM

Quote:

I guess what I really want is to be able to drop a program/process in to a wrapper that gives me access to the memory used and allows me to control the execution of the program. Sounds VM like.

Maybe you are looking for a debugger ?

Maybe IDE is what you are looking for:
(basically debugger and disassembler)
http://www.datarescue.com/idabase/index.htm

Another debugger is SoftICE:
http://www.compuware.com/products/devpartner/default.htm

Metorical

May 18, 2006 at 9:15 AM

Thanks guys!

I never thought of a debugger outside of the context of a debug build.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.