首页
社区
课程
招聘
[分享][Tool]可列舉現正執行之 Process 所使用的 Dll及Function 與檔案路徑
2010-1-22 10:52 4293

[分享][Tool]可列舉現正執行之 Process 所使用的 Dll及Function 與檔案路徑

2010-1-22 10:52
4293
[Tool]可列舉現正執行之 Process 所使用的 Dll及Function 與檔案路徑

listdlls 對於偵查是否被植入後門提供蠻好用的資訊 如果有使用到不正常path的dll ,那就必須小心檢查自己的電腦了, listdlls 支援 win9x and win nt/2000 ,相關下載資訊如下:
http://www.sysinternals.com/ntw2k/utilities.shtml

[培训]内核驱动高级班,冲击BAT一流互联网大厂工 作,每周日13:00-18:00直播授课

收藏
点赞0
打赏
分享
最新回复 (6)
雪    币: 2096
活跃值: (100)
能力值: (RANK:420 )
在线值:
发帖
回帖
粉丝
rockinuk 8 2010-1-22 10:54
2
0
另外有一個工具 除可以列舉 process and dll (沒有path) 並把 註冊檔中之System Startup , User Startup, Run, RunOnce , RunServices , RunServicesOnce 的內容列舉隨時監控 ,查看是否有被植入 ,有關下載的資訊如下
http://www.wheresjames.com/software/Ins ... tupMgr.exe
雪    币: 2096
活跃值: (100)
能力值: (RANK:420 )
在线值:
发帖
回帖
粉丝
rockinuk 8 2010-1-22 10:54
3
0
類似 上述兩種工具 但提供更詳細的資訊
Dr. Watson is a software utility included with Microsoft Windows that is used to help detect, decode and log errors that are encountered while windows or windows programs are running

下載資訊如下: http://www.computerhope.com/software/drwatson.htm
雪    币: 2096
活跃值: (100)
能力值: (RANK:420 )
在线值:
发帖
回帖
粉丝
rockinuk 8 2010-1-22 10:55
4
0
另外可以參考 微軟知識庫文件 - 275481

How to Troubleshoot Program Faults with Dr. Watson
適用於
This article was previously published under Q275481
SUMMARY
This article describes how to use Dr. Watson to troubleshoot program errors that occur when you are running Microsoft Windows 98, Windows 98 Second Edition, and Windows Millennium Edition (Me).
MORE INFORMATION
Dr. Watson is a program error troubleshooting tool that traps program faults (that are running in ring three of the processor), and generates a snapshot of the operating system that you can use to diagnose the fault. This tool interprets program errors in Windows-based programs and attempts to diagnose them. When you run Dr. Watson, it automatically creates a log file when a program fault occurs. The log files have a .wlg extension, and are stored in the \Windows\Drwatson folder. The log file indicates the program that created the fault, the program that the fault occurred in, and the memory address where the fault occurred. Dr. Watson cannot create a snapshot if the program does not respond (hangs).
Using Dr. Watson
When you run Dr. Watson (Drwatson.exe), it collects detailed information about the state of your operating system at the time of a program fault. Dr. Watson intercepts the software faults, identifies the software that faulted, and then provides a detailed description of the cause. When this tool is enabled, it automatically logs this information to the disk (\Windows\Drwatson\Watsonxxx.wlg); the information can then be displayed on the screen.

You can configure Dr. Watson to load automatically when Windows starts. To do this, create a shortcut to Drwatson.exe in the Startup folder. This configuration is useful when an issue is not easily reproducible. When Dr. Watson traps the program fault and creates the log, you can contact technical support for further assistance.

NOTE: Dr. Watson is best used with reproducible faults. With intermittent faults, you may not be able to determine the cause of the fault.

To start Dr. Watson, do one of the following:
On the Start menu, click Run, type Drwatson, and then click OK.

-or-
Follow these steps:
Click Start, point to Programs, point to Accessories, and then click System Tools.
Click System Information, and then on the Tools menu, click Dr. Watson.
When Dr. Watson is enabled, an icon is displayed on the taskbar.

If a program fault occurs, Dr. Watson generates a snapshot of the software environment. Click the Details button in the error message box to view the information gathered by Dr. Watson.

To generate a log file, double-click the Dr. Watson icon on the taskbar. Dr. Watson gathers information about the operating system, and then a Dr. Watson dialog box is displayed.

When Dr. Watson is loaded, click any tab to move out of the text box. The Dr. Watson window closes if you press ENTER.

To view the advanced tabs in Dr. Watson, follow these steps:
Double-click the Dr. Watson icon.
On the View menu, click Advanced View. The following tabs provide detailed information about your system that you can give to a support technician:
System: Includes information that you would see on the General tab of System Properties.
Tasks: Includes information about the tasks that were running when the snapshot was taken. This tab also includes information about the program, the version, the manufacturer, the description, the path, the type, and the program that this program is related to (when this information is available).
Startup: Includes information about the programs that are configured to load during Startup. This tab includes the program name, and information about where the program was loaded from, and the command line that is used to load the program.
Kernel Drivers: Includes information about where the Kernel-mode drivers are installed, including the name of the driver, the version, the manufacturer, the description, the likely path, information about where the driver is loaded from, the type of driver, and the program that the driver related to (when information is available).
User Drivers: Includes information about the User-mode drivers that are installed, including the name of the driver, the version, the manufacturer, the description, the likely path, the type of driver, and the program that the driver is related to (when information is available).
MS-DOS Drivers: Includes information about the MS-DOS drivers that are installed.
16-bit Modules: Includes information about the 16-bit modules that were in memory when the snapshot was taken, including the name of the module, the version, the manufacturer, the description, the likely path, the type of driver, and the program that the driver is related to (when information is available).
Details (this tab is only displayed when Dr. Watson has captured a fault): Lists the events that occurred before and during the fault, in progressive order.
If you experience a program fault, and you want to use Dr. Watson, follow these steps:
Try to reproduce the fault to verify that it is not a random failure.
Click Start, point to Programs, point to Accessories, and then click System Tools.
Click System Information, and then on the Tools menu, click Dr. Watson.
Reproduce the fault.
Click Details in the Program Fault window.
View the Diagnosis window to determine the source of the fault.
If the issue is intermittent or not easy to reproduce, put Dr. Watson in your Startup folder so that it is always running. The Dr. Watson dialog box includes a text box that you can use to enter information about what you were doing when the issue occurred. You should provide information about the programs that were running, and the steps that resulted in the program fault.

NOTE: After you type the information in the text box, on the File menu, click Save or Save As to save the file. If you only click OK in the Dr. Watson dialog box, the information that you enter in the text box is not saved.

When a program fault occurs, the Dr. Watson log file is automatically named Watsonxxx.wlg (where xxx is an incremented number). By default, Dr. Watson log files are saved to the \Windows\Drwatson folder. To save the information generated by Dr. Watson, click Save on the File menu.

You can view a Dr. Watson log file by using the Dr. Watson program or by using Microsoft System Information (MSInfo). To view Dr. Watson log files by using MSInfo, follow these steps:
Click Start, point to Programs, point to Accessories, point to System Tools, and then click System Information.
On the File menu, click Open.
Open the folder where the Dr. Watson log is saved.
In the Files of type list, click Dr. Watson Log File (*.wlg).
Click the file, and then click Open.
To print Dr. Watson log files, on the File menu, click Print. To print only specific information, use Microsoft System Information to view the log file, and then copy the specific information to a text editor, such as Microsoft Notepad.

NOTE: A typical Dr. Watson log can be over 15 pages, depending on the software running.
Customizing Dr. Watson
To customize Dr. Watson, on the View menu, click Options. You can select any of the following options:

Log Files: Configures the number of log files that are able to be stored on the computer and the folder that the log files are saved in.
Disassembly: Configures the number of CPU instructions and stack frames that are reported in the log file. You need to configure these options only when you are requested to do so by technical support.
雪    币: 2096
活跃值: (100)
能力值: (RANK:420 )
在线值:
发帖
回帖
粉丝
rockinuk 8 2010-1-22 10:56
5
0
提供Kernel相關資訊工具(含Source Code)
http://www.security.org.sg/code/kproccheck.html

漏洞相關資訊
http://www.security.org.sg/vuln/index.html
雪    币: 1585
活跃值: (182)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
shangrila 2010-4-23 00:25
6
0
地对地导弹点点滴滴
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
sunningboy 2010-6-26 11:10
7
0
对地导弹点点滴滴
游客
登录 | 注册 方可回帖
返回