Adapting PTfinder to other Versions of Microsoft Windows

PTfinder relies on some internal structures and magic numbers of the NT kernel to find traces of processes and threads. My proof-of-concept implementation only works on Microsoft Windows 2000. In this article I'll give the full set of parameters needed to adapt PTfinder to other versions up to Vista.

The first table contains the Type/Size pairs used to identify DISPATCHER_HEADER for several kinds of objects. As stated in an earlier post, the type doesn't change between Windows versions, so it's given here for completeness only.

ParameterVersion of Microsoft Windows
2000, SP 4XPXP, SP 22003 Vista (5270)
Sync EventType0x010x010x010x010x01
Size0x040x040x040x040x04
ProcessType0x030x030x030x030x03
Size0x1b0x1b0x1b0x1b0x20
SemaphoreType0x050x050x050x050x05
Size0x050x050x050x050x05
ThreadType0x060x060x060x060x06
Size0x6c0x700x700x720x74
Notification TimerType0x080x080x080x080x08
Size0x0a0x0a0x0a0x0a0x18

The next table lists the offsets of certain EPROCESS members used in PTfinder.

ParameterVersion of Microsoft Windows
2000, SP 4XPXP, SP 22003 Vista (5270)
ofs PageDirectoryBase0x0180x0180x0180x0180x018
ofs ThreadListHeadFlink0x0500x0500x0500x0500x050
ofs ThreadListHeadBlink0x0540x0540x0540x0540x054
ofs ExitStatus0x06c0x24c0x24c0x24c0x234
ofs CreateTimeLo0x0880x0700x0700x0700x088
ofs CreateTimeHi0x08c0x0740x0740x0740x08c
ofs ExitTimeLo0x0900x0780x0780x0780x090
ofs ExitTimeHi0x0940x07c0x07c0x07c0x094
ofs PID0x09c0x0840x0840x0840x09c
ofs PPID0x1c80x14c0x14c0x1280x124
ofs ImageFileName0x1fc0x1740x1740x1540x154
ofs Sync Event 10x070----
ofs Sync Event 20x13c0x0d80x0d80x0dc-
ofs Sync Event 30x1640x0fc0x0fc0x224-
sizeof struct0x2900x2580x2600x2780x268

And finally the same for ETHREAD members.




















ParameterVersion of Microsoft Windows
2000, SP 4XPXP, SP 22003 Vista (5270)
ofs CreateTimeLo0x1b00x1c00x1c00x1c80x1d0
ofs CreateTimeHi0x1b40x1c40x1c40x1cc0x1d4
ofs ExitTimeLo0x1b80x1c80x1c8ox1d00x1d8
ofs ExitTimeHi0x1bc0x1cc0x1cc0x1d40x1dc
ofs ExitStatus0x1c00x1d00x1d00x1d80x1e0
ofs PID0x1e00x1ec0x1ec0x1f40x1fc
ofs TID0x1e40x1f00x1f00x1f80x200
ofs HasTerminated0x224----
ofs Terminated-0x248:00x248:00x250:00x250:0
ofs ThreadsProcess0x22c0x2200x2200x2280x13c
ofs StartAddress0x2300x2240x2240x22c0x234
ofs Win32StartAddress0x2340x2280x2280x2300x230
ofs Notification Timer0x0e80x0f00x0f00x0780x080
ofs Semaphore 10x1900x19c0x19c0x1900x1a4
ofs Semaphore 20x1e80x1f40x1f40x1fc0x204
ofs Semaphore 3----0x270
sizeof struct0x2480x2580x2580x2600x278

The notation 0x248:0 denotes bit 0 of the DWORD starting at offset 0x248.

04/18/2006: added Synchronization Event and ThreadsProcess for Vista.

Archives

Imprint

This blog is a project of:
Andreas Schuster
Im Äuelchen 45
D-53177 Bonn
impressum@forensikblog.de

Copyright © 2005-2012 by
Andreas Schuster
All rights reserved.
Powered by Movable Type 5.12