Is it possible to redirect an app's write to a file (to memory for example)
Maybe using a hook or sth like that, but how?
Posted on 2003-10-03 11:33:56 by optimus
i've something in my mind that might work but not reliable.

Start process execution in debug mode and hook all memory allocation related APIs
when app decides to alloc memory you give a read-only buffer to it, that any write attempt will cause exception and then you hook it (will generate debugevent) and restore state.Change stack to read-only too before execution.

or you can make a .vxd that handles the memory fault.

Another way is doing partial emulation for each opcode, checking its modrm/sib for memory access and check some other particular instructions too.

uNdErX
Posted on 2003-10-03 13:27:08 by uNdErX
What do you mean by an 'app's write'. If you mean the standard output, this can be redirected to a file or a pipe by specifying the hStd* handle values in the STARTUPINFO structure used in CreateProcess.

Thomas
Posted on 2003-10-03 13:34:22 by Thomas
Not console output. I mean an app's write to a disk file.
Posted on 2003-10-03 23:06:29 by optimus
sounds quite complicated. if i just wanna redirect an app's write to REGISTRY, then how?


i've something in my mind that might work but not reliable.

or you can make a .vxd that handles the memory fault.

Another way is doing partial emulation for each opcode, checking its modrm/sib for memory access and check some other particular instructions too.

uNdErX
Posted on 2003-10-03 23:08:24 by optimus
Att.=Very simple MsgBox Hook Example + Doc.

More information
http://www.wheaty.net/W95SPS.ZIP
Posted on 2003-10-04 05:20:07 by Criminal2
Really cool, u mean hooking the API of registry operation?
But still need some time to digest the code. This trick only works in win9x?


Att.=Very simple MsgBox Hook Example + Doc.

More information
Posted on 2003-10-04 07:23:19 by optimus

u mean hooking the API of registry operation? yes...
This trick only works in win9x? yes...
Posted on 2003-10-04 19:10:34 by Criminal2
i thought that u'd like to intercept every memory write attempt.
Posted on 2003-10-05 12:50:37 by uNdErX