bugtraq - [Mlabs] Dissecting Internals of Windows XP Svchost : Reverse Engineering Stature

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <46F2FC98.5010408@secniche.org>
Date: Thu, 20 Sep 2007 16:04:56 -0700
From: Aditya K Sood <zeroknock@...niche.org>
To: bugtraq@...urityfocus.com
Subject: [Mlabs] Dissecting Internals of Windows XP Svchost : Reverse Engineering
 Stature

Hi all

This is the reverse Engineering layout of Scvhost Internals.

|Category : Reverse Engineering Analysis.

The paper solely relates to the core internals that build up the
Windows XP Svchost. The Svchost internals have not been disseminated
into informative elements yet. I have found only one or two analysis
but that wont satisfy my views regarding XP Svchost. The anatomy of
Svchost has got complexity in its own term. This pushes me to write
a specific analysis over it. The analysis provide a structural design
with concept wise dissection. The point is to understand the hidden
artifacts and how it affects the working aspect of prime service host
controller.Every process is disseminated into primary process and
secondary process. In terms related to operating system there is a parent
process and its child. If one look at the implementation scenario then
child processes are undertaken as thread internally. The kernel level
implementation is subjugated like this. The XP Svchost runs as threads
under services process.|

http://mlabs.secniche.org/winxp_svchost.html
http://mlabs.secniche.org/papers/Win_Xp_Svc_Int.pdf

Regards
Aks aka 0kn0ck
http://mlabs.secniche.org | http://www.secniche.org