{"id":272,"date":"2018-07-16T15:26:28","date_gmt":"2018-07-16T14:26:28","guid":{"rendered":"https:\/\/cybercop-training.ch\/?p=272"},"modified":"2018-07-16T15:32:37","modified_gmt":"2018-07-16T14:32:37","slug":"about-processes-and-threads","status":"publish","type":"post","link":"https:\/\/cybercop-training.ch\/?p=272","title":{"rendered":"About processes and threads"},"content":{"rendered":"

First let me find a short definition what we have to understand under a process and a thread. A process is an instance of a computer program that is being executed. It’s a set of threads and their shared memory. A thread is a sequenze of the order to be executed in the cpu. Sounds a bit confusing, isnt’it?<\/p>\n

A simple way to view processes is windows taskmanger, but it’s a bit limited in functionality and there are more advanced tools like process explorer<\/a> from sysinternals or process hacker<\/a> which is a great opensource tool. The advantage of process explorer is thats a microsoft tool and officially digitaly signed by them.<\/p>\n

\"\"<\/a><\/p>\n

Let’s open a cmd and start a hidden powershell by typing the following command:<\/p>\n

powershell -w hidden -c dir c:\\ -recurse<\/code><\/p>\n

Now a powershell process is running on our machine, but without a window. Process Explorer shows us a cmd.exe with a childprocess called conhost.exe<\/p>\n

Let’s doubleclick conhost.exe and explore some usefull functionalities of process explorer.<\/p>\n

\"\"<\/a><\/p>\n

In the Image tab we can see useful informations like the full path of the executable, the command line field which exactly shows the previous command we’ve typed in and the parent process. Another cool feature is the VirusTotal field. After clicking on submit a hashvalue of the binary will be created and checked against the virustotal database.\u00a0 The value 0\/68 means that the binary hash value is known and was checked with 68 different Antivirus Engines. 0 means that none of them sees a potential danger. A return value of n\/a would imply\u00a0 that the hash value isn’t known yet by virustotal and the binary should be uploaded for further analysis.<\/p>\n

\"\"<\/a><\/p>\n

Another interessting function is the TCP\/IP and the Strings tab. If the binary should do any network connections we would see them there. With help of the strings it’s possible to read out which strings are stored in the memory of a specific process. In case of a cmd.exe we can find which commands where typed.<\/p>\n

\"\"<\/a><\/p>\n

Next thing we want to have a short look on ist the Threads tab. Everytime a process needs some CPU power we will see activity there. From that tab we have also the possibility to suspend or kill a task. Forexample if we open a notepad and suspend that task, notepad will be in a frozen state.<\/p>\n

If we suspend a task there is always a way back. Forexample we can suspend a task and then create a memory dump and reactivate it by clicking on Resume. If we kill the task, there’s no way back! Another tool that was slightly covered was procmon from sysinternals. With help of that tool you can monitor the system and get specific traces of certain processes.<\/p>\n

If you remember the last exercise<\/a> and do a dump from the lsass.exe process, you’ll also save some passwords that are stored in the memory. So be careful about that \ud83d\ude09<\/p>\n

Some repeating qustions:<\/p>\n

What is the lowest PID (Process Identifier) you can observe in the OS?<\/strong><\/p>\n

0 –> Idle process<\/p>\n

Get-Process | Sort-Object Id | Select -First 5<\/code><\/p>\n

You’ll notice that all of the PIDs are divisible by 4. 4 is therefore the first PID available after 0 (which is the Idle process).<\/p>\n

Which process is the parent process for most svhost.exe processes?<\/strong><\/p>\n

Services.exe<\/p>\n

How many thread you can deserve within notepad.exe process?<\/strong><\/p>\n

1<\/p>\n

Which DLL must be present if you want to configure symbols for Process Explorer?<\/strong><\/p>\n

dbghelp.dll [1]<\/p>\n

Which activities Process Monitor CANNOT monitor?<\/strong><\/p>\n

Shared memory access<\/p>\n

Further references:<\/p>\n

[1] https:\/\/blogs.msdn.microsoft.com\/vijaysk\/2009\/04\/02\/getting-better-stack-traces-in-process-monitor-process-explorer\/<\/a><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

First let me find a short definition what we have to understand under a process and a thread. A process is an instance of a […]<\/a><\/p>\n<\/div>","protected":false},"author":2,"featured_media":275,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-272","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-windows-security"],"_links":{"self":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/272","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=272"}],"version-history":[{"count":9,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/272\/revisions"}],"predecessor-version":[{"id":287,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/272\/revisions\/287"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/media\/275"}],"wp:attachment":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=272"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=272"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=272"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}