資安論壇

行政院 國家資通安全會報 - 技術服務中心 - 資安論壇 https://forum.icstc.org/
現在的時間是 2012年 10月 22日, 02:48

所有顯示的時間為 UTC + 8 小時




發表新文章 回覆主題  [ 21 篇文章 ]  前往頁數 12  下一頁
發表人 內容
文章發表於 : 2004年 7月 7日, 11:17 
離線

註冊時間: 2003年 5月 6日, 12:02
文章: 329
來自: fullback
[Tool]可列舉現正執行之 Process 所使用的 Dll及Function 與檔案路徑

listdlls 對於偵查是否被植入後門提供蠻好用的資訊 如果有使用到不正常path的dll ,那就必須小心檢查自己的電腦了, listdlls 支援 win9x and win nt/2000 ,相關下載資訊如下:
https://www.sysinternals.com/ntw2k/utilities.shtml

PS : 被 Microsoft 併購,網址改為
https://technet.microsoft.com/en-us/sysinternals/default.aspx


最後由 王世達 於 2005年 7月 19日, 13:13 編輯,總共編輯了 1 次。

回頂端
 個人資料  
 
 文章主題 :
文章發表於 : 2004年 7月 7日, 13:55 
離線

註冊時間: 2003年 5月 6日, 12:02
文章: 329
來自: fullback
另外有一個工具 除可以列舉 process and dll (沒有path) 並把 註冊檔中之System Startup , User Startup, Run, RunOnce , RunServices , RunServicesOnce 的內容列舉隨時監控 ,查看是否有被植入 ,有關下載的資訊如下 ;
https://www.wheresjames.com/software/InstallStartupMgr.exe

圖檔

圖檔


回頂端
 個人資料  
 
文章發表於 : 2004年 7月 7日, 14:49 
離線

註冊時間: 2004年 3月 8日, 09:48
文章: 2017
來自: 火山爆發
王世達 寫:

這地方小工具蠻多的
很有用很值得一逛
但最先讓我動心的是BLUESCREEN SCREEN SAVER
足夠讓不知情的人嚇出一身冷汗

_________________
如果我請你找廠商
不是看不起你, 畢竟沒人生來全知全能
這樣做是為解燃眉之急
廠商幫你做, 你在旁邊學
這樣會比網路上講半天還講不通要好得多


回頂端
 個人資料  
 
 文章主題 : 類似的工具 DR.Watson
文章發表於 : 2004年 7月 9日, 14:41 
離線

註冊時間: 2003年 5月 6日, 12:02
文章: 329
來自: fullback
類似 上述兩種工具 但提供更詳細的資訊
Dr. Watson is a software utility included with Microsoft Windows that is used to help detect, decode and log errors that are encountered while windows or windows programs are running

下載資訊如下:
https://www.computerhope.com/software/drwatson.htm


回頂端
 個人資料  
 
文章發表於 : 2004年 7月 9日, 14:48 
離線

註冊時間: 2003年 5月 6日, 12:02
文章: 329
來自: fullback
另外可以參考 微軟知識庫文件 - 275481


How to Troubleshoot Program Faults with Dr. Watson
適用於
This article was previously published under Q275481
SUMMARY
This article describes how to use Dr. Watson to troubleshoot program errors that occur when you are running Microsoft Windows 98, Windows 98 Second Edition, and Windows Millennium Edition (Me).
MORE INFORMATION
Dr. Watson is a program error troubleshooting tool that traps program faults (that are running in ring three of the processor), and generates a snapshot of the operating system that you can use to diagnose the fault. This tool interprets program errors in Windows-based programs and attempts to diagnose them. When you run Dr. Watson, it automatically creates a log file when a program fault occurs. The log files have a .wlg extension, and are stored in the \Windows\Drwatson folder. The log file indicates the program that created the fault, the program that the fault occurred in, and the memory address where the fault occurred. Dr. Watson cannot create a snapshot if the program does not respond (hangs).
Using Dr. Watson
When you run Dr. Watson (Drwatson.exe), it collects detailed information about the state of your operating system at the time of a program fault. Dr. Watson intercepts the software faults, identifies the software that faulted, and then provides a detailed description of the cause. When this tool is enabled, it automatically logs this information to the disk (\Windows\Drwatson\Watsonxxx.wlg); the information can then be displayed on the screen.

You can configure Dr. Watson to load automatically when Windows starts. To do this, create a shortcut to Drwatson.exe in the Startup folder. This configuration is useful when an issue is not easily reproducible. When Dr. Watson traps the program fault and creates the log, you can contact technical support for further assistance.

NOTE: Dr. Watson is best used with reproducible faults. With intermittent faults, you may not be able to determine the cause of the fault.

To start Dr. Watson, do one of the following:
On the Start menu, click Run, type Drwatson, and then click OK.

-or-
Follow these steps:
Click Start, point to Programs, point to Accessories, and then click System Tools.
Click System Information, and then on the Tools menu, click Dr. Watson.
When Dr. Watson is enabled, an icon is displayed on the taskbar.

If a program fault occurs, Dr. Watson generates a snapshot of the software environment. Click the Details button in the error message box to view the information gathered by Dr. Watson.

To generate a log file, double-click the Dr. Watson icon on the taskbar. Dr. Watson gathers information about the operating system, and then a Dr. Watson dialog box is displayed.

When Dr. Watson is loaded, click any tab to move out of the text box. The Dr. Watson window closes if you press ENTER.

To view the advanced tabs in Dr. Watson, follow these steps:
Double-click the Dr. Watson icon.
On the View menu, click Advanced View. The following tabs provide detailed information about your system that you can give to a support technician:
System: Includes information that you would see on the General tab of System Properties.
Tasks: Includes information about the tasks that were running when the snapshot was taken. This tab also includes information about the program, the version, the manufacturer, the description, the path, the type, and the program that this program is related to (when this information is available).
Startup: Includes information about the programs that are configured to load during Startup. This tab includes the program name, and information about where the program was loaded from, and the command line that is used to load the program.
Kernel Drivers: Includes information about where the Kernel-mode drivers are installed, including the name of the driver, the version, the manufacturer, the description, the likely path, information about where the driver is loaded from, the type of driver, and the program that the driver related to (when information is available).
User Drivers: Includes information about the User-mode drivers that are installed, including the name of the driver, the version, the manufacturer, the description, the likely path, the type of driver, and the program that the driver is related to (when information is available).
MS-DOS Drivers: Includes information about the MS-DOS drivers that are installed.
16-bit Modules: Includes information about the 16-bit modules that were in memory when the snapshot was taken, including the name of the module, the version, the manufacturer, the description, the likely path, the type of driver, and the program that the driver is related to (when information is available).
Details (this tab is only displayed when Dr. Watson has captured a fault): Lists the events that occurred before and during the fault, in progressive order.
If you experience a program fault, and you want to use Dr. Watson, follow these steps:
Try to reproduce the fault to verify that it is not a random failure.
Click Start, point to Programs, point to Accessories, and then click System Tools.
Click System Information, and then on the Tools menu, click Dr. Watson.
Reproduce the fault.
Click Details in the Program Fault window.
View the Diagnosis window to determine the source of the fault.
If the issue is intermittent or not easy to reproduce, put Dr. Watson in your Startup folder so that it is always running. The Dr. Watson dialog box includes a text box that you can use to enter information about what you were doing when the issue occurred. You should provide information about the programs that were running, and the steps that resulted in the program fault.

NOTE: After you type the information in the text box, on the File menu, click Save or Save As to save the file. If you only click OK in the Dr. Watson dialog box, the information that you enter in the text box is not saved.

When a program fault occurs, the Dr. Watson log file is automatically named Watsonxxx.wlg (where xxx is an incremented number). By default, Dr. Watson log files are saved to the \Windows\Drwatson folder. To save the information generated by Dr. Watson, click Save on the File menu.

You can view a Dr. Watson log file by using the Dr. Watson program or by using Microsoft System Information (MSInfo). To view Dr. Watson log files by using MSInfo, follow these steps:
Click Start, point to Programs, point to Accessories, point to System Tools, and then click System Information.
On the File menu, click Open.
Open the folder where the Dr. Watson log is saved.
In the Files of type list, click Dr. Watson Log File (*.wlg).
Click the file, and then click Open.
To print Dr. Watson log files, on the File menu, click Print. To print only specific information, use Microsoft System Information to view the log file, and then copy the specific information to a text editor, such as Microsoft Notepad.

NOTE: A typical Dr. Watson log can be over 15 pages, depending on the software running.
Customizing Dr. Watson
To customize Dr. Watson, on the View menu, click Options. You can select any of the following options:

Log Files: Configures the number of log files that are able to be stored on the computer and the folder that the log files are saved in.
Disassembly: Configures the number of CPU instructions and stack frames that are reported in the log file. You need to configure these options only when you are requested to do so by technical support.


回頂端
 個人資料  
 
文章發表於 : 2004年 7月 9日, 16:43 
離線

註冊時間: 2003年 5月 6日, 12:02
文章: 329
來自: fullback
這個功能更強不但可以允許Win9X 的使用者 類似 win nt 2000 的方式關閉 process 並可以檢查註冊檔中 invalid entries 並可以delete 還有 資源監控的功能可以解決資源 備不明原因大量耗損的問題 還可以監控網路的連線狀況
......最好的是它支援Win9x and win NT/2000.....好好利用吧 不過是shareware 有試用期
有關下載的資訊如下 :
https://www.glocksoft.com/process_info.htm

圖檔


最後由 王世達 於 2006年 3月 28日, 14:38 編輯,總共編輯了 1 次。

回頂端
 個人資料  
 
 文章主題 : SIG^2 G-TEC
文章發表於 : 2004年 8月 5日, 16:14 
離線

註冊時間: 2003年 2月 26日, 14:25
文章: 346
來自: TAIWAN
提供Kernel相關資訊工具(含Source Code)
https://www.security.org.sg/code/kproccheck.html

代碼:
C:\KProcCheck-0.2beta2\KProcCheck>kproccheck
KProcCheck Version 0.2-beta2 Proof-of-Concept by SIG^2 (www.security.org.sg)

Usage: kproccheck -p    show kernel active process list.
       kproccheck -s    show scheduler thread list.
       kproccheck -o    show processes by traversing Handle Table list.
       kproccheck -d    show kernel module list.
       kproccheck -t    show hooked SDT entries.
       kproccheck -g    show hooked GDI SDT entries.
       kproccheck -u    unload support driver.

代碼:
C:\KProcCheck-0.2beta2\KProcCheck>kproccheck -p
KProcCheck Version 0.2-beta2 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of ActiveProcessLinks

4     -           System
172   -      wscntfy.exe
212   -          cmd.exe
276   -      wuauclt.exe
488   -     vmtoolsd.exe
568   -         smss.exe
632   -        csrss.exe
664   -     winlogon.exe
708   -     services.exe
720   -        lsass.exe
844   -  VMUpgradeHelper
880   -     vmacthlp.exe
904   -      svchost.exe
972   -      svchost.exe
1056  -      svchost.exe
1112  -      svchost.exe
1156  -      svchost.exe
1276  -   KProcCheck.exe
1368  -       conime.exe
1416  -      spoolsv.exe
1564  -     explorer.exe
1660  -   VMwareTray.exe
1676  -   VMwareUser.exe
1708  -       ctfmon.exe
1888  -          alg.exe

Total number of processes = 25

代碼:
C:\KProcCheck-0.2beta2\KProcCheck>kproccheck -s
KProcCheck Version 0.2-beta2 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4     -           System
212   -          cmd.exe
488   -     vmtoolsd.exe
632   -        csrss.exe
664   -     winlogon.exe
708   -     services.exe
720   -        lsass.exe
904   -      svchost.exe
972   -      svchost.exe
1056  -      svchost.exe
1156  -      svchost.exe
1368  -       conime.exe
1532  -      notepad.exe
1564  -     explorer.exe
1660  -   VMwareTray.exe
1676  -   VMwareUser.exe
1708  -       ctfmon.exe

Total number of processes = 17
NOTE: Under WinXP, this will not show all processes.

代碼:
C:\KProcCheck-0.2beta2\KProcCheck>kproccheck -o
KProcCheck Version 0.2-beta2 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of HandleTableList

4     -           System
172   -      wscntfy.exe
212   -          cmd.exe
276   -      wuauclt.exe
488   -     vmtoolsd.exe
568   -         smss.exe
632   -        csrss.exe
664   -     winlogon.exe
708   -     services.exe
720   -        lsass.exe
844   -  VMUpgradeHelper
880   -     vmacthlp.exe
904   -      svchost.exe
972   -      svchost.exe
1056  -      svchost.exe
1112  -      svchost.exe
1156  -      svchost.exe
1368  -       conime.exe
1416  -      spoolsv.exe
1460  -   KProcCheck.exe
1532  -      notepad.exe
1564  -     explorer.exe
1660  -   VMwareTray.exe
1676  -   VMwareUser.exe
1708  -       ctfmon.exe
1888  -          alg.exe

Total number of processes = 26

代碼:
C:\KProcCheck-0.2beta2\KProcCheck>kproccheck -d
KProcCheck Version 0.2-beta2 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D8000 - \WINDOWS\system32\ntkrnlpa.exe
806D1000 - \WINDOWS\system32\hal.dll
F8B9A000 - \WINDOWS\system32\KDCOM.DLL
F8AAA000 - \WINDOWS\system32\BOOTVID.dll
F856B000 - ACPI.sys
F8B9C000 - \WINDOWS\system32\DRIVERS\WMILIB.SYS
F855A000 - pci.sys
F869A000 - isapnp.sys
F8AAE000 - compbatt.sys
F8AB2000 - \WINDOWS\system32\DRIVERS\BATTC.SYS
F8B9E000 - intelide.sys
F891A000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
F86AA000 - MountMgr.sys
F853B000 - ftdisk.sys
F8BA0000 - dmload.sys
F8515000 - dmio.sys
F8922000 - PartMgr.sys
F86BA000 - VolSnap.sys
F84FD000 - atapi.sys
F8AB6000 - vmscsi.sys
F84E5000 - \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
F86CA000 - disk.sys
F86DA000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
F84C5000 - fltMgr.sys
F84B3000 - sr.sys
F849C000 - KSecDD.sys
F840F000 - Ntfs.sys
F83E2000 - NDIS.sys
F83C8000 - Mup.sys
F86EA000 - agp440.sys
F874A000 - \SystemRoot\system32\DRIVERS\i8042prt.sys
F8952000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
F8BA4000 - \SystemRoot\system32\DRIVERS\vmmouse.sys
F895A000 - \SystemRoot\system32\DRIVERS\mouclass.sys
F8343000 - \SystemRoot\system32\DRIVERS\parport.sys
F875A000 - \SystemRoot\system32\DRIVERS\serial.sys
F8B3E000 - \SystemRoot\system32\DRIVERS\serenum.sys
F8962000 - \SystemRoot\system32\DRIVERS\fdc.sys
F876A000 - \SystemRoot\system32\DRIVERS\cdrom.sys
F877A000 - \SystemRoot\system32\DRIVERS\redbook.sys
F8320000 - \SystemRoot\system32\DRIVERS\ks.sys
F878A000 - \SystemRoot\system32\DRIVERS\vmci.sys
F897A000 - \SystemRoot\system32\DRIVERS\vmx_svga.sys
F830C000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
F8982000 - \SystemRoot\system32\DRIVERS\usbuhci.sys
F82E8000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
F898A000 - \SystemRoot\system32\DRIVERS\vmxnet.sys
F879A000 - \SystemRoot\system32\drivers\es1371mp.sys
F82C4000 - \SystemRoot\system32\drivers\portcls.sys
F87AA000 - \SystemRoot\system32\drivers\drmk.sys
F8B46000 - \SystemRoot\system32\DRIVERS\CmBatt.sys
F87BA000 - \SystemRoot\system32\DRIVERS\intelppm.sys
F8B4A000 - \SystemRoot\system32\DRIVERS\fsvga.sys
F8C9F000 - \SystemRoot\system32\DRIVERS\audstub.sys
F87CA000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
F8B4E000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
F82AD000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
F87DA000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
F87EA000 - \SystemRoot\system32\DRIVERS\raspptp.sys
F8992000 - \SystemRoot\system32\DRIVERS\TDI.SYS
F8274000 - \SystemRoot\system32\DRIVERS\psched.sys
F87FA000 - \SystemRoot\system32\DRIVERS\msgpc.sys
F899A000 - \SystemRoot\system32\DRIVERS\ptilink.sys
F89A2000 - \SystemRoot\system32\DRIVERS\raspti.sys
F8244000 - \SystemRoot\system32\DRIVERS\rdpdr.sys
F880A000 - \SystemRoot\system32\DRIVERS\termdd.sys
F8BAE000 - \SystemRoot\system32\DRIVERS\swenum.sys
F8146000 - \SystemRoot\system32\DRIVERS\update.sys
F8B66000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
F881A000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F89AA000 - \SystemRoot\system32\DRIVERS\flpydisk.sys
F8B92000 - \SystemRoot\system32\DRIVERS\gameenum.sys
F883A000 - \SystemRoot\system32\DRIVERS\usbhub.sys
F8BB0000 - \SystemRoot\system32\DRIVERS\USBD.SYS
F8BB2000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F8CC6000 - \SystemRoot\System32\Drivers\Null.SYS
F8BB4000 - \SystemRoot\System32\Drivers\Beep.SYS
F89BA000 - \SystemRoot\System32\drivers\vga.sys
F8BB6000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F8BB8000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F89C2000 - \SystemRoot\System32\Drivers\Msfs.SYS
F89CA000 - \SystemRoot\System32\Drivers\Npfs.SYS
F8387000 - \SystemRoot\system32\DRIVERS\rasacd.sys
B2DCD000 - \SystemRoot\system32\DRIVERS\ipsec.sys
B2D74000 - \SystemRoot\system32\DRIVERS\tcpip.sys
B2D4C000 - \SystemRoot\system32\DRIVERS\netbt.sys
F8377000 - \SystemRoot\System32\drivers\ws2ifsl.sys
B2CFE000 - \SystemRoot\system32\DRIVERS\ipnat.sys
F884A000 - \SystemRoot\system32\DRIVERS\wanarp.sys
B2CDC000 - \SystemRoot\System32\drivers\afd.sys
F885A000 - \SystemRoot\system32\DRIVERS\netbios.sys
B2CBE000 - \SystemRoot\System32\DRIVERS\vmhgfs.sys
F886A000 - \??\C:\WINDOWS\system32\Drivers\vmdebug.sys
B2C93000 - \SystemRoot\system32\DRIVERS\rdbss.sys
B2C23000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys
F888A000 - \SystemRoot\System32\Drivers\Fips.SYS
F88BA000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F89E2000 - \SystemRoot\system32\DRIVERS\usbccgp.sys
F8295000 - \SystemRoot\system32\DRIVERS\hidusb.sys
F88CA000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
F89EA000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
F8291000 - \SystemRoot\system32\DRIVERS\mouhid.sys
B2BE3000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F8BBA000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F813A000 - \SystemRoot\System32\drivers\Dxapi.sys
F89F2000 - \SystemRoot\System32\watchdog.sys
BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
F8D1C000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9D5000 - \SystemRoot\System32\vmx_fb.dll
B2AF3000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
B2796000 - \SystemRoot\system32\drivers\wdmaud.sys
B2A23000 - \SystemRoot\system32\drivers\sysaudio.sys
B25AB000 - \SystemRoot\system32\DRIVERS\mrxdav.sys
F8C4E000 - \SystemRoot\System32\Drivers\ParVdm.SYS
F8C50000 - \??\C:\Program Files\VMware\VMware Tools\Drivers\memctl\vmmemctl.sys
B24E1000 - \SystemRoot\system32\DRIVERS\srv.sys
B2180000 - \SystemRoot\System32\Drivers\HTTP.sys
B208A000 - \SystemRoot\system32\drivers\kmixer.sys
F8DB1000 *  --[Hidden]--

Total number of drivers = 120

代碼:
C:\KProcCheck-0.2beta2\KProcCheck>kproccheck -t
KProcCheck Version 0.2-beta2 Proof-of-Concept by SIG^2 (www.security.org.sg)

Checks SDT for Hooked Native APIs

Error getting Kernel base address!

C:\KProcCheck-0.2beta2\KProcCheck>
C:\KProcCheck-0.2beta2\KProcCheck>kproccheck -g
KProcCheck Version 0.2-beta2 Proof-of-Concept by SIG^2 (www.security.org.sg)

Checks Shadow SDT for Hooked Native GDI APIs

KeServiceDescriptorTableShadow                          80553F60
KeServiceDescriptorTableShadow.SDE[1].ServiceTable      BF999B80
KeServiceDescriptorTableShadow.SDE[1].ServiceLimit      667

Number of GDI Service Table entries hooked = 0

C:\KProcCheck-0.2beta2\KProcCheck>kproccheck -u
KProcCheck Version 0.2-beta2 Proof-of-Concept by SIG^2 (www.security.org.sg)

Support driver successfully unloaded.

C:\KProcCheck-0.2beta2\KProcCheck>


上一層還有
漏洞相關資訊
https://www.security.org.sg/vuln/index.html

不知道這組織,是否算新加坡之官方組織 :roll:


回頂端
 個人資料  
 
 文章主題 :
文章發表於 : 2004年 10月 12日, 15:41 
離線

註冊時間: 2003年 5月 6日, 12:02
文章: 329
來自: fullback
sysinternals 的 process explorer 已經出新版 v8.5
也有相同的功能 而且是免費

不過一定要到sysinternals下載
資訊如下
https://www.sysinternals.com/ntw2k/freeware/procexp.shtml


回頂端
 個人資料  
 
 文章主題 :
文章發表於 : 2005年 4月 14日, 09:03 
離線

註冊時間: 2003年 5月 6日, 12:02
文章: 329
來自: fullback
另外還有一個軟體 也可以 列舉 但功能沒有process explorer強 但是它有掃 bots 等trojan 的功能 可以試試 但不知好不好 相關下載資訊如 下
https://www.swatit.org/download.html


回頂端
 個人資料  
 
 文章主題 :
文章發表於 : 2005年 6月 20日, 11:32 
離線

註冊時間: 2003年 5月 6日, 12:02
文章: 329
來自: fullback
Dependency Walker

另外有一個 工具 可以查看 32bits or 64bits windows module 的細部資訊 對於PD 很有幫助, 之前 yoshiotw sir 有推薦過 值得放到這裡 供大家參考

Dependency Walker is a free utility that scans any 32-bit or 64-bit Windows module (exe, dll, ocx, sys, etc.) and builds a hierarchical tree diagram of all dependent modules. For each module found, it lists all the functions that are exported by that module, and which of those functions are actually being called by other modules. Another view displays the minimum set of required files, along with detailed information about each file including a full path to the file, base address, version numbers, machine type, debug information, and more.

Dependency Walker is also very useful for troubleshooting system errors related to loading and executing modules. Dependency Walker detects many common application problems such as missing modules, invalid modules, import/export mismatches, circular dependency errors, mismatched machine types of modules, and module initialization failures.

Dependency Walker runs on Windows 95, 98, Me, NT, 2000, XP, and 2003. It can process any 32-bit or 64-bit Windows module, including ones designed for Windows CE. It can be run as graphical application or as a console application. Dependency Walker handles all types of module dependencies, including implicit, explicit (dynamic / runtime), forwarded, delay-loaded, and injected. A detailed help is included.

Dependency Walker is completely free to use. However, you may not profit from the distribution of it, nor may you bundle it with another product.

下載資訊
https://www.dependencywalker.com

圖檔


回頂端
 個人資料  
 
文章發表於 : 2006年 11月 9日, 13:11 
離線

註冊時間: 2003年 5月 6日, 12:02
文章: 329
來自: fullback
功能類似 請參考

https://www.microsoft.com/technet/sysinternals/SystemInformation/processmonitor.mspx


回頂端
 個人資料  
 
 文章主題 :
文章發表於 : 2007年 8月 25日, 23:58 
離線

註冊時間: 2007年 8月 25日, 15:41
文章: 153
提到這類的軟體,不能不提icesword 冰刃
至於這把刀利不利,就看你怎麼用了

_________________
小遊戲 | 遊戲 | 好玩遊戲 | 海綿寶寶 | 楓之谷小遊戲


回頂端
 個人資料  
 
文章發表於 : 2008年 3月 17日, 18:31 
離線

註冊時間: 2003年 5月 6日, 12:02
文章: 329
來自: fullback
netstat -abvp tcp
執行上面的指令也可以有一些幫忙
SANS 有一些文件可以參考
https://isc.sans.org/diary.html?storyid=1911&rss


回頂端
 個人資料  
 
 文章主題 :
文章發表於 : 2008年 3月 17日, 20:45 
離線

註冊時間: 2002年 9月 25日, 10:57
文章: 8868
來自: R.O.C
感謝分享好東西


回頂端
 個人資料  
 
 文章主題 :
文章發表於 : 2008年 7月 22日, 11:35 
離線

註冊時間: 2007年 9月 5日, 03:03
文章: 2
thanks alot

_________________
天生我材必有用

沉睡的小五郎


回頂端
 個人資料  
 
顯示文章 :  排序  
發表新文章 回覆主題  [ 21 篇文章 ]  前往頁數 12  下一頁

所有顯示的時間為 UTC + 8 小時


誰在線上

正在瀏覽這個版面的使用者:沒有註冊會員 和 1 位訪客


不能 在這個版面發表主題
不能 在這個版面回覆主題
不能 在這個版面編輯您的文章
不能 在這個版面刪除您的文章

搜尋:
前往 :  
POWERED_BY
正體中文語系由 竹貓星球 維護製作