December 2007 - Posts

• How to isolate a service in its own scvhost.exe

  This is a very good public link to read about service control manager internals and how to manage services. download. microsoft .com/download/f/ 3/9/f3900e1e-a45c-45a4-b716-740e553e1f62/SPTCF_SYS.doc Description of svchost.exe http://support.microsoft.com/kb/314056 Read More... Posted Sunday, December 23, 2007 2:30 PM by ganand | 2 Comments Filed under: services

• How do transition from user mode to kernel mode takes place

  NTDLL is used to call into the operating system, which is (generally) in the address range (0x80000000-0xFFFFFFFF). The operating system addresses are not accessible in user-mode; therefore a special protected mechanism (using a CPU instruction which Read More... Posted Sunday, December 23, 2007 2:25 PM by ganand | 1 Comments

• Dumping out notepad.exe and ntdll.dll

  I tried to dump out the headers and data sections of notepad.exe and ntdll.dll to figure out what are their dependents and what are the functions and services provided by ntdll.dll along with service numbers which are used in kernel mode. Microsoft (R) Read More... Posted Sunday, December 23, 2007 1:57 PM by ganand | 1 Comments