0

I was trying to use

https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/memory_grep.rb

using the stack-based method. However it wasn't working. What I do is migrate to the actual process I am trying to read memory from, then drop to irb and execute the commands:

proc = client.sys.process.open(session.sys.process.getpid, PROCESS_ALL_ACCESS)
tid = proc.thread.each_thread.first
thread = proc.thread.open(tid)
esp = thread.query_regs['esp']

When I do that, esp is set to 0, which doesn't seem right. Also, alot of the other registers are set to 0, including eip. From processhacker I can see the eip and it's definetly not 0.

Would someone be able to help me out to figure out what I'm doing wrong? I am running this on Win7 x64 box.

Also, if I go into processhacker and figure out the memorylocation, I can read the data using proc.memory.read, I just want to be able to do that dynamically.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.