ProcessInspect BOF

A CS BOF which can be used to inspect process memory, addresses and symbols!

Overview of commands

Send patches! Send recommendations for more commands!

BOF commands

lm

The lm command lists loaded modules in the current process. When invoked without arguments it returns every loaded DLL; when given a DLL name it returns details for just that module (base address, entry point, size, full path).

Syntax

psi lm [dll]

Parameters:

• dll (optional): The name of a loaded DLL to look up. If omitted, every loaded module is listed.

Example:

psi lm
psi lm ntdll.dll
psi lm kernel32.dll

addr

The addr command returns the value at a given address

Syntax:

psi addr <address> <type> [count]

• address: The address to inspect in hex
• type: This controls how to treat the type of data at the given address. Valid values are: BYTE, WORD, DWORD, LPVOID. Therefore, if a user provides a value DWORD, then a chunck of size(DWORD) is read at that address. Each chunk is printed as a 0x-prefixed little-endian value whose width equals the type size (e.g. a WORD row groups as 0xaabb 0xccdd ...). Type names are matched case-insensitively. Same-sized Win32 aliases (int, ULONG, ULONG64, HANDLE, etc.) are intentionally omitted — use BYTE/WORD/DWORD/ for 1/2/4/8-byte reads.

The output should be a hexdump starting at the given address and chuncks grouped together

Example:

psi addr 0xdeadbeef DWORD 2 
psi addr 0xdeadbeef LPVOID
psi addr 0xdeadbeef WORD 8

meminfo

The meminfo command returns various information about a given memory address including:

• Name of the module backing the address if any
• Memory permissions of the memory region R/W/X
• Any associated symbols at that address fetched from microsoft symbol server
• Other information similar to windbg !address command

Syntax:

psi meminfo <address> 

• address: The address to inspect in hex

Example:

psi addr 0xdeadbeef

lt

The lt command prints all the threads of the current process along with their TID and entrypoint

Syntax

psi lt

regdump

The regdump command dumps CPU registers for a thread. The thread id (tid) is optional: if omitted, the calling Beacon thread is dumped via RtlCaptureContext; if supplied, that thread in the current process is suspended for the duration of the snapshot. If a register name is supplied, only that register is printed; otherwise every supported register is dumped, including the full x64 GPR set plus RFLAGS, segment registers, debug registers, SSE (XMM), AVX/AVX2 (YMM), and AVX-512 (ZMM / kmask) — the last three gated on the host's CPU feature support. Register names are matched case-insensitively and accept sub-width aliases (e.g. eax, ax, ah, al all resolve against the same underlying GPR).

Syntax:

psi regdump [tid] [register]

• tid: optional thread id whose context to dump. If omitted, the calling Beacon thread is captured directly.
• register: optional register name to filter the output to a single register. Requires tid to be specified.

Example:

psi regdump
psi regdump 12345
psi regdump 12345 rip
psi regdump 12345 ymm0

Building BOFs

To compile a BOF, update the src/hello.cc file or the Makefile to reflect the necessary changes and then type:

$ docker-compose up --build

Built using the template from: https://github.com/whokilleddb/cs-bof-template