Accessing the Stack?

Hey, I'm wondering if anyone knows if its possible to access the stack of a process remotely on Windows XP. i.e. you have Process A running on a computer and then Process B accesses Process A via the necessary memory access calls. I am wondering if its possible to modify that process's stack remotely in order to call functions within Process A. Should this maybe be done with a dll thats attached during runtime rather than an external program? Basically I am trying to have a process or module access the functions within an active process.

I'm sorry if I'm being vague, I'm just not entirely sure of how Windows programs handle their stack. On the other hand, my concept of the stack might be entirely off which would certainly cause a bunch of problems.

2 Answers

Relevance
  • 1 decade ago
    Best Answer

    Oh. very nice question!

    In fact, if you want to access the memory or functions of a specific process, you won't need to get direct access to the process stack.

    To get access a process function you can use the "GetProcHandle" api method, which returns the pointer to the function of the specific process. Consider that you should do this steps to gain access such the methods:

    1) Open or create your specified process,

    2) Gain a process handle (For more details see "OpenProcess" or "CreateProcess" in MSDN)

    3) Gain a handle to the method stored module. (You can do that by "LoadModule" or enumurating the process modules using "EnumProcessModules". You can see complete details in MSDN)

    4) Use "GetProcAddress" to retrieve a pointer to the needed function in foreign process.

    5) Call the function by it's pointer.

    I recomend you to this steps using C or C++.

    Note that if you want to define a pointer for the function, you must know the arguments of that function, else your pointer will not be useful and cause errors.

    If this description didn't help you I advice you to search MSDN or internet specially http://www.thecodeproject.com about "Importing dll methods" because this way is also used in importing dll functions into programs and sensitively in C and C++.

    Be Succeed,

    Babax.

  • 1 decade ago

    no, this is not allowed, for security reasons. you need to be part of process A.

    Therefore, if process A loads a DLL at runtime, the DLL is loaded into A's process space and is able to access the stack.

    However, then you're detached from Process B, and B can't control this execution. In this case, you'd need a communication channel between B and the DLL.

Still have questions? Get your answers by asking now.