Bugtraq mailing list archives

Re: [Mlabs] Dissecting Internals of Windows XP Svchost : Reverse Engineering Stature


From: "J. Oquendo" <sil () infiltrated net>
Date: Fri, 21 Sep 2007 13:32:21 -0400

Aditya K Sood wrote:
Hi all

This is the reverse Engineering layout of Scvhost Internals.

|Category : Reverse Engineering Analysis.

The paper solely relates to the core internals that build up the
Windows XP Svchost. The Svchost internals have not been disseminated
into informative elements yet. I have found only one or two analysis
but that wont satisfy my views regarding XP Svchost. The anatomy of
Svchost has got complexity in its own term. This pushes me to write
a specific analysis over it. The analysis provide a structural design
with concept wise dissection. The point is to understand the hidden
artifacts and how it affects the working aspect of prime service host
controller.Every process is disseminated into primary process and
secondary process. In terms related to operating system there is a parent
process and its child. If one look at the implementation scenario then
child processes are undertaken as thread internally. The kernel level
implementation is subjugated like this. The XP Svchost runs as threads
under services process.|

http://mlabs.secniche.org/winxp_svchost.html
http://mlabs.secniche.org/papers/Win_Xp_Svc_Int.pdf

Regards
Aks aka 0kn0ck
http://mlabs.secniche.org | http://www.secniche.org


I'd like to know which of the genius moderators let this guy's
information get through. He's nothing more than a plagiarist passing bad
information to the community. Its shameful what Bugtraq has become. Has
anyone from there taken a look at the information this clown is posting
or someone asleep at the wheel.

-- 
====================================================
J. Oquendo
"Excusatio non petita, accusatio manifesta"

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xF684C42E
sil . infiltrated @ net http://www.infiltrated.net

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature


Current thread: