Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 46 guests online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Programmingarrow Using Assembly to access locked files
EH-Net
May 22, 2013, 11:06:08 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Using Assembly to access locked files  (Read 6673 times)
0 Members and 1 Guest are viewing this topic.
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« on: November 20, 2008, 10:28:43 PM »

Hey all,

Pardon my Assembly ignorance.  I am wondering if you can use Assembly language to access files locked for exclusive access by Windows.  For example, can I use Assembly to gain read access to Index.dat or the Swap File?   I am not entirely sure how you go about doing this since Windows locks files based on their Handles.   Since Assembly has lower level access, I am wondering if there are way to circumvent file locks.   Anyone have experience with this?

Numerous hex editors have circumvent file locks by reconstructing the file system on the fly.   I wonder if there is an easier way.
Logged

~~~~~~~~~~~~~~
Ketchup
NickFnord
Full Member
***
Offline Offline

Posts: 117



View Profile WWW
« Reply #1 on: November 21, 2008, 05:24:17 AM »

Since Assembly has lower level access,

I'm a relative newbie at assembly language programming also, so I'm not going to try to answer your main question, but I'm really curious as to why you think assembly has "lower level access" than any other programming language, and what that exactly means.

seeing as all compiled languages all end up running as machine code which can be directly translated into assembly language, you should be able to do most things with most languages, writing assembly just gives you a finer level of control. 

anyway, just thoughts.

Logged
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #2 on: November 21, 2008, 08:38:41 AM »

Well, like I said, I am an Assembly n00b.  Perhaps I phrased this wrong.   I believe that Assembly doesn't use file handles for I/O operation.   If I can access NTFS directly through Assembly, I may be able to bypass Windows file locking APIs.  NTFS doesn't lock files, Windows does it through File Handles.   Does this make more sense?
Logged

~~~~~~~~~~~~~~
Ketchup
geekyone
Full Member
***
Offline Offline

Posts: 180



View Profile
« Reply #3 on: November 21, 2008, 03:59:46 PM »

*Caveat* I am not an Assembly guru by any stretch of the imagination.
From what I know you are correct that Assembly doesn't use file handles it uses memory addresses instead (I think).  You could definitely write an Assembly program that accessed a locked file using it's memory address.  Although you might be limited in what you could do with it.
Logged

CISSP, CEH, GPEN, GCIH, GCFA
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #4 on: November 21, 2008, 04:30:53 PM »

Thanks.   I suppose the trick would be to figure out how to translate the Windows file Handle to a memory address. 
Logged

~~~~~~~~~~~~~~
Ketchup
apollo
Full Member
***
Offline Offline

Posts: 146


View Profile WWW
« Reply #5 on: November 21, 2008, 07:56:29 PM »

So.. I'm not a windows kernel hacker, but here is some speculation.  My guess would be that the ideal way to get to the things that you want is not assembly, but instead dll injection.  If you want to delete locked files, process explorer can probably help you.  If you want to scrape program memory, a debugger or such can be your best friend.  So I guess the real question is, what is your goal.  A file handle is basically just a view into the file that the operating system helps you keep track of so that you aren't doing a lot of other work that the operating system is already doing for you.  Files aren't always in one place on the disk, so the file handle makes sure you don't have to deal with that.  If you are trying to do something specific with these files, elaborate a little more and there may be some tools out there that will help you do what you'd like without writing any code.

Logged

CISSP, CSSLP, MCSE+Security, MCTS, CCSP, GPEN, GWAPT, GCWN, NOP, OSCP, Security+
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #6 on: November 24, 2008, 01:34:14 PM »

Hmm, dll injection may be an option.   I hadn't thought of that.   What I am trying to do is mainly copy certain files for offline analysis while the machine is running.   For example, I am trying to copy pagefile.sys and SYSTEM (registry).   I don't need to view or delete them from the default location.   

I can get these files by doing a complete live image, but that type of acquisition has other issues, like bit shifting and time requirements.
Logged

~~~~~~~~~~~~~~
Ketchup
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.07 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.