Tuesday, September 12, 2006

command line security tool: X-ps v1.0

You can use this tool to show all process, find loaded dll, search string from process, kill process. even more, you can inject or release dll to a process. This tool is useful for security engineer.

download X-ps tool from UNNOO website:X-ps v1.0

Options:
c:\>ps /h
X-PS v1.0, code by glacier@xfocus.org
USAGE:
/m: Display the modules information
/n : Display the process whose ID equal to
/f : Find the process/modules that contain
/k : Kill process
/i : Inject library into process
/e : Eject library from process

Example:
ps /m
show all process and all dll loaded.

ps /m /n 1012
show all dll that process id=1012

ps /m /f "user32.dll"
search "user32.dll" string from all loaded dll

ps /i explorer.exe hook.dll
inject hook.dll to explorer.exe

ps /e * hook.dll
eject hook.dll from all process

No comments: