Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 04-05-2005, 02:00
abitofboth
 
Posts: n/a
Beating a two session max!

I got this application.

It will let me run two instances of this app at the same time, no more!

Having two installations doesnt solve the problem.
Renaming the exe doesnt solve the problem.
Renaming the top window handle doesnt solve the problem.

It could be a registry value, ill check that with a monitor now, but i HIGHLY doubt that is it! Just two many possible error factors involved.

Could it really be that this app iterates through all running processes trying a ReadProcessMemory for identification ? This sounds far fetched as well, but its the nect logical conclusion I can come up with!
Key words : I can come up with
Well.. Im a noob! Dont kill me plz ?
I just wanted some input, what do YOU think is the most likely explanation for this behavior!
(also, the app doesnt host a serversocket, its not a port comm thing!)

Actually..

while reviewing network activity in different versions of netstat (with gui's and all) yields nothing interresting, using SysInternals TDImon yielded an interresting result !!

To quote the help !

"TDImon gets its name from the fact that it monitors activity at the Transport Driver Interface (TDI) level of networking operations in the operating system kernel."

And what is kinda interresting is that only THREE processes show activity here
explorer.exe
myfirewall.exe
theappthatannoysme.exe

So maybe it DO have some loopback activity going on ?

It shows up as TDI_SEND TCP:10.0.0.2 (my ip) SUCCESS-562 length:32


Allrighty then !!!!!!
Both sessions show this behavior!! (using different destination ports!)


First thing : Is this the monkey im chasing ?
Second thing : How do I bean it ? (firewall blocking doesnt seem like an option!)

[Edit JMI: DO NOT answer your own post. Use the EDIT Button. That's what it's for.]
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Starting a debugging session with Flexlm lmgrd and a vendor specific daemon zaratustra General Discussion 14 12-30-2005 19:55
beating IsDebuggerPresent for my unpacker 0x539 General Discussion 14 03-02-2005 05:01


All times are GMT +8. The time now is 10:47.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )