Re: windows smss.exe strings loaded in memory - are they hidden?

Perhaps you are denied PROCESS_VM_READ access to that process.

ReadProcessMemory:
http://msdn.microsoft.com/en-us/library/ms680553.aspx

Process Security and Access Rights:
http://msdn.microsoft.com/en-us/library/ms684880.aspx

Paul

<> wrote in message
news:93eb0b73-36d1-4e39-9a1b-...
> Hi all,
>
> I had nothing better to do so I checked on what kind of strings I
> could find inside Windows processes using the Sysinternals "Process
> Explorer".
>
> This tool can show strings inside executables currently running in
> Windows. In fact it has two settings:
> -"Image": to show the strings found inside the executable as it is on
> the hard disk
> -"Memory": to show the strings found inside the executable in RAM.
>
> (The reason for the two separate settings is that some times malware
> obfuscates strings so that they are visible only when the executable
> is in RAM)
>
> In any case, one of the processes I checked was smss.exe. I noticed
> that it shows a lot of strings when the "Image" radio button is
> selected, but when selecting the "Memory" radio button the window goes
> completely blank. Sort of gives one the impression that Process
> Explorer has no access to the in-memory strings?
>
> And after checking other processes it seems that smss.exe is the only
> MS process for which no strings are visible in the memory.
>
> What could be the cause of this? Could this be a side effect of how
> smss.exe itself is loaded into the memory?
>
> Thanks in advance