Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [winapi]

Microsoft's application programming interfaces available in the Windows operating system.

0
votes
0answers
39 views

What is causing handles to be opened to crypto/RSA files when debugging with IDA?

When I debug an exe file in IDA and watch what happens in Procmon, I see a couple of calls to CreateFile C:\Users\UserName\AppData\Roaming\Microsoft C:\Users\UserName\AppData\Roaming\Microsoft\Crypto\...
2
votes
1answer
148 views

What is the difference between kernelBase.dll and Kernel32.dll

What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ? Why both of them implement WideCharToMultiByte ?
3
votes
0answers
41 views

int 2eh instead of syscall/sysenter [duplicate]

I have been looking into ntdll.dll on windows 10 x64 bit, and i noticed a check inside the ntdll like this: So after testing some bit, it tries to execute the system call via int 2eh. I have tried to ...
1
vote
0answers
91 views

Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)

In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
1
vote
1answer
120 views

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. When I'm ...
2
votes
1answer
97 views

Missing kernel32.dll in import table

I have very basic application which is console app dispaying message box. In Visual Studio I change following options: - C/C++ -> SecurityCheck -> Disable Security Check (/GS-) - Linker -> ...
3
votes
1answer
178 views

How to debug slow Windows API calls?

My machine at work has recently been updated to Windows 10, from Windows 7, and it has become incredibly slow. The IT has installed a bunch of new tools for security and protection after the upgrade ...
2
votes
1answer
73 views

How to see ReadFile results with ProcMon

I running procmon to monitor my process, and see that my process uses ReadFile API. How can I see which data the process received when it uses ReadFile?
0
votes
2answers
73 views

Magic number in resource loading routine

I'm practicing windows disassembly on x64 notepad.exe I've managed to find buffer allocation and string resources load. But after that follows code, which I can't fully understand: rbx = 0, rdx = 0 ...
3
votes
1answer
129 views

Why does this function calls offset move when I restart windows

Every time I restart windows it breaks the patch I've made to an executable where I've called a function from the dll user32.dll. Currently the offset for the function call resides at 0x76E3CDB4, but ...
1
vote
2answers
2k views

What is \Sessions\1\BaseNamedObjects\NamedBuffer?

I see those in a debugger (OllyDbg, handles subwindow), but I never meet an explanation on what those are. Here is the full content of it, and to be honest I want to know the meaning of all of this. ...
0
votes
3answers
656 views

In Memory DLL Injection

I am currently working on learning how different types of DLL injection can be performed. Right now I am able to run a function by: Opening the remote process; Allocating memory in remote process; ...
0
votes
1answer
112 views

Information about packers

i was trying to search for some information about packers just to learn more about it, there is a lot of stuff out there but its hard to find something that really explain that good and clear, I would ...
1
vote
1answer
127 views

Find the code used when you right click and select “Bring To Front” in Task Manager

How can I find out what code is being called when you right click on a process in Windows Task Manager, and click on "Bring To Front" ? This is related to https://stackoverflow.com/questions/45046765/...
1
vote
2answers
223 views

Dumping Memory to Raw File

Is there a way to dump a section of process memory knowing the start and end address to raw bin file via a winapi function or some other method? I know that you can do this easily with a debugger, but ...
3
votes
3answers
366 views

How to debug ServiceMain function of a service?

I have a malware which is checking for keyboard type and locale information. After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
1
vote
0answers
47 views

Fighting programs that don't respond to Send/PostMessage-based input

This can be difficult to ask because 1) people assume this is necessarily malicious and 2) unrelated but effectual techniques like GetForegroundWindow can make this impossible to answer. So, to keep ...
0
votes
2answers
363 views

How can I get the process information in windows without using APIs?

I want to write a program to obtain the information of process, for the purpose of detecting and combating malware. I can use C++ and Win32 APIs to finish it, but I then started suspecting those APIs ...
4
votes
1answer
202 views

How to debug packet processing with overlapped socket on Windows

The problem is quite complex so i don't want to run into unneccessary details. I have a network application, that communicates with multiple clients at once via UDP. I haven't written it and there is ...
0
votes
1answer
69 views

How to bypass this old windows application's free disk space check?

This windows application checks the available disk space when an attempt is made to enable a feature. The error message can be translated into "You need 2145461018 more bytes to load this tileset. ...
0
votes
1answer
238 views

How to capture Data from OllyDbg window?

I'm trying to capture data from OllyDbg's info window (PWM_INFO), to do that I've captured that particular window using winspy++, how could i use the info provided by winspy++ with the WinAPI? I mean, ...
1
vote
1answer
2k views

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

When I analyzed this malware sample it was invoking api's related to creating additional processes. With the process explorer I saw the debugged process is creating a new process. Please suggest any ...
1
vote
2answers
225 views

Identifying DeviceIoControl argument

I am reversing an application that uses the serial interface (COM1 port) and am using API Monitor to trace through the API calls. I found a reference to CreateFileA("\\.\Commsb96", GENERIC_READ | ...
1
vote
3answers
684 views

Winapi ReadFile monitor

I'm trying to make a small proxy dll that will be able to print out all the files that a game tries to access from disk. I'm using a dinput8 wrapper dll as my proxy dll, from where I've managed to ...
5
votes
1answer
3k views

IDA python, list all imported functions

I have the following IDA python script. It sets and removes breakpoints on all calls to library functions: import idc import idaapi import idautils def set_breakpoints(): ea = idc.ScreenEA() ...
2
votes
1answer
191 views

Changes on threads and threading system, in new Windows OS

I looked up the source code of the functions like CreateProcess and CreateThreade from kernel32. For example, CreateThread@kernel32 leads into kernelbase.dll and ends with a call to NtCreateThreadEx. ...
1
vote
0answers
136 views

How do I access the TEB in PIN?

In PIN's documentation it says this about PIN_SafeCopy: PIN_SafeCopy is used to copy the specified number of bytes from a source memory region to a destination memory region. This function ...
0
votes
2answers
188 views

Can benign applications have such APIs?

I am new to malware analysis .. and I was analyzing some 'windows' apps and found functions that I thought it exist only on malware, is this possible or there is something wrong with my analysis ? I ...
0
votes
2answers
164 views

MSDetour not detouring SHGetKnownFolderPath

Tried to hook SHGetKnownFolderPath from shell32, using the normal DetourFunctionWithTrampoline, and it could not. Investigating, it seen that the application use GetProcAddress to load the function, ...
5
votes
2answers
536 views

CreateProcess - First thread routine - where is the memory allocated for the thread?

When calling CreateProcess internally it will call (obviously ZwCreateProcessEx and then) ZwCreateThread with a CreateSuspended set to True, then i assume final initialization is taking place. ...
2
votes
0answers
51 views

Inserting Win32 controls into MFC application [closed]

I was wondering if there's a way to insert native win32 controls(button, static, etc.) into a MFC application during runtime. I was abled to embed my dll but everytime I create a new control via ...
0
votes
1answer
238 views

Breaking on specific API

I wish to set a breakpoint on a call to a specific windows API function, e.g.- RegQueryValueExA() It is resolved at runtime in unknown stage of malware execution, and I wish to initiate manual ...
-1
votes
1answer
488 views

What does “mov [edi+68h], eax” mean?

What does mov [edi+68h], eax mean in the following asm code .text:0083FB35 call esi ; RegisterWindowMessageW .text:0083FB37 push offset My_Priv8_Msg ; "MY_PRIVATE_MSG" .text:...
4
votes
3answers
438 views

Is there a tool to see kernel space mapping of a Windows exe?

In Microsoft Windows, a 32bits process calc.exe has 0x0-0x80000000 (2GB) reserved as its user-space and the rest is kernel-space (2GB). So, a process has 2+2 = 4GB of virtual space. This ratio could ...
0
votes
1answer
91 views

How to find “enter” key event functions in games

I'm trying to locate the function that handles the Enter key press event from a dialog box in a very simple game (no directx afaik, game has a spashscreen that says "Made with Macromedia"). I think I'...
1
vote
1answer
543 views

Why do i get into endless loop in winapi when i am debugging?

I am debugging some quiz program called "abex crackme 1" When I execute this program without debugging, it shows a simple message box, which reads "Make me think your HD is a CD-Rom" After I click ...
6
votes
0answers
1k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
3
votes
2answers
1k views

How to debug a self-debugging process?

How do you swap debuggers in Windows? In my case, I have a process A which creates a copy of itself: CreateProcessA("XXX.exe", NULL, 0x0023f560, 0x0023f560, TRUE, **...
3
votes
0answers
378 views

Hooking the BootClassLoader [closed]

According to Wikipedia, there are 3 class loaders. The Boot Class-Loader which loads everything in RT.jar and /../jre/lib Then the extensions class loader and the system class loader. I'm only ...
2
votes
1answer
956 views

finding a RC4 Encryption function in obfuscated assembly code with no symbols

RC4 encryption is quite basic and its Pseudo random generation algorithm is given at Wikipedia When Looking for a hashing algorithm like MD5 or SHAx it is pretty simple to look for the Hashing ...
1
vote
1answer
135 views

GUI represention in assembly level and another question

In advance, I'd say I'm learning reverse engineering newly. Indeed, there are some questions to be asked. First of all I would ask : In assembly level of the applications which use GUI ,how things ...
1
vote
2answers
625 views

How to compare no-case sensitive strings IDC

So I want to track when a certain file is loaded into an Win32 app. That's way I put a break-point on 'CreateFile' which compares the first parameter with the target file name, but the problem is that ...
5
votes
1answer
1k views

DLL Injection search for procedures/variables

I am learning DLL injection basics and different techniques to achieve it, like using CreateProcess and LoadLibrary for example, or simply replacing a .dll in folder where the application to inject ...
1
vote
2answers
1k views

Command Injection in Windows ShellExecuteA()?

Imagine that we have the following pseudo-code in a Windows application: ShellExecuteA(0, "open", &File, &Parameters, &Directory, 1); And, imagine that you can gain control over the ...
0
votes
1answer
898 views

What are best practices for reversing a dll that is injected into another process?

For example, you want to use Ollydbg to reverse a binary that is injected using WriteProcessMemory and CreateRemoteThread. How do you do this with ease? Currently I am setting a breakpoint on ...
2
votes
2answers
323 views

Why cl.exe change the extern function name used in my code?

So basically I my nasm syntax asm code, I use some extern functions like this: extern _printf extern __imp__Sleep@4 .... call _printf call [__imp__Sleep@4] Then I use nasm to assemble it into obj:...
2
votes
3answers
692 views

Why IDA Pro generate define-lack code like this?

Basically I us IDA Pro 6.1 on Windows 32 bit, dealing with binaries from SPEC 2006. I use IDA Pro to generate asm code from the binaries, and in the .data section, I see data define like this: ...
1
vote
1answer
354 views

How to get the PID of the a thread's creator (not owner, not host)

The THREADENTRY32 structure contains a member called th32OwnerProcessID, which is described as: The identifier of the process that created the thread. I'm not sure if I understand how the ...
2
votes
1answer
651 views

Can a process disable UAC via WinAPI without prompting the user? [closed]

Is it possible for a running process to turn off User Account Control (UAC) via a Windows API call? If so, which API calls are needed? I found this interesting question/answer on stackoverflow, ...
6
votes
2answers
2k views

Can a Windows process check if it has been injected by another process?

There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger. Is it possible for a process to somehow detect if it has been ...