Questions tagged [winapi]

Microsoft's application programming interfaces available in the Windows operating system.

Filter by
Sorted by
Tagged with
2
votes
0answers
15 views

WinApi of UWΡ Shаdοws

I want to ask which WinApi methods being used to draw shadows under flyouts on UWΡ. What I know: This shаdοw disappearing when hiding flyout (via SW_HIDE), but it stays if we one hide it using ...
0
votes
1answer
62 views

CreateFileA returning invalid handle when file exists

I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
0
votes
0answers
58 views

How to hack fan control speed?

So I recently bought a new laptop (Acer Aspire A315-57g) on which I found that the cooling solution wasn't optimal, and I decided that I want more RPMs from my fan. However, I wasn't able to find a ...
0
votes
0answers
45 views

How are programs like 'StartAllBack' and 'T-Clock' developed?

There are many programs like StartAllBack and its predecessor StartIsBack which somehow modifies different aspects of Windows Shell (explorer.exe). How are these hook points discovered in the first ...
0
votes
1answer
88 views

Windows User Identification / HWID Limiting

I've been playing a game that has an HWID limit and a bunch of other limitations, such as: a) Cannot be ran in a VM b) Cannot be ran using Sandboxie and other Sandbox environments c) Limits 3 ...
10
votes
1answer
2k views

Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?

I'm debugging this process which has a lot of anti debugging techniques in it, and I faced something new which I don't know how to bypass yet. Changing the code dynamically causes exceptions to occur ...
1
vote
1answer
68 views

Is there any way to watch a block of memory of the current process for change?

I'm looking for a way to get notified when some block of memory of the current process change. To be more specific, I want to track when some fields of a struct change. Let's say I have one instance ...
0
votes
0answers
92 views

Windbg memory access error when trying to edit a string value of a button

So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using ...
2
votes
0answers
78 views

How to disassemble win32 function RegSetValueExW?

I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern. How do I actually disassemble RegSetValueExW_0?
2
votes
1answer
172 views

Extracting strings from binary files (.exe)

This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive. What I`m looking for is to build what Strings does from Sysinternals. My ...
2
votes
1answer
110 views

How to find sleep() in ollydbg or IDA or ghidra

I have a program which converts videos from a proprietary format into mp4. The conversion is very slow and CPU utilization is less than 1%. I'm able to speed up the conversion process via Cheat Engine'...
0
votes
0answers
41 views

Set standard input/output to a process using NtCreateProcessEx

In the official Windows API function CreateProcessA is possible set or change the standar input and output of the process vía LPSTARTUPINFO structure. How can do this using the undocumented function ...
7
votes
2answers
3k views

Can a Windows process check if it has been injected by another process?

There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger. Is it possible for a process to somehow detect if it has been ...
0
votes
1answer
27 views

How can a debugger break on dynamic loaded libraries?

I think I have a massive understanding problem with the following issue: Usually the loader will fix the Import Table for the modules that have been loaded, right, so if I set a breakpoint on ...
0
votes
1answer
238 views

which is harder to reverse engineer? [closed]

I'm planning on writing a windows application, used everywhere in my home country. I will code it in C++, but my question is which would you consider better to use? win32api Visual C++ MFC I'm ...
0
votes
1answer
107 views

Debugging Encrypted Malware with Multiple Threads

What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
1
vote
2answers
51 views

In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?

Take for example, 'kernel32.dll', the export table already provides the list of exported functions, then in what use case, would I need to download the debugging symbols for it from the MS symbol ...
3
votes
1answer
346 views

Finding AddressOfEntryPoint for a 64-bit process

Okay, so in the following code-snippet I am starting a notepad.exe process in a suspended state and trying to get the AddressOfEntryPoint of the process. Problem is I can't seem to find the actual ...
3
votes
1answer
275 views

CreateTimerQueueTimer arguments differs from WinAPI

I was reading a man page about CreateTimerQueueTimer. BOOL CreateTimerQueueTimer( PHANDLE phNewTimer, HANDLE TimerQueue, WAITORTIMERCALLBACK Callback, PVOID ...
0
votes
1answer
201 views

How to call WinApi from a breakpoint in IDA Pro?

When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint): //C++ code SCROLLINFO s; s....
2
votes
1answer
151 views

Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame

I'd like to use some undocumented symbols that listed in ProcessHacker project. taken from Here: https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpebteb.h#L241 https://...
3
votes
1answer
169 views

GetWindowLongPtr with undocumented nIndex of -1

I'm trying to reverse functionality of scrollbars in comctrl32.dll and I keep witnessing them calling GetWindowLongPtr function with undocumented index -1 as such: Does anybody know what that ...
1
vote
1answer
875 views

x64dbg how to set conditional breakpoint on WinAPI function

I am trying to solve a GUI based crackme. https://crackmes.one/crackme/5c68758633c5d4776a837cc4 so that I learn security. I want to set a conditional Break point on user32.CallWindowProcA. Microsoft ...
2
votes
1answer
2k views

What is the difference between kernelBase.dll and Kernel32.dll

What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ? Why both of them implement WideCharToMultiByte ?
1
vote
1answer
595 views

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. When I'm ...
3
votes
0answers
258 views

int 2eh instead of syscall/sysenter [duplicate]

I have been looking into ntdll.dll on windows 10 x64 bit, and i noticed a check inside the ntdll like this: So after testing some bit, it tries to execute the system call via int 2eh. I have tried to ...
1
vote
0answers
368 views

Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)

In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
3
votes
3answers
998 views

How to debug ServiceMain function of a service?

I have a malware which is checking for keyboard type and locale information. After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
0
votes
2answers
285 views

Can benign applications have such APIs?

I am new to malware analysis .. and I was analyzing some 'windows' apps and found functions that I thought it exist only on malware, is this possible or there is something wrong with my analysis ? I ...
2
votes
1answer
347 views

Missing kernel32.dll in import table

I have very basic application which is console app dispaying message box. In Visual Studio I change following options: - C/C++ -> SecurityCheck -> Disable Security Check (/GS-) - Linker -> ...
3
votes
1answer
859 views

How to debug slow Windows API calls?

My machine at work has recently been updated to Windows 10, from Windows 7, and it has become incredibly slow. The IT has installed a bunch of new tools for security and protection after the upgrade ...
2
votes
1answer
365 views

How to see ReadFile results with ProcMon

I running procmon to monitor my process, and see that my process uses ReadFile API. How can I see which data the process received when it uses ReadFile?
0
votes
2answers
87 views

Magic number in resource loading routine

I'm practicing windows disassembly on x64 notepad.exe I've managed to find buffer allocation and string resources load. But after that follows code, which I can't fully understand: rbx = 0, rdx = 0 ...
3
votes
1answer
149 views

Why does this function calls offset move when I restart windows

Every time I restart windows it breaks the patch I've made to an executable where I've called a function from the dll user32.dll. Currently the offset for the function call resides at 0x76E3CDB4, but ...
1
vote
2answers
6k views

What is \Sessions\1\BaseNamedObjects\NamedBuffer?

I see those in a debugger (OllyDbg, handles subwindow), but I never meet an explanation on what those are. Here is the full content of it, and to be honest I want to know the meaning of all of this. ...
0
votes
3answers
1k views

In Memory DLL Injection

I am currently working on learning how different types of DLL injection can be performed. Right now I am able to run a function by: Opening the remote process; Allocating memory in remote process; ...
1
vote
1answer
222 views

Find the code used when you right click and select "Bring To Front" in Task Manager

How can I find out what code is being called when you right click on a process in Windows Task Manager, and click on "Bring To Front" ? This is related to https://stackoverflow.com/questions/45046765/...
0
votes
1answer
133 views

Information about packers

i was trying to search for some information about packers just to learn more about it, there is a lot of stuff out there but its hard to find something that really explain that good and clear, I would ...
1
vote
2answers
672 views

Dumping Memory to Raw File

Is there a way to dump a section of process memory knowing the start and end address to raw bin file via a winapi function or some other method? I know that you can do this easily with a debugger, but ...
1
vote
0answers
58 views

Fighting programs that don't respond to Send/PostMessage-based input

This can be difficult to ask because 1) people assume this is necessarily malicious and 2) unrelated but effectual techniques like GetForegroundWindow can make this impossible to answer. So, to keep ...
-1
votes
2answers
592 views

How can I get the process information in windows without using APIs?

I want to write a program to obtain the information of process, for the purpose of detecting and combating malware. I can use C++ and Win32 APIs to finish it, but I then started suspecting those APIs ...
3
votes
1answer
510 views

How to debug packet processing with overlapped socket on Windows

The problem is quite complex so i don't want to run into unneccessary details. I have a network application, that communicates with multiple clients at once via UDP. I haven't written it and there is ...
0
votes
1answer
95 views

How to bypass this old windows application's free disk space check?

This windows application checks the available disk space when an attempt is made to enable a feature. The error message can be translated into "You need 2145461018 more bytes to load this tileset. ...
1
vote
2answers
319 views

Identifying DeviceIoControl argument

I am reversing an application that uses the serial interface (COM1 port) and am using API Monitor to trace through the API calls. I found a reference to CreateFileA("\\.\Commsb96", GENERIC_READ | ...
1
vote
2answers
233 views

MSDetour not detouring SHGetKnownFolderPath

Tried to hook SHGetKnownFolderPath from shell32, using the normal DetourFunctionWithTrampoline, and it could not. Investigating, it seen that the application use GetProcAddress to load the function, ...
0
votes
1answer
338 views

How to capture Data from OllyDbg window?

I'm trying to capture data from OllyDbg's info window (PWM_INFO), to do that I've captured that particular window using winspy++, how could i use the info provided by winspy++ with the WinAPI? I mean, ...
1
vote
3answers
1k views

Winapi ReadFile monitor

I'm trying to make a small proxy dll that will be able to print out all the files that a game tries to access from disk. I'm using a dinput8 wrapper dll as my proxy dll, from where I've managed to ...
1
vote
1answer
3k views

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

When I analyzed this malware sample it was invoking api's related to creating additional processes. With the process explorer I saw the debugged process is creating a new process. Please suggest any ...
4
votes
1answer
5k views

IDA python, list all imported functions

I have the following IDA python script. It sets and removes breakpoints on all calls to library functions: import idc import idaapi import idautils def set_breakpoints(): ea = idc.ScreenEA() ...
2
votes
1answer
283 views

Changes on threads and threading system, in new Windows OS

I looked up the source code of the functions like CreateProcess and CreateThreade from kernel32. For example, CreateThread@kernel32 leads into kernelbase.dll and ends with a call to NtCreateThreadEx. ...