Questions tagged [winapi]
Microsoft's application programming interfaces available in the Windows operating system.
17
questions with no upvoted or accepted answers
4
votes
0
answers
84
views
API Breakpoints not hitting while debugging a malware using x32dbg
I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful.
I am going through a malware analysis course and following the debugging ...
- 41
3
votes
0
answers
193
views
Why can't I view certain USER32.dll API calls in the disassembly?
I'm trying to understand and patch the GUI in Microsoft Edge. When I look at the disassembly in 2 different debuggers (x64dbg and cutter), the API calls responsible for much of the GUI functionality ...
- 31
3
votes
0
answers
120
views
WinApi of UWΡ Shаdοws
I want to ask which WinApi methods being used to draw shadows under flyouts on UWΡ.
What I know:
This shаdοw disappearing when hiding flyout (via SW_HIDE), but it stays if we one hide it using ...
3
votes
0
answers
273
views
How to disassemble win32 function RegSetValueExW?
I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.
How do I actually disassemble RegSetValueExW_0?
- 131
2
votes
0
answers
44
views
Redirect exception handler?
I'm working on a localization project and have a few trampoline hooks to translate some text in an online game. Periodically throughout gameplay, there are checks that run in the background to ensure ...
2
votes
0
answers
117
views
Frida hook InsertMenuItemW
I'm trying to get information about menu items in an application. Experimentally established that InsertMenuItemW is called. Thanks to the documentation, I set the number of input parameters and wrote ...
- 65
2
votes
0
answers
366
views
How to hack fan control speed?
So I recently bought a new laptop (Acer Aspire A315-57g) on which I found that the cooling solution wasn't optimal, and I decided that I want more RPMs from my fan. However, I wasn't able to find a ...
- 465
1
vote
0
answers
90
views
How to get the call stack of WinAPI functions?
Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
- 115
1
vote
0
answers
300
views
Windbg memory access error when trying to edit a string value of a button
So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using ...
- 21
1
vote
0
answers
529
views
Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)
In the core my question is about how to reverse engineer undocumented functions.
I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
- 11
1
vote
0
answers
68
views
Fighting programs that don't respond to Send/PostMessage-based input
This can be difficult to ask because 1) people assume this is necessarily malicious and 2) unrelated but effectual techniques like GetForegroundWindow can make this impossible to answer.
So, to keep ...
- 185
1
vote
0
answers
199
views
How do I access the TEB in PIN?
In PIN's documentation it says this about PIN_SafeCopy:
PIN_SafeCopy is used to copy the specified number of bytes from a
source memory region to a destination memory region. This function
...
- 121
1
vote
1
answer
726
views
Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied
I'm trying to inject my executable payload into remote process.
I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table.
When I'm ...
- 133
1
vote
2
answers
161
views
Identifying file-access functions used by explorer.exe
I'm trying to write a Windows 10 64-bit rootkit that runs on userland and hides files using IAT hooking. I managed to accomplish that on cmd.exe by hooking FindFirstFileW and FindNextFileW imported ...
0
votes
0
answers
44
views
Is game hacking all about memory manipulation?
I wanted to know if game hacking is all about manipulating memory ?
and If we need anything more than, this topics for game hacking ?
memory manipulation
Reverse engineering
Windows internals
C++ ...
- 1
0
votes
1
answer
644
views
Windows User Identification / HWID Limiting
I've been playing a game that has an HWID limit and a bunch of other limitations, such as:
a) Cannot be ran in a VM
b) Cannot be ran using Sandboxie and other Sandbox environments
c) Limits 3 ...
- 1
0
votes
1
answer
205
views
CreateFileA returning invalid handle when file exists
I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
